All eyes on deck

Ellen Fussell Policastro examines how video surveillance meets DCS integration for faster event response.

Video surveillance sees use for monitoring coastal traffic monitoring and preventing vandalism in a protected area — controlled via internet protocol. Photo from VideoTec.

The US Energy Information Administration names Angola as the second-largest oil producer in Sub-Saharan Africa. When an international oil and gas conglomerate in Angola became concerned about security on a floating production storage and offloading unit (FPSO), operations managers responded by asking to increase visibility to the operation — a costly move in such a remote location. The unit operators needed to keep an eye on their safety system, especially flame monitoring, as well as the workstation onboard the FPSO.

In response, an industrial ethernet provider for the oil and gas industry teamed-up with a control and instrumentation systems provider to implement the critical process control system for the platform. Using a video encoder, the system migrated from analog closed-circuit television (CCTV) to internet protocol (IP) networks. This allowed seamless integration of the process control systems and IP video systems, giving the FPSO alarm-to-video monitoring.

The good news is operators can now see more and respond faster to potential safety and security events. The bad news is distributed control system (DCS) integration could bring more potential for cyber security threats.

Detailed Project Picture

An IP camera is a digital video camera that can send and receive data via a network and the internet. The Angola project required 232 IP video cameras linked to heat sensors at each workstation. With the trigger of a heat sensor came an alarm and recorded video with time-stamping mechanisms.

Operators can view an event remotely, even days after, because the system logs and stores event information. They can also search for event information in a central database and play it back for details about what triggered the event. “This gives the user not only a way to view in real time exactly what is happening in the field, but a way to take corrective action from the control room, or immediately send the proper team to respond,” said Thomas Nuth, manager for global oil and gas systems at Moxa, Inc., in Brea, California.

The video recording function for the control system provider’s video management system offered historical playback and search of events that triggered the system. “We make use of the video encoder to convert the video analog signal to TCP/IP,” says Francis Goh, of Yokogawa Electric International, in Singapore. “Detectors are also segregated in zones,” he says, “and we even have event video recording for a duration of three minutes.”

Harry Hsiao, product manager of the industrial video networking division at Moxa, worked with Yokogawa Engineering Asia, combining the DCS system with IP video. “The benefits of the rugged CCTV systems are short response time in the field of sight because the video image pops up automatically once an event has happened, which means less money lost in system downtime or broken equipment,” he says.

When the DCS receives an alarm, it sends an event trigger to the surveillance server. The video surveillance system immediately retrieves video streams from the relevant industrial video encoder unit and initiates recording and playback functions. At the DCS control center, a built-in viewer allows engineers to review event logs and corresponding video in a single glance.

IP Video, DCS Integration

Video cameras have two important roles in offshore security plans, said Gianni Viero, a vice president at VideoTec, a CCTV industrial video equipment provider, headquartered in Schio, Italy. “The first is assessing detected alarms and confirming their cause; the second is surveillance,” he said. With live video stream that monitors activity approaching the platform, operators can immediately “direct a response force to counteract and confront any intrusion,” Viero said.

While the camera isn’t a magic pill, it can be a key part of the revolution that’s happening in oil and gas – the addition of ethernet.

“While DCSs are redundant and reliable, they don’t have a lot of bandwidth, but IP video does,” Nuth says. And with the integration of fiber and internet, the DCS can grow more intelligent.” Integration happens by adding another layer of networking or an auxiliary network. “So if the wireless system fails, operators will still be able to manage,” Nuth says. And if there is an explosion or spill, they can now respond faster to fix the problem.

“The great thing about ethernet is it’s attached to sensors in the field,” Nuth said. “Cameras can be tethered to these meters, and because the cameras watch over the DCS and part of the DCS operation, operators can use them to survey everything in the core operations through supervisory control and data acquisition (SCADA).” Operators in the control room can see what’s happening on the platform through a live video feed. “It’s a network of controllers feeding into the central human machine interface (HMI) to a computer screen, and one person can control what’s going on. But now with the cameras, they can see more.”

Before IP video surveillance, “these systems were all proprietary, so if you had one particular vendor, you had to use that vendor’s cabling system, coax, VHC, and twisted pair wires,” Jonathan Pollet, founder and executive director at Red Tiger Security in Houston, says. “The biggest benefit of the convergence to IP is the ability to deploy video to places that are not geophysical—limited.

“With the older systems that ran over coax, you could only push that video out so far. Then you needed to repeat that signal every 1700ft. With IP cameras you can go as far as you want either with fiber optics, category 5 or 6 cable, or wireless, putting a canopy over the rig.”

Eye on Safety

Fred Czubba, senior business development manager for oil and gas at Phoenix Contact in Middletown, Pennsylvania, has seen how cameras can save lives offshore. “In the North Sea, temperatures are close to subzero,” Czubba says. “I wouldn’t want my operators out at night to investigate a problem when I can have a camera out on the catwalk. The two highest quantifiable sensors offshore are fire and gas. So if either of those detects a leak, they will show in which zone, but not the actual location. If you have a camera at that location, you can actually see the white cloud where something is leaking.” Nobody would need to enter a potentially dangerous situation.

“The flare always burns with a little pilot light, and if one of those turbines shuts down, that flare becomes a 600ft candle,” Czubba says. “If the compressor fails, suddenly you’re venting pure gas into the atmosphere. With the cameras, you can see the pilot went out, and you know you need to reignite it.”

The project in Angola had 224 workstations attached to temperature and pressure meters with a high probability of flame damage or flare-up. “Since they are so remote, you can’t have somebody managing each workstation at all times,” Nuth says. If the meters exceed a certain pressure and temperature, the sensor will send an alarm via remote monitoring to the control room. They’ll also receive the alarm by phone and email. Simultaneously, the cameras will come on. Then the event log will turn on, so this event will be saved at the moment it exceeds a certain pressure and heat level. Not only can operators see immediately what has happened, they can post-reference to see how the problem occurred. They can assess the problem remotely and implement corrective action.

Physical Intrusion, Cyber Concerns

If someone approaches a rig, operators will be alerted. Some cameras have microphone capabilities and can allow operators to speak to potential intruders. When fishermen or tugboats tie off onto the rig in rough seas, operators can use a high-powered speaker to ask them to identify themselves. The camera’s recording capabilities come in handy for security issues as well. “As soon as an object changes the pane of view (someone approaching), operators have a cache of the previous 10 seconds, the actual action, and the following ten seconds after the object or person leaves the pane of view,” Pollet says.

But while integration can be great for business and provide a cost-effective way to monitor the platform, cyber intrusion through the network is a big concern. Rigs are often targets for malicious activities, especially in remote areas, and one way to gather intelligence is to hack into a camera system. “Terrorists might want to take over the rig’s assets or personnel for ransom, which has actually happened at an oil refinery in Europe,” Nuth says. “They might have planned a successful infiltration by hacking cameras to see where the assets are located. But the video encoder converts the video feed from the camera to the recipient — whether in the control room or on the PC at home — so nobody can intercept.”

However, “encoding the video only protects the video content from being hijacked or altered in transit from the camera to the software,” Pollet says.

“It only protects the video stream. If the video system is integrated with the control system, hackers would not be targeting the video content itself, but instead would use vulnerabilities in the video servers, workstations, and cameras to move from the video environment to the control system environment.”

Any IP-enabled system that integrates with or affects the DCS should go through a comprehensive cyber risk assessment first to ensure design does not open the system to additional risk, Pollet says. He’s seen actual cyber intrusions in which hackers used the video surveillance camera to get into the system.

“My main concern with this movement to IP is to make sure it’s isolated and not connected to the control system. Unfortunately installers want the ability to go in remotely — through the internet.”

While Pollet wants to keep the networks secure with separate systems, he understands why the industry is reluctant to separate them — because of the “limited bandwidth, limited communications, and one satellite uplink. So they end up converging all those systems to save money,” he said.

Pollet believes this to be a problem in terms of security: “The danger here is that you’ve put two different systems that serve two different functions on the same cyber network. If the video surveillance system is not locked down and secure, someone could access the video system from a business network or Internet and use the video system as a way to link themselves into the DCS system. If it’s all integrated together, and I can access the video system, I’m on the same network. So now I can access the pumps, valves, operator screens, and the entire control system.”

This theory is not a popular one with some on the operations side.

“If I make these systems separate, do I now need a separate monitor? I don’t have acres of space in my offshore platform control room — not like in a refinery,” Czubba says. “In today’s world, everything works in an enterprise mode to make money, and the enterprise is connected from top to bottom. Nothing is going to change that, because making money is still the key.

Now I hear the only way you can be protected is to be isolated from the network? No way. Not when we spent the last 20 years integrating everything for efficiency and economics.”

“If they made that big of an investment, of course they will want remote access capability,” Pollet says. “But that doesn’t necessarily mean it’s integrated into the DCS. But if they have integrated it, they need to make sure security controls and perimeter protections are in place around the system,” he says. “There should also be controls on who can access information, as well as two-factor authentication with a user name and password unique to that person.”

Those working with this day-to-day might say, “It’s just video. I can’t control anything or alter the operations of the rig just by watching it.” But there has to be proper isolation, Pollet says.

“How have they performed security to ensure these networks are truly separate?”

Future Vision

IP video will only get less expensive, more reliable, and more widely accepted in the next five years. “People are going to have constant availability and control for their networks, onsite and remotely, whenever they want,” Nuth said. “Money is the only downside. But just as with increased automation and diagnostics to airplanes, which ultimately reduced crashes, we’re chopping away at catastrophic events little by little. That’s huge in this industry.”

Pollet agrees everything will converge into IP protocols, “but you just need to make sure cyber security has been applied to keep these networks isolated and separate, based on functionality,” he said.

“Your voice systems should not be talking over the same IP network as the alarm system. The video should not be on the same network as the control system. And that will require more input from cyber security. We’ll see a greater deployment of firewalls to secure IP phones and video surveillance systems.”

They will also want to send their logs to someone who can review them.

“You won’t want logs from your computer network going to one security internet manager and logs from your video system going to another,” Pollett adds.

All cyber-related logs will go to one security operations center, Pollet says. And business will grow for incident responders, cyber analysts, and security operations centers.

As far as Czubba is concerned, “you cannot operate a modern FPSO without cameras.”

Hazardous Location Standards Apply to Cameras

Of course IP video equipment must be durable enough to withstand harsh conditions. Underwriter Laboratories (UL) Class 1, Division 2 (Div 2) requirements and ATEX certification are top priority.

The US National Electrical Code says hazardous material may exist in normal and abnormal conditions. Division 1 is a normal condition, and Division 2 is abnormal. Classes 1, 2, and 3 hazardous locations can fall under Division 1 or 2. In a Class 1, Div 2 area, gas and hazardous vapors could be present via leakage or system failure. In a Class 1 Div 1, area, you can assume the presence of gas and hazardous vapors at all times. “These cameras live in harsh environments with corrosive gases -- from arctic temperatures to equatorial temperatures -- minus 40 to plus 80 degrees C,” says Fred Czubba, senior bsusiness development manager for oil and gas at Phoenix Contact in Middletown, Pennsylvania. “In these environments, Class 1, Div 2 is very important. The Class 1, Div 1 enclosure means totally explosion proof,” Czubba says.

ATEX standards refer to the European Union’s directives. ATEX directive 94/9/EC addresses equipment and instrumentation intended for use in potentially explosive atmospheres. It covers safety equipment, such as gas detectors and requirements for equipment used in explosive areas. The ATEX directive, like the US., distinguishes between two types of explosive atmospheres: gas and dust. Areas within these atmospheres are each divided into three sub-zones (comparable to the US Divisions). Zones 0, 1, and 2 refer to gas; Zones 20, 21, and 22 refer to dust.

When Gianni Viero, a vice president at VideoTec in Schio, Italy, and his team installed 37 units of stainless steel housings to monitor pipelines on an offshore platform for Arab Petroleum on the coast of Egypt’s Suez Canal, he had to ensure they were intrinsically safe because of the flammable gases present. “With these stainless steel cameras, we analyze each mechanical detail to provide equipment that meets standards for reliable and resistant industrial use, especially for use in conditions that cause intense corrosion from the sea,” he says. Such explosion-proof products need to be “internationally certified to meet the rigorous requirements for installation in hazardous areas with explosive risk.”