Security—the latest, high-tech ‘layered look’

By Control Engineering Staff March 10, 2006

Tight physical- and cyber-security together with safety are not inimical to flexible and effective process controls. The ‘layered (clothing) look’ of residents of wintry, northern climes is a good metaphor—adding (or subtracting) items as the temperature (risk) changes—for amalgamating security, safety, and process controls..

Control Engineering recently visited Honeywell Inc.’s Geismar chemical plant. The occasion? An in-depth review of some of the fruits of its $100 million annual R&D spending as applied to what the company believes is the state-of-the-art integration of security and process safety. Integration is so seamless that alarm-level incidents are reported simultaneously to the DCS operator as well as security—so the operator can concentrate on resolution without the distraction of calling security.

The facility is part of $26-billion/year, Honeywell International’s Specialty Materials sector—a $3.5 billion business group. Geismar is one of the most important plant assets of Honeywell Specialty Materials, as it is the U.S.’ largest manufacturer of hydrofluoric acid and is a principal producer of key, non-ozone-depleting refrigerants and Aclon resin (a clear vapor barrier for pharmaceuticals such as pills and capsules). Specialty Materials has invested significantly in the plant in recent years to add capacity.

Among 160 other nearby chemical plants, situated on the Mississippi River, Geismar’s some 20 miles south of Baton Rouge, LA, and 60 miles north of New Orleans. The plant is a good test site for industrial security products and services because:

  • Fluorine and hydrofluoric acid are extremely reactive and potentially hazardous to humans and the environment;

  • The plant is co-located with other chemical businesses, which often share common areas with the Honeywell operation;

  • Its dock operations are situated on a heavily traveled, critical U.S. waterway; and

  • Product is shipped via rail and a dedicated company-owned truck fleet.

Indeed, the Geismar plant recently hosted a visit from members of the U.S. Congress and Department of Homeland Security to showcase what can be done for chemical plant security. It may even set the standard for federal plant security regulations that may be promulgated before yearend 2006. Honeywell claims it has a unique position to showcase a best-in-class security solution because it:

  • Owns chemical plants and understand the importance of securing these facilities;

  • Has nearly 40 years’ experience in process and automation controls; and

  • Is the only company to successfully integrate advanced security systems with advanced process control systems—making the Geismar solution the first of its kind

Given the nature of the plant’s products security has always been a management focus. For now the company’s close coordination with local law enforcement authorities and compliance with the U.S. Coast Guard’s Marsec (maritime security) levels have been more than adequate. The company also works closely with local authorities on both notification, general populace education, and containment/mitigation plans to address any foreseeable safety incident.

The cyber-semi

The integrated system controls perimeter access, including the gate to the Geismar plant’s Mississippi River dock.

Kicking off the tour was a visit inside the Control Engineering -magazine-sponsored, Honeywell demonstration 18-wheeler—chockablock with real-world computers, controls, and video monitors—provides control-room display-equivalent demonstrations of process controls with and without the safety and security systems developed by Honeywell. The truck will travel across the U.S. allowing industry professionals to see first-hand what Honeywell is offering in this critical area.

Company experts together with simulations effectively convey the reality of today’s risk—and solutions. Honeywell Process Solutions’ marketing vice president, Harry Sim, advised that, “Only about 1,000 of 15,000 vulnerable, mission-critical sites have even conducted a risk assessment much less implemented any measures.”

Analysis of British Columbia Institute of Technology researcher, Eric Byres’ paper: “Insidious Threat to Control Systems,” showed that, from 1982-2000, only 31% of incidents originated outside companies. A 2000 FBI study indicated that insiders perpetrated 71% of security breaches. However, 2001 was a watershed; in evaluating the period 2001-2003, data showed external sources generating 70% of all events. Similarly, Deloitte & Touche’s 2003 Global Security Survey of 80 Fortune-500 companies found that 90% of security breaches originated from outsiders rather than rogue employees. And the incidents are not trivial, with some 50% of the respondents reporting financial impacts seeing impacts >$1 million. Furthermore, 41% reported lost production and 29% saw a loss of ability to view/control plant processes. According to IBM’s Global Security Intelligence Services, network attacks against critical infrastructure providers surged 55% from July-August 2004. On an average month, IBM’s monitoring services detects 100-million suspected or actual attacks against customers.

Buffalo to‘Nawlins’

Process security meets rocket science as commercially available radar is married to ballistic-missile-tracking expertise to provide automated threat-tracking of river traffic, customized to time of day and day of the week criteria.

Migrating south from Buffalo, NY, and running his seventh chemical plant, Honeywell’s site manager, Bill Lessig, told Control Engineering that the facility was built in 1967 by Allied Chemical Co. Encompassing some 1,900 acres—with an active‘footprint’ of 240 acres—it includes including a dock that can accommodate ships with up to a 25,000-ton capacity. It allows the crushed fluorite (CaF2) feedstock to be imported from around the world.

Honeywell employs 274, with approximately 85 contractors on site at any given time. Consequently, including neighboring companies on the property, the total, area-wide head-count approximates 1,000.

Honeywell is also the lessor/host to four other chemical companies (PCS (Potash Corp.)—nitrogen production; Williams Co.—ethylene; Innophos—phosphoric acid; and Basic Chemical Solutions—that takes Geismar’s excess hydrochloric acid) and, as such, provides water, power, transportation services, stores, security personnel and medical facilities.

At the outset Honeywell recognized two fundamental challenges:

  • Isolating its facilities from its neighbors’ plants; and

  • Integrating the security, safety, and process functions without losing functionality.

The company’s approach to protecting the facility employs a comprehensive defense in depth strategy that seamlessly integrates the physical, electronic and cyber layers of security with building automation, security and process control systems for real-time information sharing. Integration is the most effective and efficient way to address safety and security that enables faster, better incident (safety or security) responses, such as pre-emptive shutdown/safe-mode and the mustering of personnel in safe areas.

Honeywell’s integrated-security solution’s capabilities include:

  • Monitor and protect the perimeter—intrusion detection, radar tracking of vessels;

  • Provide beyond the perimeter surveillance;

  • Identify and control who enters and exits the facility;

  • Track movements of building occupants and assets;

  • Control access to restricted areas;

  • Quickly locate equipment, products, and other resources;

  • Improve emergency response time;

  • Prevent theft;

  • Integrate systems for greater speed and efficiency;

  • Protect process automation networks and systems from cyber threats;

  • Track vehicle and hazardous materials; and

  • Track personnel locations on site in the event of an incident through automated mustering.

The $3.5-million, 16 month undertaking was completed in January 2005, and included Honeywell’s investment of over $2.5 million and a $1.02-million Department of Homeland Security grant (which added to project completion time requirements).

A ‘show of hands,’ please

In an emergency, the exceptions display indicates individuals not yet at a‘mustering point’ (safety refuge) as well as their last location. This allows focused rescue efforts, minimizing exposure of rescue teams. Data is available in real-time to safety, security, and operations staff.

The combined efforts of Honeywell’s aerospace, automation, and specialty materials groups took a pragmatic approach, avoiding compromising existing plant process controls’ functionality. But that didn’t prevent use of the latest technology, such as hand geometry biometrics—since workers’ hands might be grimy negating the effectiveness of fingerprint-based technology. At heightened levels of security hand geometry, together with personal identification numbers and magnetic pass cards, provide a far higher level of certainty that the individual with a pass card is who he claims to be.

And an example of the amalgamation of ‘rocket science’ and pragmatism was the marriage of Honeywell’s ballistic missile-tracking expertise with commercially available radar to provide continuous, automated threat-monitoring capability for all traffic approaching and passing by on the Mississippi River. It has user-defined rules that can adapt to both time of day and day of the week factors.

Also, the security system has the same heritage as Honeywell’s process-control software. So, given the embedded ‘hooks’ of the two software elements, integration between the two is much tighter.

Control room operators are only a mouse-click away from display of critical operational, safety, and personnel data.

Geismar plant is now the template for Honeywell’s upgrade of its Tier-I and -II chemical plants’ security/control systems. Nonetheless, the majority of U.S. chemical plants are taking a wait-and-see attitude pending federal regulations on the topic, which may be promulgated as early as later this year. Meanwhile, Honeywell has made several sales of the system to petroleum and chemical companies in the Middle East and the U.S. Many of the customers already use Honeywell process controls, but the security side can be integrated with non-Honeywell controls, albeit with somewhat—and understandably—less effectiveness. A key attraction of the system is the ability to apply it more cost- and time-effectively than a one-off purpose-built creation.

Lessig volunteered that the biggest human-factor issue he faced was changing employees’ habits. He said, “People were used to going anywhere anytime in the plant. The new system only allows access to areas relevant to an employee’s duties. “And Lessig indicated that, “we learned a lot (that we didn’t previously know) about our employees’ workflow early on.”

Under the new system all personnel access to the three zones—perimeter, process, and control rooms—is increasingly restricted as the U.S. Coast Guard’s Marsec level rises from Level 1 to Level 3 (to date it’s not been over Level 1). And the tight integration allows real-time knowledge of every person’s whereabouts in an emergency—either at mustering points in a safety incident or unaccounted for, allowing focused rescue efforts. And operations staff has the same real-time access to that information as the safety and security staff.

Honeywell aims to push its motto,‘building a safer and more secure world’ leveraging its global presence. So ‘stay tuned,’ the company is outfitting the plant as its showcase for all the latest in its automation technology. The klieg lights are expected to illuminate in early 2007.

For more information visit:

Richard Phelps , senior editor, Control Engineering