# Presentation: 208109

## SNS Controls System Software

**ICS Software Planning and Status Meeting**** **
**(Preliminary Planning)**
**Ernest L. Williams Jr.**
**Revision 1: February 1, 2001**

## Supported Host/Target Development Platforms

**Red Hat Linux 6.2/7.0 (running on PCs)**
**Solaris 7/8 (running on Sun Workstations)**
**vxWorks 5.4 – running on MVME2101 (powerPC)**
**vxWorks 5.4 – running on MVME2302 (powerPC)**
**vxWorks 5.4 – running on MVME167 (68k)**

**Notes:**
The MVME2101 has a PowerPC 32-bit processor --- MPC8240 (Architecture is PowerPC 603e – 200MHz – 32MB of RAM)
The MVME2303 has a PowerPC 64-bit processor --- MPC8240 (Architecture is PowerPC 603 – 200MHz 32MB of RAM)
The MVME167 has a 68K 32-bit processor --- M68030 (Architecture is 68K – 33MHz 8MB of RAM)

## Supported Host/Target Development Platforms

| Software | Version
(in use) | Version
(recommended) | Purpose |
| --- | --- | --- | --- |
| Red Hat Linux | 6.2 | 7.0 | EPICS Development and Operations |
| Solaris | 7 | 8 | EPICS
Development and Operations |
| VxWorks | 5.4 | 5.4 | Target Operating System for 
EPICS IOCs |
| MS Windows | NT 4.0 | Windows 2000 | Allen Bradley Programming Software Environment for PLCs |

- Note: The SNS ICS has standardized on the Linux Platform.  The Software Engineering group has successfully
- migrated all of the EPICS client-based tools to Red Hat Linux 7.0.  We are stiil working to get the VxWorks development
- Environment ported to Red Hat Linux 7.0  (recall that this depends on WindRiver)

## Controls Software Tools on Solaris (Compilers)

**SparcWorks C/C++-compiler (not recommended)**
**SparcWorks Fortran Compiler**
**GCC 2.95.2 – GNU Compiler Collection Suite**
**C compiler**
**C++ compiler**
**Objective C compiler**
**Chill compiler**
**Fortran compiler**
**Java**
**GCC 3.0 (coming soon, Q1  2001)**

**Notes:**
CHILL (CCITT High Level Language) is a general procedural programming language which is mainly used in the field of telecommunications. As a general programming language it is by no means limited to this field. A number of CHILL programming environments are also implemented in CHILL. Some more details can be found in a paper by K. Rekdal. 
The current official definition of CHILL is the standard: ITU-T Recommendation Z.200 (11/99) / ISO/IEC 9496:1998(E)
This standard can be obtained from ITU-T in Geneva or from ISO. 
A new version of CHILL has been accepted by WTSC in the autumn of 2000 (CHILL2000). 

Objective-C is a powerful, easy-to-learn, object-oriented extension to C. Unlike in C++, advanced object-oriented features like dynamic binding, run-time type identification, and persistence are standard features in Objective-C which apply universally and work well together. Moreover, the support for descriptive message names (a la SmallTalk) makes Objective-C code easy to read and understand. Objective-C is supported by the GNU and NeXTSTEP C compilers. 

## ICS Software Compilers on Solaris

| Software | Version
(in use) | Version
(recommended) | Purpose |
| --- | --- | --- | --- |
| SparcWorks 
ANSI C/C++
Compiler | 6.0 | Not necessary for EPICS | Compiling Application Software |
| SparcWorks 
Fortran Compiler | 7 | Not necessary for EPICS | Compiling Application Software |
| GNU GCC | 2.95.2
 | 2.95.2
 | Compiling Application Software |
| JAVA/JRE | 1.3 | 1.3 | Compiling Application Software |
| GNU Make | 3.74 | 3.79.1 | Compiling Application Software |

- Note: ICS will move to GCC 3.0 when it is stable/available
- Note: If one wanted to created a host-native 64-bit application the SparcWorks compiler is useful.

## ICS Scripting Languages on Solaris

| Software | Version
(in use) | Version
(recommended) | Purpose |
| --- | --- | --- | --- |
| TCL/TK | 8.3.1 | 8.3.1 | Building GUIs and software applications |
| Python | 1.6a | 2.0 | Building GUIs and software applications |
| PERL | 5.004
 | 5.6.0
 | Building Application Software |

- Note: ICS will move to Python 2.0.  PERL will always be needed for building EPICS
- Note: All of the above scripting languages have an interface to TK to facilitate building GUIs

## Other required Host Software on Solaris

| Software | Version
(in use) | Version
(recommended) | Purpose |
| --- | --- | --- | --- |
| SSH/openSSH | SSH 2.0.12 | openSSH 2.3.0p1 | Secure remote access |
| CVS | 1.10.7 | 1.11 | Software Version Control |
| EMACS | 20.4.1
 | 20.4.1
 | Powerful Text-based Editor |

## EPICS Base and Extensions

**EPICS version R3.13.3 with extensions**
**EPICS BASE R3.13.3**
**Client side channel access (ca) utilities**
**caGet, caPut, caInfo, caget, caput, camonitor.....**
**Medm, dm2k, edm**
**Channel Archiver, StripTool, alh, burt**
**DataCatcher, Viewer, ScanSee (IDL???)**
**Dct313 (tcl version), gdct, oracle-based dct (recommended)**
**Jdct (java-based), jprobe (java-based)**
**probeII, SDDS**
**PV gateway (channel access server)**
**Xmca**
**Km (knob manager)**
**AR/ARR (old retrieval tool)– not recommended**
**MATLAB, MATHMATICA ..... ?????**

## EPICS Support Modules and Drivers

**EPICS Support Modules and Drivers**
**IPAC**
**MPF**
**mpfSerial (8-chan RS232 IP module)**
**mpfGpib (IEEE488 IP module)**
**dac128V (8-chan 12-bit D/A IP module)**
**Ip330 (16/32-chan SI/DI 16-bit A/D IP module)**
**NewPort Motor Controller(MM3000/MM4000)**
**Motor Support**
**Stepper Motor (APS Motor Record)**
**	****OMS VME58 support**
**     ****NewPort Controller Support**
**Allen Bradley Support**
**Support via AB 6008 VME Scanner**
**Support via ether_ip driver**
**synApps Support (from APS beamlines)**
**vxStats Support (LBL IOC test routines)**
**Magnet Power Supply Record Support**
**?????? What Else for drivers?**

## ICS Computer Maintenance and Administration

**Back-up and Recovery Plan**
**Amanda Scripts**
**Disk Mirroring/RAID, etc...**
**Computer Security Management**
**Respond to security scans**
**Apply patches**
**Software Installation and Maintenance**
**Apply patches**
**Keep OS stable**
**Keep software licenses up to date**
**High Availability Architecture to facilitate upgrades or repair**

## ICS Application Development Environment (ADE)

**The ICS ADE is currently set-up on sofa**
**Sun Workstation (w/ Solaris 7)**
**On loan to SNS**
**New SNS office network change will make sofa unreachable**
**The ADE will move to the new server (ics-srv01)**
**Sun Workstation – Ultra 10 (w/Solaris 8)**
**4mm DAT Back-up Device (40GB capacity)**
**256 MB of RAM, 9.1GB drive, additional 20 GB drive**
**We own it (thanks to John Galambos)**
**ADE Documentation update in progress**
**Migration Plan from sofa to ics-srv01 in progress**

**Notes:**
The ADE Development Team is working to improve the ADE Architecture. 
We are also working to migrate the ADE to our new EPICS Server (ics-srv01.sns.ornl.gov)
Currently myself and Steve Lewis are working on the initial framework.
Then I will present a draft plan for review to:
John Munro/Delphy Nypaver – ORNL
Johnny Tang --- BNL
Bob Dalesio/Kay Kasemir – LANL
Carl Lionberger --- LBL

## ICS Available Development Hardware

**16 Port Serial Port Server**
**Provides transparent access to remotely located serial ports**
**Makes tipping into EPICS IOCs easy**
**PLCs will download/upload instructions**
**PLCs will go online for quick monitoring/remote trouble-shooting**
**12 PowerPC-based EPICS IOCs**
**10 MVME2101s (ICS Development Lab)**
**1 MVME2302 (ICS Development Lab)**
**1 MVME2101 (deployed for Target Test Facility)**

## Controls Network Plans in progress

**Major Controls System Networks**
**ICS Accelerator Operations Networks**
**Accelerator Systems Controls**
**RF Systems Controls**
**Low-Level RF Systems Controls**
**Beam Diagnostics Controls**
**Vacuum Systems Controls**
**Power Supply Systems Controls**
**Personnel Protection Systems Controls**
**Conventional Facility Systems Controls**
**Cryogenic Systems Controls**
**Target Systems Controls**
**ICS Accelerator Maintenance Networks**
**ICS Development Networks**
**SNS User Instrument Systems Networks**

## Controls Network Plans in progress (Cont’d)

**Each of the networks will be addressed via a Private IP Addressing Scheme**
**ICS will use a Class B IP allocation**
**172.31.0.0**
**Subnets will be created via VLAN technology**
**Bandwidth conservation**
**Flexibility**
**performance**

**Notes:**
Virtual networking has rapidly become one of the major new areas in the internetworking industry. Virtual networking refers to the ability of switches and routers to configure logical topologies on top of the physical network infrastructure, allowing any arbitrary collection of LAN segments within a network to be combined into an autonomous user group, appearing as a single LAN. Virtual LANs (VLANs) offer significant benefits in terms of efficient use of bandwidth, flexibility, performance, and security. VLAN technology functions by logically segmenting the network into different broadcast domains so that packets are only switched between ports that are designated for the same VLAN. Thus, by containing traffic originating on a particular LAN only to other LANs within the same VLAN, switched virtual networks avoid wasting bandwidth, a drawback inherent in traditional bridged/switched networks where packets are often forwarded to LANs that do not require them. This approach also improves scalability, particularly in LAN environments that support broadcast- or multicast-intensive protocols and applications that flood packets throughout the network. Figure 1 depicts a typical VLAN, where traffic is only switched between LAN interfaces that belong to the same VLAN. Here, the criteria for VLAN membership is departmental function; however, users could also be combined in VLAN topologies based upon a common protocol or subnet address. 
The degree of flexibility and control that virtual networking offers is unprecedented. Regardless of physical location or interface type, network managers can define workgroups based on logical function rather than physical location through simple port configuration. Using switches and routers that have embedded VLAN intelligence obviates the need for expensive, time-consuming recabling to extend connectivity in switched LAN environments. 
However, the real power of virtual networking comes from its ability to affect VLAN topologies that extend beyond single sites to combine multiple LANs across an organization's backbone network. Cisco Systems now offers a comprehensive VLAN solution that can bring together geographically dispersed users across an enterprise network to form VLAN workgroup topologies. Regardless of whether the network comprises Asynchronous Transfer Mode (ATM), Fiber Distributed Data Interface (FDDI), Ethernet/Fast Ethernet, Token Ring, or serial links, the Cisco product line now offers the advantages of virtualization

## Controls Network Plans in progress (Cont’d)

| Range of IP addresses | Class of Networks | Number of Networks |
| --- | --- | --- |
| 10.0.0.0 to 10.255.255.255 | A | 1 |
| 172.16.0.0 to 172.31.255.255 | B | 16 |
| 192.168.0.0 to 192.168.255.255 | C | 256 |

**RFC 1918 Private Address**

**Class B has been assigned by Susan Hicks (ORNL Network Operations)**

## Controls Network Plans in progress (Cont’d)

**Class B Private Address Allocation:  Subnet Mask 255.255.252.0**

**Notes:**
There are 16 subnets in each column.  Each subnet can support 1022 Network Devices. Within each subnet pair we will use the first subnet; this allows one to increase the size of the subnet with minimum impact network administration.

## Controls Network Plans in progress (Cont’d)

**Accelerator Systems Controls**

**Conventional Facility Systems Controls**

**Cryogenic Systems Controls**

**Accelerator Operations Networks**

**172.31.8.0**

**172.31.16.0**

**172.31.24.0**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Target Systems Controls**

**172.31.0.0**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Notes:**
Note: The Accelerator Operations Networks contains 16 networks:  we are currently only using 4 out of 16

Note: The following Network Addresses are reserved for future growth and network scalability:
172.31.4.0,  172.31.12.0,  172.31.20.0

## Controls Network Plans in progress (Cont’d)

***ICS Development Networks***

**Accelerator Systems Controls**

**Conventional Facility Systems Controls**

**Cryogenic Systems Controls**

**172.31.72.0**

**172.31.80.0**

**172.31.88.0**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Target Systems Controls**

**172.31.64.0**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Notes:**
Note: The ICS Development Networks contains 16 networks:  we are currently only using 4 out of 16

Note: The following Network Addresses are reserved for future growth and network scalability:
172.31.68.0,  172.31.76.0,  172.31.84.0,

## Controls Network Plans in progress (Cont’d)

**ICS Maintenance Networks**

**Accelerator Systems Controls**

**Conventional Facility Systems Controls**

**Cryogenic Systems Controls**

**172.31.136.0**

**172.31.144.0**

**172.31.152.0**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Target Systems Controls**

**172.31.128.0**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**Notes:**
Note: The ICS Maintenance Networks contains 16 networks:  we are currently only using 4 out of 16

Note: The following Network Addresses are reserved for future growth and network scalability:
172.31.132.0,  172.31.140.0,  172.31.148.0,  

## Controls Network Plans in progress (Cont’d)

**User Instruments Systems Controls**

**172.31.192.0**

**Subnet Mask = 255.255.252.0**
**Number of Subnets = 64**
**Number of Hosts = 1022**

**User Instrument Systems Networks**

## Controls Network Plans in progress (Cont’d)

**Controls Network Security**
**VLANs and Private Address Scheme**
**Network Address Translation (NAT)**
**VPN for remote access (IPSEC)**
**Firewalls (IP filtering)**
**TCP Wrappers (host-based ACLs)**
**SSH for remote access will still be supported**
**Strong Security Policy**

**Notes:**
Although some vendors and service providers might disagree, in common usage a virtual private network is a group of two or more computer systems, typically connected to a private network (a network built and maintained by an organization solely for its own use) with limited public-network access, that communicates "securely" over a public network. VPNs may exist between an individual machine and a private network (client-to-server) or a remote LAN and a private network (server-to-server). Security features differ from product to product, but most security experts agree that VPNs include encryption, strong authentication of remote users or hosts, and mechanisms for hiding or masking information about the private network topology from potential attackers on the public network
Security - VPNs provide the highest level of security using advanced encryption and authentication protocols that protect data from unauthorized access. 
Scalability - VPNs allow corporations to utilize remote access infrastructure within ISPs. Therefore, corporations are able to add a virtually unlimited amount of capacity without adding significant infrastructure. 
Compatibility with Broadband Technology - VPNs allow mobile workers, telecommuters and day extenders to take advantage of high-speed, broadband connectivity, such as DSL and Cable, when gaining access to their corporate networks, providing workers significant flexibility and efficiency.