During the night shift, the production line's SCADA computer throws a blue screen. The operator is calling you, and the line is down. You open your remote desktop software and see a single line: connection could not be established. Because there is no longer a running Windows on that computer.
In this article we explain exactly where software-based remote access ends, how KVM-over-IP and out-of-band (OOB) access step in, and why this distinction is a cost item in industrial environments.
What does software-based remote access assume?
TeamViewer, AnyDesk, VNC and Windows Remote Desktop all rely on the same basic assumption: an operating system is up and running on the target computer, and a service is running on that operating system. As long as this assumption holds, they all do their job well.
But what happens in the following situations?
- The computer has hit a blue screen (BSOD) and frozen there
- After a Windows update the system will not boot and is stuck on the startup repair screen
- Because of a disk failure the machine is stuck on the BIOS/UEFI screen
- The machine is powered off and needs to be turned on remotely
- A new operating system needs to be installed on the system
- The network adapter driver is corrupted and the machine cannot reach the network at all
In none of these six scenarios is there a remote access program (agent) running on the operating system. Software-based access does not help here, and going on site is often the only option.
What is KVM-over-IP?
KVM stands for Keyboard, Video, Mouse. A classic KVM switch lets you manage multiple computers with a single keyboard, monitor and mouse set. KVM-over-IP carries these three over an IP network instead of local cables.
The working principle matters: the device captures the target computer's HDMI video output at signal level and streams it to a web interface. It also sends keyboard and mouse commands to the target computer's USB port as a standard keyboard and mouse.
From the target computer's point of view, there is no such thing as remote access; only a monitor and a keyboard are connected. The operating system does not know the input comes from a remote location, and it does not need to. This is exactly where the independence comes from: whatever is on the screen is what you see. This includes the BIOS menu, the boot screen, a blue screen, a Linux kernel panic message or an installation wizard.
There is one precondition: the computer must have power and output video over HDMI. With a power supply, motherboard or graphics card fault there is no picture to capture, so these faults need on-site work.
What does out-of-band (OOB) access mean?
In networking, in-band management means managing a device over its own normal data path. The problem is this: if the thing you manage and the path you use to manage it are the same, you lose your ability to manage it when that path goes down.
Out-of-band management breaks this dependency. Management traffic travels over a separate channel, independent of the main data path. In the server world the equivalent is HPE iLO, Dell iDRAC or, more generally, IPMI cards. However, these cards are only found in that vendor's servers; an industrial PC, an HMI panel or an old desktop computer in a rack does not have such a card.
An external KVM-over-IP device gives this capability to compatible computers with an HDMI video output and a USB port, regardless of brand or model.
What the difference costs in industrial environments
When an office computer crashes, the user is inconvenienced. When a SCADA or HMI computer crashes, production stops. The difference is the cost per minute.
There are several additional challenges that make industrial environments special:
- Location: A transformer substation, a pumping station or an out-of-town facility. Getting to the site takes hours.
- Network isolation: For security reasons the OT (production) network is separated from the IT network. It cannot easily be reached from the office.
- License dependency: TIA Portal, EcoStruxure, Sysmac Studio or TwinCAT licenses are usually tied to the customer's engineering computer. Moving the project to your own machine is not always possible.
- Legacy hardware: The computer of a line installed ten years ago does not have modern remote management features.
A common question: does it connect to the PLC or to the computer?
In its KVM function the device connects not to the PLC itself but to the engineering computer that is connected to the PLC. With QuickDesk Pro you can also connect the PLC to the device's LAN port over Ethernet and carry out direct remote PLC maintenance; this method is described on the QuickDesk Pro page.
In KVM use, the chain is as follows: you connect to the device from your browser, you use the engineering computer's screen and keyboard through the device, and the licensed software on that computer communicates with the PLC as it always has. In KVM use, the communication structure, protocol and addressing on the PLC side do not change. The software and its licence stay on the customer's computer; no licence transfer is needed.
Summary comparison
- Remote desktop software: Does everything if the operating system is running; can do nothing if it is not.
- VPN + RDP: Works if the network and the operating system are up; goes out of action when the network adapter or the operating system fails.
- iLO / iDRAC / IPMI: Works at hardware level but is only available on servers that have this feature.
- KVM-over-IP (external device): Works over HDMI and USB, so it is independent of brand and operating system; no software is installed on the target computer. The computer must have power and output video.
What does installation require in practice?
A basic installation needs an HDMI output and a free USB port on the target computer, plus a power source for the device. On the network side, one of the Ethernet, Wi-Fi or 4G LTE options is used.
No software is installed on the target computer, and screen and keyboard access does not require restarting it. This is a significant advantage in environments where touching a validated or in-production computer is difficult. Powering a computer on remotely is a different matter: Wake-on-LAN wakes a computer that supports it and may need BIOS and network card settings; it does not restart a frozen computer. Power/reset control through the device requires wiring to the computer's power and reset connection, and feasibility is checked during installation. If the corporate network must not be touched at all, the device can use a separate 4G LTE connection; this needs a mobile line and adequate coverage on site.
Don't overlook security
Any solution that provides remote access to a computer's keyboard and screen also creates a new access surface. For this reason, KVM-over-IP devices should not be thought of as a security product on their own. When commissioning, clarify the following:
- Who can access the device and at what permission levels
- Whether session logs will be kept
- Whether management traffic will pass through the cloud or through your own server (on-premise installation)
- Which network segment the device will be placed in
In projects where data must not leave the organization, products with an on-premise installation option should be preferred. With this option traffic passes through a server under your control; on its own, however, it does not guarantee that all data stays in-house or that legal requirements are met.
When is it not necessary?
It is not necessary everywhere. If you can walk to the computer in a minute, if the cost of downtime is low, or if the machine already has iLO/iDRAC, you may not need this kind of device. It is also not the right tool for everyday office screen sharing, presentations or watching video; remote desktop software is already better suited for that.
The sensible question is: how long does it take me to physically reach this computer's screen, and what is stopped during that time? If the answer is hours of lost production, a hardware-level access path can pay for itself quickly.
The MicronTech approach
MicronTech is the Turkey distributor of QuickDesk Pro, an industrial KVM-over-IP and out-of-band management device. We provide sales, installation and configuration services for SCADA and HMI stations, PLC engineering computers, industrial PCs at remote sites and headless servers.
Besides the KVM function, QuickDesk Pro lets you mount an ISO on its virtual USB drive to reinstall the operating system remotely and transfer files. It also offers additional operating modes (e.g. programming a PLC remotely by connecting it to the device's LAN port). These modes are separate from KVM access and need their own network and security planning; the KVM connection alone does not give direct access to the PLC.
Before recommending a product, we talk through the scenario: which computer, what its downtime costs, what the current access path is and where it breaks. Based on the answers, we decide together which computer the device connects to, which link is used (Ethernet, Wi-Fi or 4G LTE) and who gets access with which permissions.
Explore the QuickDesk Pro product page or contact us to evaluate your own scenario together.