January/February 2020

Communities: Industry
Texas PE Plays Leadership Role in Process Industry

Over a 40-year career, NSPE member Paul Gruhn, P.E., of Houston, has become a top expert on functional safety in the process industry. The global functional safety consultant for aeSolutions has served on standards-making committees, developed training courses on safety systems, and he served as president of the International Society of Automation in 2019.

He recently shared his thoughts on the challenges of cybersecurity, the importance of the PE license and qualified technicians, and the exciting times ahead for the automation industry.

PE: In early November, ISA held its 2019 Process Industry Conference, and many of the sessions were dedicated to cybersecurity. What do you think is the industry’s most immediate challenge in addressing cyberthreats?

Gruhn: While the name of this event changed this year, what has been formerly known as the Process Control and Safety Symposium has had such sessions for many years. ISA also has a Safety and Cybersecurity Division. The ISA 99 standard committee has been the group creating the ISA/IEC 62443 family of international standards and technical reports on the cybersecurity of operational technology (OT) control systems (as opposed to IT systems).

Entire books have been written regarding “industry’s most immediate challenges,” but if I were to provide a very short list, it would be the following: There is a lack of qualified personnel who understand the cyber issues of OT systems. The focus and tools used to assess and implement solutions for OT systems are very different than for IT systems. Companies need to understand and appreciate that while they may not be a direct target, the vulnerabilities of their control systems are well known to many and are subject to general exploits, no matter how “air gapped” people may think their systems are. Overcoming these obstacles requires awareness and training. ISA offers classroom and online training and a certificate program to qualify as many practitioners as possible. ISA also offers awareness and short training sessions at our conferences.

PE: How will ISA’s new Global Cybersecurity Alliance contribute to the effort?

Gruhn: ISA was formed 74 years ago with the banding together of more than a dozen local instrumentation societies. They realized that they could accomplish more together as a larger group than any smaller, regional group could do individually. The same applies to ISA and the formation of the Global Cybersecurity Alliance in 2019. The alliance is intended to help us advance cybersecurity readiness and awareness in manufacturing and critical infrastructure facilities and processes. It will do this by bringing end-user companies, automation and control systems providers, IT infrastructure providers, service providers, system integrators, and other cybersecurity stakeholder organizations together to proactively address growing threats. The alliance will work to increase awareness and expertise, openly share knowledge and information, and develop best-practice tools to help companies navigate the entire lifecycle of cybersecurity protection. The alliance will work closely with government agencies, regulatory bodies, and stakeholder organizations around the world.

PE: The control systems engineering PE exam began in 1992. Since then, it appears that issues such as cyberthreats to critical infrastructure and the close connection between control systems and public health and safety have made licensing all the more important in the discipline. How important is the license today in the practice of control systems engineering?

Gruhn: It just so happens that I am a long-term member of the control system engineer (CSE) [PE] exam team. The topic of cybersecurity is of immense importance to the safety of the public, industry in general, company reputation, and our critical infrastructure—in short, the safety and security of our entire nation. Portions of the ISA/IEC 62443 family of standards on cybersecurity date back to 2007. The latest ISA/IEC 61511 standard (formerly known ISA 84), which has been part of the exam specification for decades, now states that cyber risks must be assessed, and systems must be designed to provide the required resilience. While that’s easy to say, it’s not simple or easy to do. The CSE exam specification was updated recently and there are cyber questions in the current version of the exam. I would assume their percentage will probably grow over time. As a PE myself, I view licensure as extremely important. Considering that PEs earn a higher salary, apparently industry views licensure as important and worthwhile as well.

PE: In addition to PEs, competent technicians are also integral to the engineering team. How does the certification of qualified technicians also help address cyberthreats and public safety issues confronting industry?

Gruhn: Control system technicians calibrate, document, troubleshoot, and repair/ replace instrumentation for systems that measure and control level, temperature, pressure, flow, and other process variables. ISA has had a long-standing certification program for control system technicians (CCST). There are three levels of certification requiring differing degrees of technical experience, education, and training. Many companies prefer candidates who are certified control system technicians because they can trust their documented knowledge of automation and control systems. There are four major domains for the CCST exams and cybersecurity is touched upon. ISA also offers a certified automation professional (CAP) designation. While cyber is not currently addressed in that exam, it will be soon.

Information on both certification programs, as well as the CSE PE exam, can be found at www.isa.org.

PE: You’ve worked in this discipline for 40 years, but if you were just beginning your career, what technologies would you be most excited about?

Gruhn: I wouldn’t suggest that someone beginning their career focus on any particular technology; they change too rapidly. Engineers are trained to be problem solvers, and they should realize the need for life-long learning. While someone with knowledge on a 40-year-old technology (e.g., the original distributed control systems from the 1970s) might still be employable just to keep such systems running, no recent graduate wants to learn what is now viewed as such an antiquated system. I would suggest choosing a topic that interests you and doing everything you can to remain up to date on that subject. Topics such as process safety, functional safety, instrumentation, control systems, and cybersecurity will always be relevant, while the technologies they are all based on will continuously evolve.

PE: What are your personal opinions regarding opportunities in control systems and automation? What are you most excited by in your discipline and why?

Gruhn: Engineers, by their very nature, like “things” and technology. Automation is performed with technology. ISA’s vision statement is: “Create a better world through automation.” This is exactly what automation has done for the last 150 years. There have been amazing advancements in the field of automation, which will only continue to evolve. Robotics, autonomous vehicles, 3D printing, open systems, virtual and augmented reality, the industrial internet of things, and more. IIoT will produce so much data that only artificial intelligence will be able to make sense of it all. Yet IIoT must adequately address cybersecurity concerns in order to be implemented. There is a never-ending list of challenges that must be solved, which is exactly what engineers are trained for and interested in. These are truly exciting times!