ABB AWT420 User manual

—
ABB MEASUREMENT & ANALYTICS | COMMUNICATIONS SUPPLEMENT
AWT420
Universal 4-wire, dual-input transmitter
Ethernet communications
configuration
Measurement made easy
Introduction
This Communication Supplement provides
procedures specifically related to the Ethernet®
option for the AWT420 transmitter. Refer to the
AWT420 Operating instructions (OI/AWT420-EN) for
general information on installation, operation and
maintenance.
For more information
Further publications for the AWT420 transmitter
are available for free download from:
www.abb.com/measurement
or by scanning this code:
Links and reference numbers for the transmitter
publications are also shown below:
Search for/ click on:
   

Commissioning Instruction C  

Operating Instruction O  

HART Communications Supplement

HART-EN





PROFIBUS Communications Supplement

PROFIBUS-EN




—
Universal 4-wire,
dual-input transmitter

2AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C
Contents
1 Health & Safety ..............................3
 .................................3
Safety precautions .................................3
Potential safety hazards ............................3
Safety standards ...................................3
Product symbols .................................. 4
Product recycling and disposal (Europe only) ....... 4
End-of-life battery disposal ...................4

2011/65/EU (RoHS II) .............................. 4
2 Cyber security...............................5
3 Overview....................................5
Ethernet features .............................5
4 Installation..................................6
Cable length ...................................... 6
Cable specification ................................ 6
Network connection ............................... 6
Cable entries...................................... 6
Ethernet module installation ....................... 6
5 Configuration ...............................7
Ethernet menus ....................................7
Non- secure connections .......................... 8
Secure connections configuration.................. 8
Security Certificate configuration
menu options ................................8
Certificate management and storage............... 8
First provisioning.............................9
 ..............................9
Certificate renew .............................9
Provisioning ......................................10
First Provisioning ............................10
Certificate Renewal ..........................10
Web Browser first connection ................ 11
Connecting with FTP using a web browser ....12
Connecting with FTP using an FTP client ......12
Folders access rights ........................15
Software Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . 15

AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C 3
1 Health & Safety
Document symbols
Symbols that appear in this document are explained below:
DANGER
The signal word ‘DANGER’ indicates an imminent danger.
Failure to observe this information will result in death or
severe injury.
WARNING
The signal word ‘WARNING’ indicates an imminent danger.
Failure to observe this information may result in death or
severe injury.
CAUTION
The signal word ‘CAUTION’ indicates an imminent danger.
Failure to observe this information may result in minor or
moderate injury.
NOTICE
The signal word ‘NOTICE’ indicates potential material
damage.
Note
‘Note’ indicates useful or important information about the
product.
Safety precautions
Be sure to read, understand and follow the instructions
contained within this manual before and during use of the
equipment. Failure to do so could result in bodily harm or
damage to the equipment.
WARNING
Bodily injury
Installation, operation, maintenance and servicing must be
performed:
• by suitably trained personnel only
• in accordance with the information provided in this
manual
• in accordance with relevant local regulations
Potential safety hazards
AWT420 transmitter – electrical
WARNING
Bodily injury
To ensure safe use when operating this equipment, the
following points must be observed:
• Up to 240 V AC may be present. Be sure to isolate the
supply before removing the terminal cover.
Safety advice concerning the use of the equipment
described in this manual or any relevant Material Safety

Company, together with servicing and spares information.
Safety standards
This product has been designed to satisfy the requirements of
IEC61010-1:2010 3rd edition ‘Safety Requirements for Electrical
Equipment for Measurement, Control and Laboratory Use’ and
complies with US NEC 500, NIST and OSHA.

4AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C
…1 Health & Safety
Product symbols
Symbols that may appear on this product are shown below:
Protective earth (ground) terminal.
Functional earth (ground) terminal.
Alternating current supply only.
 
This symbol, when noted on a product, indicates a
potential hazard which could cause serious personal
injury and/or death. The user should reference this
instruction manual for operation and/or safety
information.
This symbol, when noted on a product enclosure or
barrier, indicates that a risk of electrical shock and/or
electrocution exists and indicates that only
individuals qualified to work with hazardous voltages
should open the enclosure or remove the barrier.
The equipment is protected through double
insulation.
Recycle separately from general waste under the
WEEE directive.
Product recycling and disposal (Europe only)
ABB is committed to ensuring that the risk of any
environmental damage or pollution caused by any of
its products is minimized as far as possible. The
European Waste Electrical and Electronic Equipment

August 13 2005 aims to reduce the waste arising from
electrical and electronic equipment; and improve the
environmental performance of all those involved in
the life cycle of electrical and electronic equipment.
In conformity with European local and national
regulations, electrical equipment marked with the
above symbol may not be disposed of in European
public disposal systems after 12 August 2005.
NOTICE
For return for recycling, please contact the equipment
manufacturer or supplier for instructions on how to return
end-of-life equipment for proper disposal.
End-of-life battery disposal
The transmitter contains a small lithium battery (located on the
processor/display board) that must be removed and disposed
of responsibly in accordance with local environmental
regulations.
Information on ROHS Directive 2011/65/EU
(RoHS II)
ABB, Industrial Automation, Measurement &
Analytics, UK, fully supports the objectives of the
ROHS II directive. All in-scope products placed on the
market by IAMA UK on and following the 22nd of July
2017 and without any specific exemption, will be
compliant to the ROHS II directive, 2011/65/EU.

AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C 5
2 Cyber security
This product is designed to be connected to and to
communicate information and data via a digital communication
interface. It is your sole responsibility to provide and
continuously ensure a secure connection between the product
and your network or any other network (as the case may be).
You shall establish and maintain any appropriate measures
(such as but not limited to the application of authentication
measures etc.) to protect the product, the network, its system
and the interface against any kind of security breaches,
unauthorized access, interference, intrusion, leakage and/or
theft of data or information.
ABB Ltd and its affiliates are not liable for damages and/or
losses related to such security breaches, any unauthorized
access, interference, intrusion, leakage and/or theft of data
or information.
The AWT420 can handle a data rate up to 300 packets per
second, which far exceeds what the application needs. It is the
customer's responsibility to ensure that the device is deployed
in a network that does not exceed this packet rate. If the device
were to experience data flooding exceeding this rate, it will
become unresponsive to network requests during the data
flooding and, for several seconds after the data flooding ends.
3 Overview
Ethernet features
Ethernet is the standard way to connect devices on a wired
connection. It provides a simple interface for connecting
multiple devices on a local network (LAN).
The AWT420 supports 10Base-T and 100Base-T using screened
twisted pair (STP) or unscreened twisted pair (UTP) Cat-5e
cable.
The AWT420 Ethernet communication supports the following
TCP/IP protocols/features:
• Web Server both unsecured (HTTP) and secured (HTTPS)
with SSL/TLS encryption and private/public key
authentication
• FTP, both unsecured and secured over SSL/TLS
connections
• Username and password configuration for remote access
to the system using the above protocols
• 
automatically configure the device’s IP Address
• 
an Internet name resolution server
Note
The AWT420 supports both secure protocols (HTTPS and SFTP)
and insecure protocols (HTTP and FTP), although insecure
protocols are disabled by default. Insecure protocols transmit
unencrypted data that an attacker who has hacked into the
network can spy and capture. ABB recommends the use of
secure protocols.

6AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C
4 Installation
Optional Ethernet communications modules can be fitted in the
communications slot of the AWT420 transmitter to provide
local network access. The AWT420 is not intended to be an
internet facing device so installations requiring remote access
should take precautions to ensure their network is secure.
A possible installation model is shown in the following example.
Figure 1 Example of Ethernet network
Cable length
The maximum cable length is 100 m (330 ft) Category 5e UTP or STP.
Cable specification
Category 5e cable recommended.
Network connection
WARNING
Refer to the AWT420 Operating instruction
(OI/AWT420-EN) before making electrical connections.
NOTICE
Property damage
When connecting an AWT420 to a local area network:
• Use Cat 5e (STP or UTP) cable.
• Ensure the RJ45 plug is firmly inserted into the RJ45
socket.
• Route data lines clear of the source of any strong
electrical and magnetic fields.
Cable entries

A 
B 
C 
D Figure 3, page 6
E M20
F 
G 
Figure 2 Cable entries
Ethernet module installation
Referring to Figure 3:
1 Isolate the transmitter from the power supply.
2 Using a suitable screwdriver, release transmitter door
retaining screw Aand open the door.
3 Insert Ethernet module Binto communications slot C
4 Route Ethernet cable through a suitable cable entry D.
5 Connect Ethernet cable plug to socket Ein Ethernet module
B.
6 Close transmitter door and secure with door retaining screw
A.
7 Restore power to the transmitter.
Figure 3 Ethernet module installation
Engineer
Firewall
AWT4 20
multi-input
transmitter
AWT4 20
multi-input
transmitter
AWT4 20
multi-input
transmitter
Operator
LAN router
12345 6 7 8
GLASS
GUARD REFERENCE SOLUTION EARTH PT PT SCREEN PT (3rd)
12345 6 7 8
GLASS
GUARD REFERENCE SOLUTION EARTH PT PT SCREEN PT (3rd)
ETHERNET pH INPUT pH INPUT

AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C 7
5 Configuration
Ethernet menus
Ethernet menus are accessed via the Communication level. Refer to Operating Instruction OI/AWT420-EN for menu navigation.
Menu Comment Default
Web Server Submenu that allows the configuration of the built-in web server.
DHCP 
• 
• 
Enabled
IP Address Enter the IP Address to be assigned to the transmitter.

The IP Address is used by the IP Protocol to distinguish among different devices.


Subnet Mask 



Class default
Default Gateway 
Note: this setting is required only if the device and the PC running the web browser/FTP client are on
different IP subnetworks.

DNS IP Address 
the name resolution of IP Addresses.


Secure Connection Enable or disable the SSL/TLS (Secure Socket Layer/Transport Layer Security) layer to establish secure
connections over a public network with a web browser. When enabled, remote connections are
established after an authentication phase via a security certificate (explained later).
When Secure Connection is Enabled, it is necessary to configure the Port Number option accordingly.
When Secure Connection is Enabled the web protocol used is HTTPS, otherwise HTTP.
Enabled
Disable Webserver Select Enabled to allow remote connections to the device with a web browser Enabled
Port Number Configures the Port Number from which the transmitter listens for connections requests. This
configuration must be changed according to the configuration of the Secure Connection parameter.
Valid values are:
• HTTPS
• HTTP

FTP Submenu to configure the FTP functionality.
Port Number Configures the Port Number from which the transmitter listens for connections requests. 
Disable FTP Select Enabled to allow remote connections to the device with either an FTP client or a web browser
(Read Only access, in the latter case)
Enabled
Secure Connection Enable or disable the SSL/TLS (Secure Socket Layer/Transport Layer Security) layer to establish secure
connections over a public network with a web browser. When enabled, remote connections are
established after an authentication phase via a security certificate (see Certificate management and
storage, ).
Security Certificate .
First Provisioning Performs the first provisioning of the device. To be used when the device is expected to be Inter-net
facing.
This option performs the following operations:
• 
• 
• Creation of the first self-signed digital certificate to be used during the secure connection
establishment
After this operation is completed, the device is ready to be connected to the Internet. The digital

N/A
Certificate Renew Performs the renewal of the device’s digital certificate. To be used after expiration of the current one.
See  for more details.
N/A
Device Identifier 

First Provisioning,  for details.

(not provisioned)
User Name Allows the configuration of the web server and FTP server user. advanced
Password Allows the configuration of the associated password to access both the web server and the FTP server.
The user/plant administrator is advised to change the default password upon device commissioning to
restrict access to authorized personnel only.
advanced
MAC Address Shows the MAC Address of the Ethernet device. This value is read-only. N/A

8AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C
…5 Configuration
Non- secure connections
To establish a non-secured connection, the AWT420 Ethernet
must be configured as follows:
• 
• Port Number must be set to 80 (HTTP)
To connect to the device, open a web browser and in the
address bar type:
http://<IP Address>
Refer to Figure 4. In this example. IP Address is set to the value:
10.0.0.1:
Figure 4 Example of URL to be used for non-secure connection
Secure Connection, Port Number and IP Address configuration
parameters are explained on page 7, Ethernet Menus.
Secure connections configuration
To establish a secure connection over SSL/TLS, it is necessary
for a server to prove its identity. The AWT420 achieves this by
using asymmetric cryptography, also known as public key
cryptography. A private/public key pair is created, with the
private key maintained secret and the public key freely
distributed. When a client wants to establish a secure
connection with a server, it requests the server a file known

This document contains, among other information:
• the name of the device
• certificate creation and expiration dates
• the server’s public key
• a certificate hash encrypted with the server’s private key
(digital signature)
Upon reception of the digital certificate, the client tries to
decrypt the signature to retrieve the original certificate hash
and compare it with the locally calculated hash. If the
comparison operation is successful, it constitutes proof of
identity of the server, because the signature could be encrypted
only with the private key associated to the public key
distributed with the certificate. However, the AWT420 supports
self-signed certificates. This means the web browser raises a
warning to indicate it cannot verify the authenticity of the
certificate.
The user must ensure the network is secure and there are no
intrusions. The user must add an exception to the list of servers
it trusts as, from this moment onwards, the warning is not
raised again. The procedure to add web server exception is
explained on page 11 in Web Browser first connection.
Security Certificate configuration menu options
Refer to page 7 for Security Certificate menu options.
Certificate management and storage
The AWT420 has an on-board HSM (Hardware Security Module)
which performs the following functions:
• creation of self-signed certificates
• secure private and public key pair creation and storage
• secure certificate storage
• digital signatures creation and verification
There are two different phases in the device service life
regarding the security certificates:
• provisioning
• certificate renewal

AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C 9
First provisioning
This procedure configures the AWT420 internal HSM to create
self-signed digital certificates that allow secure network
connections to be established. At the end of the provisioning
phase, a self-signed digital certificate is created. This
certificate is sent to the client web browser during the SSL/TLS
message handshake.
Because the certificate created with this procedure is self-
signed, the web browser raises a warning to indicate it is
unable to verify the identity of the AWT420, as the certificate
issuer is unknown. The browser offers the option to view the
digital certificate and to add a security exception, so that it is
subsequently accepted for the next web sessions.
The following table shows some of the information displayed
on the certificate:
Field Value
Version 
Signature algorithm 
Signature hash algorithm 
Issuer abb.com <deviceId>, ABB Ltd., UK
Valid from <certificate creation date>
Valid to <certificate expiration date>
Subject 
Public key parameters 
curve used to create the private/public key pair)
Table 1 Certificate information
Refer to page 10 for configuration details.
Device identifier

device during the first provisioning phase and that remains the
same for the lifetime of the device. The operator can use it to


on the instrument and it is unique to it.
It is responsibility of the operator to make sure that this value is
not available to external parties that may access the device
locally. Also, the operator should check with the web browser
that the Device Identifier reported in the digital certificate is
the same as the one configured locally on the device.

Identifier embedded in a AWT420 digital certificate:
Figure 5 Digital Certificate example

value is shown in the AWT420 HMI interface.
Certificate renew
The First Provisioning procedure creates a digital certificate
that is valid for 3 years. After this time, the user should create a
new certificate valid for the next 3 years.
To renew the device certificate, select 'Certificate renew' in the
device’s HMI. To renew the security exception in the user’s web
browser, delete the previous exception (refer to the web
browser documentation for details) and re-connect to the
instrument, adding the exception with the new certificate
data from the instrument.
Refer to page 10 for configuration details.

10 AWT420 UNIVERSAL 4-WIRE, DUAL-INPUT TRANSMITTER | COM/AWT420/ETHERNET-EN REV. C
…5 Configuration
Provisioning
As noted, the device must be provisioned to enable secure
connection. In the following paragraphs the operating
procedures are described. The certificate renewal operation is
also shown.
First Provisioning
To initiate security provisioning, navigate to First Provisioning
in the AWT420 configuration menu:
Enter Configuration > Advanced > Communication >
Ethernet > Security Certificate > First Provisioning
The following screen is displayed:
Figure 6 First Provisioning screen
Press OK to start the provisioning procedure. After a few
seconds, an up arrow is displayed, indicating the operation
was successful.
Figure 7 First Provisioning complete
Press the Back button and select the Device Identifier option to
show the calculated value.
Figure 8 Device Identified programmed
As noted previously, the value shown is different for each
device (the value displayed in Figure 7 is an example only).
From this moment onwards, it is possible to connect securely
to the device.
Certificate Renewal
To access the certificate renewal option, navigate to Certificate
Renew in the AWT420 configuration menu:
Enter Configuration > Advanced > Communication >
Ethernet > Security Certificate > Certificate Renew
The following screen is displayed:
Figure 9 Security Certificate Renew screen
Press OK to start the renewal procedure. After a few seconds,
an up arrow is displayed, indicating the operation was
successful.
Figure 10 Security Certificate Renew screen
The device can now be connected to the renewed certificate.
Security Certificate
First Provisioning
Back OK
0
Security Certificate
First Provisioning
Back OK
Security Certificate
Device Identifier
1161
Back
Security Certificate
Certificate Renew
Back OK
0
Security Certificate
Certificate Renew
Back OK