Read-only: how we technically rule out write access to the CNC control

Anyone who connects a monitoring system to a CNC control opens a door to the most important component of the machine. Via OPC UA, SINUMERIK and HEIDENHAIN do not only allow values to be read. Depending on the configuration, the interface also offers functions for writing variables, calling methods and adding or deleting nodes. Condition monitoring of a spindle needs none of this. That is why, in our system, “read-only” is not a setting but a property of the software, enforced in four independent layers. This article shows how write protection for the CNC control is built technically and why it matters equally to the maintenance team, IT and the works council.

Why a monitoring system must never write

A single unintended write access can cause real damage on a machine tool: a changed parameter, a selected program number, an acknowledged alarm that the operator should still have seen. In the threat model of our system, the availability and safety of the machine therefore come first, ahead even of the protection of the measurement data.

The danger does not only come from outside. A software bug, a faulty library or an incorrect configuration could also trigger a request that changes something. A promise in the datasheet is not enough for this. The protection has to be built so that it holds even if one layer fails.

Write protection for the CNC control in four layers

The four layers work independently of each other. Each on its own would already prevent a write access. Together they also rule out errors that a single layer might miss.

Layer 1: there is no write code

The interface through which our software talks to a CNC control knows exactly five functions: connect, disconnect, read configured signals, fetch received alarms and query the connection status. A function for writing, calling methods or controlling is deliberately not part of the interface. Every driver for a control family has to adhere to this interface. The rest of the box's code therefore cannot even formulate a write command.

Layer 2: the upstream barrier with an allowlist

Every OPC UA request from our software passes through a single point in the program before it goes onto the network. That is exactly where a barrier sits that checks every request against an allowlist. Only services that cannot change anything on the control get through. Everything else is rejected before a single byte is sent. The barrier is put in place before the connection to the control is even established.

The difference between an allowlist and a blocklist is important. A blocklist enumerates what is not permitted. It has a gap as soon as there is a request type nobody thought of, for example after an update of the OPC UA library. An allowlist reverses this: only what is explicitly approved is permitted. An unknown request type is blocked automatically. Our first draft did in fact use a blocklist. Our own tests exposed it as incomplete, which is why the allowlist is now the authoritative layer.

Layer 3: automated tests with every change

The third layer consists of tests that run with every change to the code. They check write protection from several angles:

• One test scans the entire source code of the box for calls that change something on an OPC UA server, such as writing values, calling methods or adding and deleting nodes. If it finds one, the check fails.
• A further test ensures that this scan really does detect an injected write call. This means the check cannot silently become ineffective.
• For every request type that changes something, the tests verify that the barrier blocks it and that none of them is on the allowlist.
• A test against our control simulator shows that reading works, but a write attempt and a method call fail at the barrier. The simulator does not register a single method call.

These tests also run after every update of the OPC UA library. If the library changes its internal structure in a way that stops the barrier from working, this is noticed immediately, before a new version is shipped.

Layer 4: a user with minimal rights on the CNC control

The last layer lies outside our software. A dedicated user for the box is created on the control with read rights only. On SINUMERIK these are the rights SinuReadAll and AlarmRead. On HEIDENHAIN, a role with read-only rights is assigned in the user administration; we agree the exact operating steps with you during commissioning. Even if layers 1 to 3 were all to fail, the control would then reject a write attempt itself. We check and document the set-up of this user on site. How the connection is set up in detail is described in the article Connecting SINUMERIK and HEIDENHAIN via OPC UA.

Which OPC UA services are allowed and which are not

OPC UA is organised into services. Every client request belongs to exactly one service. The allowlist in our system only lets through services that read data or manage the client's own session and its own subscriptions. Subscriptions and sessions are administrative data of our connection, not of the machine.

The method call is worth noting. Controls offer functions such as program selection or file transfer via methods. Our system does not call a single method, not even one that seems harmless. The box receives alarms as events via a subscription, not via a method call.

A limited polling rate protects the CNC control

Write protection is only one part of not impairing the control. Reading too often can also put load on a control whose actual job is machining. Our system therefore reads once per second by default. Intervals shorter than 0.1 seconds are already rejected when the configuration is checked. This lower limit is based on the minimum sampling time that Siemens specifies for SINUMERIK. All configured signals are read in one combined request, not individually.

This rate is sufficient for spindle monitoring. The control supplies speed and load as additional information. The actual high-sampling-rate vibration measurement comes from the sensor on the spindle housing and puts no load on the control at all. You can read more about the division of work between box, sensor and control in the article How the edge box is built.

Encrypted connection and verified peer

In addition to write protection, we also secure the connection itself. The normal case is an encrypted OPC UA connection with the security policy Basic256Sha256 in “Sign and Encrypt” mode. As soon as encryption is used, our configuration requires the control's certificate. Without this certificate the box would trust any peer that claims to be a control. The read-only user's password is never in the configuration file, only in an environment variable on the box. How the box in turn identifies itself is described in the article Device certificates and signed updates.

What “read-only” means for warranty, works council and IT

Maintenance and warranty: a common concern is that a third-party system on the CNC control might affect the warranty or the service contract with the machine builder. Our system changes neither machine data nor NC programs nor parameters. The question of whether a third party has adjusted something on the machine therefore does not arise. Please clarify the details of your contract with the machine builder. The evidence that the box only reads exists in the form of the four layers, and you can check it yourself on the control via the rights of the read-only user.

Works council: the works council's main question is whether the system can monitor the behaviour or performance of employees. In Germany, technical equipment that is suitable for this is subject to co-determination under Section 87(1) No. 6 BetrVG (German Works Constitution Act). Our system records machine data and no data about operators. It is focused exclusively on the condition of the spindle and the spindle bearings. The fact that it also cannot change anything on the machine anticipates a second concern: nobody can intervene in the work at the machine through the system.

IT and OT security: what counts for IT is that a compromised system does not become a tool against the machine. Thanks to the allowlist and the read-only user, the possible damage even in the worst case is limited to reading values. The box also accepts no connections from outside and only sends outbound. An overview of all measures is on the Data security page.

How to check the write protection yourself

You do not have to take our word for it; you can check. During commissioning, you or your control specialist create the read-only user yourselves and see which rights it has. The box's certificate is entered manually on the control as trusted, and the box displays the fingerprints for comparison. At the first appointment the box browses the control's address space read-only, through the same barrier as in later operation, and creates a table of the available signals from it. How this appointment works is described on the Process page. We are happy to answer questions about approval within your company in the introductory call.

Frequently asked questions