The short answer
Controller Mode Switch and Keyswitch
The keyswitch on a controller selects who may change its mode: RUN executes the program and refuses remote mode changes and downloads; PROGRAM stops execution and permits programming; REMOTE lets the programming software choose, from anywhere on the network. A controller left in REMOTE can be stopped or reprogrammed by anyone who reaches it with the software, which is the reason a utility policy keeps controllers in RUN except during a change made on site or through an approved session, monitors the mode as a SCADA tag, and alarms on any change. Controllers without a keyswitch get the equivalent protection from their software security features and from the network.
Key points
- RUN means the network cannot change the mode or the program. REMOTE means it can.
- The keyswitch is the one control an attacker on the network cannot defeat.
- Policy: RUN except during an approved change, with the key removed and kept.
- Monitor the mode in SCADA and alarm on every change. A mode change is an event with a name attached.
- No keyswitch: use the platform security to lock the mode and the network to limit who can reach it.
What the switch does
| Position | Program execution | Remote mode change | Program download | Online edits |
|---|---|---|---|---|
| RUN | Running | Refused | Refused on most platforms | Refused or restricted |
| REMOTE | As last set by software: run or program | Permitted from the programming software | Permitted | Permitted |
| PROGRAM | Stopped; outputs to their program-mode state | Refused | Permitted | Not applicable |
The details vary by platform: some allow online edits in RUN with the switch in RUN, some refuse any change, some have a fourth position or a software-configurable equivalent. The controller manual is the reference. The principle is the same everywhere: RUN takes the mode and the program away from the network, and REMOTE gives them to it.
Why controllers are left in REMOTE
REMOTE is convenient. A programmer at a desk, or a vendor at home, can put a controller into program mode, download, and return it to run without driving to the site. Integrators commission systems in REMOTE and leave them there; utilities find the convenience useful and never change it. The result is a control system in which every controller can be stopped or reprogrammed by anyone who reaches the network with the software, which includes an attacker who has reached the network with the software. Publicly reported incidents at industrial sites have included controllers put into program mode remotely. The keyswitch in RUN would have prevented each one, at the cost of a drive to the site.
The policy
- 1
Default RUN
Every controller with a keyswitch is in RUN during normal operation. The key is removed and kept in a controlled place, not left in the switch.
- 2
Change on site or through an approved session
A program change requires a person at the controller to turn the switch to REMOTE or PROGRAM for the duration of the change, under the change management procedure, and to return it to RUN after. Where remote programming is genuinely needed, the switch is turned by a person on site for a session that is approved, logged, and time-limited, with the remote access through the jump host.
- 3
Monitor the mode
The controller mode is a status the program can read on most platforms, or that SCADA can read through the driver. It is a SCADA tag, trended, and alarmed on any change from RUN, at a priority that gets attention.
- 4
Alarm the unexpected
A mode change that does not correspond to an approved change record is treated as an incident: the controller is compared with its backup and the program integrity is checked.
- 5
Audit
A periodic walk of the panels to confirm every switch is in RUN and every key is accounted for, and a periodic check of the mode tags.
Platforms without a keyswitch
Many compact controllers, and some larger ones, have no physical switch; the mode is set by software, and the protection has to come from elsewhere.
- Platform security features
- Controller passwords, user accounts with roles, a software mode lock, and on newer platforms a security mode that requires authentication for any mode change or download. Enable them; they are off by default.
- Network restriction
- A firewall or an access list in front of the controller that permits the programming protocol only from the engineering workstation, and only when a session is enabled. Where the firewall understands the protocol, deny the mode change and download functions except from that source.
- Program integrity monitoring
- Detect a change after the fact: the program checksum and the last edit time read into SCADA and alarmed, and a scheduled compare against the backup.
- Physical
- A locked panel and a locked building, so that a local connection requires a key.
- Replacement
- A controller that runs a critical process, has no keyswitch, no software security, and cannot be isolated is a controller to replace on a schedule.
What to monitor
- Controller mode, per controller, as a tag, alarmed on change from RUN.
- Program checksum or change counter, alarmed on change.
- Last edit timestamp, compared with the change log.
- Controller restart and hard fault events, counted and alarmed.
- Programming protocol connections at the firewall, logged, with the source address.
- The keyswitch position where the platform exposes it separately from the mode.
Frequently asked questions
- Our integrator says they need REMOTE to support us. What do we do?
- Provide remote support through the vendor access design: a session enabled by the utility, through the jump host, with the keyswitch turned to REMOTE by a person on site for that session and returned to RUN after. It costs a phone call and a short drive per change, and it is what stops the same path being used by someone who is not the integrator.
- Does RUN prevent online edits?
- On most platforms RUN refuses remote mode changes and downloads; some still permit online edits from the software. The manual says. Where online edits are permitted in RUN, the platform security features and the network restriction cover them, and the program change detection catches them.
- What happens to the outputs when someone turns the switch to PROGRAM?
- The controller stops executing and the outputs go to their program-mode state, off on most platforms, hold on some configurations. On a lift station that is a stopped pump; on a chemical feed it is a stopped feeder. The float backup and the manual operation procedures are what carry the process through, and the mode alarm is what gets someone to the site.
- Should the key be removed from the switch?
- Yes. A key in the switch is a switch anyone can turn. The keys are kept by the utility, tracked, and issued for a change. Keys for a controller family are often identical, so a key from one panel opens all of them, which is one more reason the network and the monitoring matter too.
Related topics
- Controller HardeningWhat can be locked down on a PLC or RTU: keyswitch and mode, credentials, unused services, access lists, firmware, and the engineering workstation that is the real target.
- Controller Program IntegrityKnowing that the program in the controller is the one that was approved: checksums and change counters, the scheduled compare against the trusted backup, signed and protected projects, what an unexplained difference means, and making the check routine.
- Vendor Remote AccessIntegrators and equipment vendors need to get in. How to let them without leaving a permanent door open: utility-controlled sessions, named accounts, MFA, a jump host, session recording, and what to do about the modem you did not know was there.
- PLC Will Not RunA controller that stays in program mode, faults on every attempt to run, or will not power up: the mode switch, the major fault log, the power supply, the memory and battery, the firmware and program mismatch, and the I/O configuration errors that stop a processor, in the order that finds them.
- Lift Station Backup ControlHow a lift station keeps pumping when the transmitter, the PLC, or the SCADA link is gone: float backup logic, the control transfer relay, redundant-off protection, and how to test it with the controller actually dead.
- PLC Program BackupsWhat a complete controller backup contains, how often to take one, where to keep it, why the upload from the running controller is not the master, and the verification that turns a folder of files into a recovery plan.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.