TETRA-RTU and TETRA-Modem TMO-100 April 2015 Funk-Electronic Piciorgros

TETRA-RTU and TETRA-Modem TMO-100 April 2015 Funk-Electronic Piciorgros Gmb. H Michael D. Piciorgros (CEO)

Information Source www. Tetra. Modem. com Piciorgros Gmb. H * Germany

Funk-Electronic Piciorgros Gmb. H (TETRA Business) Wireless Solutions from 1982 until 2015++ Member of the TETRA Association (Mo. U/Tand. CCA) Core Manufacturer (Own TETRA Terminal) IOP certified from ISCOM (Italy) Member of the SME Group Piciorgros Gmb. H * Germany

Funk-Electronic Piciorgros Gmb. H (TMC-200 / T-One Terminal) 350, 380, 410, 450, 800 MHz Status, SDS, Packet Data, MSPD Authentication, Encryption, TEA 1, 2, 3 Piciorgros Gmb. H * Germany

Funk-Electronic Piciorgros Gmb. H (National Approvals) EU (BABT Certificate) Hong Kong, Thailand, Russia FCC (USA), IC (Canada) Philippines, Australia, Malaysia Piciorgros Gmb. H * Germany

Piciorgros Gmb. H * Germany

Funk-Electronic Piciorgros Gmb. H (IOP Certificates) Rohill SELEX EADS / Cassidian 3 T-Frequentis (Sepura) Damm, Motorola Teltronics Hytera, (ETELM) Piciorgros Gmb. H * Germany

Piciorgros Gmb. H * Germany

Piciorgros Gmb. H * Germany

TMO-100 = Tetra MOdem -100 Second Generation Professional TETRA Data Modem with Voice Option Piciorgros Gmb. H * Germany

Typical SCADA Server Layout Ref: Scada: Wikipedia Monitor: Samsung Piciorgros Gmb. H * Germany

TETRA Modem - TMO-100 with two serial Ports, one Ethernet Port and an optional Audio Port Piciorgros Gmb. H * Germany

TETRA Modem - TMO-100 as before with additional embedded I/O Piciorgros Gmb. H * Germany

Power Supply: 12 Volt up to 24 Volt +/-20% Piciorgros Gmb. H * Germany

Heavy Duty Connectors Piciorgros Gmb. H * Germany

DIN-Rail Mounting Piciorgros Gmb. H * Germany

SMA Antenna Connector Piciorgros Gmb. H * Germany

16 digital Inputs including … 8 Event Counter and 8 Timer (*) All inputs visible as LED Piciorgros Gmb. H * Germany

8 (16) digital Outputs PNP open Collector (500 m. A each) All Outputs visible as LED Piciorgros Gmb. H * Germany

4 analog Inputs 0 -20 m. A or 4 -20 m. A Piciorgros Gmb. H * Germany

8 LED Field Strength Bar Graph indicating –d. Bm values Piciorgros Gmb. H * Germany

Antenna Match LED (AMA) Indicates no, or faulty connected Antenna Piciorgros Gmb. H * Germany

Two Serial Ports on top (DSub) RS-232 or RS-485 / (RS-422) Piciorgros Gmb. H * Germany

10/100 MB Ethernet Port Piciorgros Gmb. H * Germany

Connector for Microphone/Speaker (Hardware Option) Piciorgros Gmb. H * Germany

Large Variaty of Expansion Modules (Hardware Option) Piciorgros Gmb. H * Germany

TETRA Data Network Structure Radio-to-Radio Piciorgros Gmb. H * Germany

SCADA using SDS based Radio-to-Radio Communication SCADA Control Room Serial Interface SDS Public Lighting TMO-100 Serial Communication SDS TMO-100 I/O Command Control Device TMO-100 SDS Serial Interface Tetra Switch TMO-100 Piciorgros Gmb. H * Germany PLC / RTU

TMO-100 TETRA Data Modem Network Structure Data Gateway-to-Radio Piciorgros Gmb. H * Germany

Highly Redundant TETRA Packet Data Gateway for SCADA Critical Operation Piciorgros Gmb. H * Germany

Highly Redundant TETRA Packet Data Gateway for SCADA Critical Operation Supported Protocols: n MODBUS-RTU n IEC 60870 -5 -101 n DNP 3 n ROC n BSAP n Pak. Bus n Siemens SINAUT n any customer specific or proprietary protocols Piciorgros Gmb. H * Germany

Highly Redundant TETRA Packet Data Gateway for SCADA Critical Operation Features: n COM Ports: RS-232 or RS-485/422, Subin-D pole female n AUX Ports: RS-232 or RS-485, RJ 12 pole female n Ethernet Ports: One (TGW-100) or two (TGW-100 R) n Ethernet interfaces: RJ-45, 10/100 MBps n Power Supply Dual Power Supplies – hot swappable n Enclosure dimensions: Complete 19" rack approx: 48, 4 * 13, 2 * 33 cm (no cables included) Piciorgros Gmb. H * Germany

SCADA – using an SDS Gateway Public Lighting Control Room TMO-100 SDS Two Serial Interfaces SDS TGW-100 SDS Gateway TMO-100 I/O Command Control Line Device IP Communication SDS AMR TMO-100 TETRA Switch Piciorgros Gmb. H * Germany

Performance Test with SDS-Gateway on ONE SCCH/MCCH: Infrastructure: TETRA with one carrier TETRA Data Link: One SCCH Data Compression: OFF Data nodes: One or more polling nodes, polling 10 TMO-100 each Protocol: Modbus RTU Polling Target: Polling different numbers of bytes from inside the TMO 100 One Node SDS: 20 Bytes Two Nodes Three Nodes Four Nodes Eight Nodes 65 130 240 250 295 SDS: 100 Bytes SDS: 200 Bytes Table showing polls per minute 285 265 Piciorgros Gmb. H * Germany

Performance Test with SDS-Gateway on FOUR SCCH/MCCH: Infrastructure: TETRA with one carrier TETRA Data Link: MCCH plus three SCCH Data Compression: OFF Data nodes: One or more polling nodes, polling 10 TMO-100 each Protocol: Modbus RTU Polling Target: Polling different numbers of bytes from inside the TMO 100 One Node Three Nodes Four Nodes 16 Nodes (on each TS) SDS: 20 Bytes Two Nodes (on each TS) 210 400 600 760 980 SDS: 100 Bytes SDS: 200 Bytes Table showing total polls (on all time slots) per minute (values rounded) Piciorgros Gmb. H * Germany

SCADA – using a Packet Data Gateway SCADA Control Room TMO-100 I/O … or Serial Interface PD Two Serial Interfaces PD TGW-100 SDS Gateway TMO-100 Command Control Line Device IP Communication PD Serial Interface Tetra Switch TMO-100 Piciorgros Gmb. H * Germany Analog and Digital I/O PLC / RTU

SCADA – using direct IP Communication SCADA Control Room IP PD TMO-100 PD Direct IP Communication TMO-100 I/O Command Control Line Device PD IP Tetra Switch TMO-100 Piciorgros Gmb. H * Germany AMR, PLC or RTU

SCADA – using a Packet Data Gateway SCADA Control Room TMO-100 I/O … or Serial Interface PD PD PLC / PRTU TMO-100 Command Control Line Device PD TGW-100 SDS Gateway Serial Interface IP Commu -nication TETRA Switch TMO-100 Piciorgros Gmb. H * Germany Analog and Digital I/O PLC / RTU

TMO-100 TETRA Data Modem Feature List Piciorgros Gmb. H * Germany

Embedded Web-Browser Piciorgros Gmb. H * Germany

Embedded IP and TETRA Router Piciorgros Gmb. H * Germany

Embedded my. SCAD Micro SCADA Piciorgros Gmb. H * Germany

Embedded my. SCAD Micro SCADA Piciorgros Gmb. H * Germany

PLE - Powerful Java Graphic Editor Piciorgros Gmb. H * Germany

No Cryptic Formulas for Logic design Piciorgros Gmb. H * Germany

Powerful embedded Micro PLC Piciorgros Gmb. H * Germany

TMO-100 TETRA Data Modem Features Piciorgros Gmb. H * Germany

TMO-100 - TETRA related Features n n n n SDS can be up to 255 bytes (2047 Bit) long. Type TL and TL 4 Packet Switched Data (IP) supported Packet Data Channel Sharing supported Single and Multi Slot Packet Data supported Secondary Control Channel supported Automatic PPP Link set up to the TETRA Switch Router Function with Port Forwarding and NAT Up to 3 Watt RF Output Power Encryption, Authentication Voice feature even with active Packet Data Link Build in Tetra Monitor (local and remote) via embedded Web Server Calibrated Field Strength Indicator on the Front Panel Short Data or SDS can be sent as alarms (low field strength. . . ) 350 MHz, 380 MHz, 410 MHz 450 MHz and 800 MHz available Piciorgros Gmb. H * Germany

TMO-100 – Voice Option n Standard 8 Pin Connector for Mic. Speaker handset n One Group Number (GISSI) to be programmed n Eight individual Numbers (ISSI) to be programmed n ISSI and GISSI to be programmed locally or remotely using the embedded Web Server n Select ISSI / GISSI by Voice Handset n Automatic PPP disconnect when pressing PTT n Automatic PPP re connect after Voice timeout or reject Piciorgros Gmb. H * Germany

TMO-100 – Protocol and I/O related Features n All digital and analog I/O isolated Serial Port COM / AUX available as RS-232 or RS-485/(422) Level 1 Protocol: Timeout or 3964 R Serial Protocols can be sent via SDS or Packet Data (So. IP) IP Protocols can be sent via Packet Data or SDS (IPo. SDS) Device Protocol to access internal Registers: Modbus RTU, Modbus IP, IEC 60870 -5 -101, IEC 60870 -5 -104 n Serial Protocols to be forwarded: Modbus RTU, DNP 3, IEC 60870 -5 -101, Pak. Bus, BSAP, ROC, … user Defined … n n n n n Ethernet 10/100 MBit IP-Port for Local Network UDP and TCP supported Embedded Web Server as Configuration Tool Modbus/IP, IEC 60870 -5 -104 (!), DNP 3/IP, … others … Low Power Consumption: <3 Watt Piciorgros Gmb. H * Germany

Pico. Logo™ – User Application Interface n n n n Easy to use graphical user interface Optimized for Tetra Infrastructure Basic Logic Functions (and, or, exor, … ) Complex Logic Functions (delay on, delay off, flip flop, …) Analog Functions (analog compare, … ) Timer and Clock Functions (time, date, Dynamic Text Message generation for Alarms and Status GPS Functions (position, … ) Modbus RTU Slave (set and read register, coil, … ) Modbus RTU Master (set and read register, coil, … ) E-Mail send (sending text and alarm messages by e-mail) SNMP Trap (automated machine messaging) … more … Piciorgros Gmb. H * Germany

TMO-100 – Embedded Web Server n Web Server to be used as … Configuration Tool for the Device, Protocols and IP Parameter, Configuration Tool for TETRA Network Parameter, Configuration for the Voice Option TETRA Monitor Device Monitor Error Log n Web Server can be accessed locally using the IP Port and remotely over the TETRA Infrastructure n Easy to be used with any Web Browser (Firefox, Internet Explorer, … ) Piciorgros Gmb. H * Germany

TMO-100 TETRA Data Modem Unique Features Piciorgros Gmb. H * Germany

TMO-100 n Feature rich All in One SCADA and Telemetry Solution n TETRA-Modem and TETRA-RTU n Interfaces fit the User Requirements and User Protocols (no ATDT. . Commands) n Embedded WEB Server n Embedded IP Router n Optional build in Digital and Analog I/O n Optional Voice Feature n Field proven in many applications n IOP approved for most of the existing infrastructures n IC and FCC approval n 3 Watt RF power output in 350 – 470 MHz range n DIN Rail Mounting and 12 -24 Volt DC +/-20% power supply n New: Over The Air Upgrade of Modem and TETRA Stack Piciorgros Gmb. H * Germany

Typical SCADA Applications: Piciorgros Gmb. H * Germany

Open Pit Mining (Water Level Control) Piciorgros Gmb. H * Germany

Turkey, Mining Application – DMO Mode Piciorgros Gmb. H * Germany

ME, Gas and Oil Piciorgros Gmb. H * Germany

Asia, Utility (Energy Companies) Pole Mounted Switches Piciorgros Gmb. H * Germany

TETRA Data Applications IP Risks and IP Security Piciorgros Gmb. H * Germany

The search term “Cyber Attack Industry” Gives more than 2. 400. 000 Results Piciorgros Gmb. H * Germany

Piciorgros Gmb. H * Germany

Piciorgros Gmb. H * Germany

Potential IP Risks (Back Doors) Control Room Air Interface Remote Modem Piciorgros Gmb. H * Germany

Risks using IP Communication via wireless Infrastructures to Remote Outstations SCADA Control Room IP PD TMO-100 Remote Modem Control Room PD TMO-100 Router / Gateway Command Control Line Device PD IP Tetra Switch Air Interface TMO-100 Piciorgros Gmb. H * Germany I/O AMR, PLC or RTU

Potential IP Risks (Hacks) n Access from the Sw. Mi side to the remote modems (RTU’s) Hacker send Control and Command data to the remote RTU’s n Access from the remote devices to the SCADA Server (Intranet) Hacker try to access and stress the Intranet, SCADA Server or any other Intranet Server n Access via the Air Interface (using a spare TMO-100) Hacker try to access the Intranet or try to send commands to the Outstation RTU’s n IP Data flooding via a remote device Hacker try to flood and stress the TETRA Infrastructure with data packets n Using IP Services to access the Intranet via a Remote Modem Hacker try to use services (ports) like Telnet, FTP or others to access and stress the Intranet Piciorgros Gmb. H * Germany

TMO-100 Protection and Firewall(s) n Access from the Sw. Mi side to the remote modems (RTU’s) The IP Server Source Address received by the TMO-100 can be restricted to a specific IP Address or a specific IP Address range n Access from the remote devices to the SCADA Server (Intranet) The RTU Source Address received by the TMO-100 can be restricted to a specific IP Address or a specific IP Address range n Access via the Air Interface (using a spare TMO-100) Enable AIE to avoid unwanted Access via the Air Interface n IP Data flooding via a remote device A configurable IP Flooding Filter stops the data flow for a specific time (5 minutes), after the TMO-100 has received a specific number of IP Packets (5 packets) in a specific time frame (10 seconds) n Using IP Services to access the Intranet via a Remote Modem Optional all IP ports can be disabled while up to 5 can be enabled individually Piciorgros Gmb. H * Germany

Piciorgros Gmb. H * Germany

Funk - Electronic Piciorgros Gmb. H Claudiastr. 5 51145 Köln-Porz Germany Thank you very much for your interest in our Products www. piciorgros. com www. tetramodem. com Piciorgros Gmb. H * Germany