Search NASA⌕ Search

SEARCH · Search NASA

Results for “Programmable Logic Controller”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

A full-scope, high-fidelity simulator-based hardware-in-the-loop testbed for comprehensive nuclear power plant cybersecurity research

Nuclear power plant (NPP) cybersecurity research often relies on hardware-in-the-loop (HIL) testbeds that integrate real hardware components into simulated environments. These testbeds allow researchers to identify vulnerabilities, evaluate attack impacts, and test security measures in a controlled setting. Furthermore, previous HIL testbeds lacked fidelity to accurately represent real nuclear systems, limiting the scope of cybersecurity analysis. This study presents the creation of a HIL testbed, devised upon a full-scope, high-fidelity NPP simulator, to facilitate realistic and comprehensive cybersecurity research. To demonstrate its capabilities, the control logic for the steam generator water level was migrated from the simulator to an external programmable logic controller. As a practical application of the developed testbed, supply chain attack scenarios were simulated by injecting malicious code into the controller logic, and the effects of manipulating sensor inputs and control commands were observed. While this HIL testbed provides more detailed simulations, enhanced realism, and wider applicability compared to other options utilizing a less complex simulator, it is also more intricate and costly. For this reason, we include a detailed comparison with some alternative architectures to aid fellow researchers and practitioners in the selection of a suitable HIL architecture based on specific research objectives.

47 OTHER INSTRUMENTATION↗
DOE OSTI2024

StructuredFuzzer: Fuzzing Structured Text-Based Control Logic Applications

Rigorous testing methods are essential for ensuring the security and reliability of industrial controller software. Fuzzing, a technique that automatically discovers software bugs, has also proven effective in finding software vulnerabilities. Unsurprisingly, fuzzing has been applied to a wide range of platforms, including programmable logic controllers (PLCs). However, current approaches, such as coverage-guided evolutionary fuzzing implemented in the popular fuzzer American Fuzzy Lop Plus Plus (AFL++), are often inadequate for finding logical errors and bugs in PLC control logic applications. They primarily target generic programming languages like C/C++, Java, and Python, and do not consider the unique characteristics and behaviors of PLCs, which are often programmed using specialized programming languages like Structured Text (ST). Furthermore, these fuzzers are ill suited to deal with complex input structures encapsulated in ST, as they are not specifically designed to generate appropriate input sequences. This renders the application of traditional fuzzing techniques less efficient on these platforms. To address this issue, this paper presents a fuzzing framework designed explicitly for PLC software to discover logic bugs in applications written in ST specified by the IEC 61131-3 standard. The proposed framework incorporates a custom-tailored PLC runtime and a fuzzer designed for the purpose. We demonstrate its effectiveness by fuzzing a collection of ST programs that were crafted for evaluation purposes. We compare the performance against a popular fuzzer, namely, AFL++. The proposed fuzzing framework demonstrated its capabilities in our experiments, successfully detecting logic bugs in the tested PLC control logic applications written in ST. On average, it was at least 83 times faster than AFL++, and in certain cases, for example, it was more than 23,000 times faster.

47 OTHER INSTRUMENTATION↗
DOE OSTI2023

Modbus RTU for Embedded Cyber Secure Inverter Controller

The Modbus communication protocol is a widely adopted communication standard in industrial control systems. This communication protocol is known for being reliable and straightforward to implement while being versatile in terms of its operating parameters while supporting multiple formats over various hardware infrastructures and architectures. Many intelligent devices such as Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), Internet-of-Things (IoT), and various Operational Technologies (OT) utilize Modbus for their communication systems. These types of systems must communicate with each other through a standardized and central communication process. To support the integration of these modular systems, a Field-Programmable Gate Array (FPGA) can act as an embedded central routing fabric for this communication to take place. Embedded systems are versatile enough to interface with various devices and systems to accomplish various goals. Additionally, embedded systems require relatively small physical designs to minimize the required resources to facilitate the intended application by providing low-level system access. This minimization of system resources goes hand in hand with reducing the financial cost of a proposed solution or system. As remotely collaborating researchers often use FPGAs to prototype designs that are required to have a method for data transmission among systems, it is imperative to provide a baseline standard for communications among devices and systems. A typical method of implementing the Modbus RTU communication protocol in an embedded environment is using integrated logic architectures within the FPGA called “Intellectual Property (IP) cores.” IP cores can be designed using integrated logic or circuit designs to function as an embedded processor. These IP cores can then perform the required computational actions to support the Modbus RTU communication protocol by utilizing high-level programming languages such as the C programming language. The hardware description language of Very High-Speed Integrated Circuit Hardware Description Language (VHDL) allows for the control of real hardware at the logic gate and signal level. These logic gates and signals can be designed and controlled to perform desired actions based on the system design. Programming an FPGA using VHDL allows an individual to access the lowest abstraction level of the system during FPGA development. This level of abstraction is referred to as the register-transfer level (RTL), which gives access to manipulating values and variables at the register level. This register-level manipulation provides precision over creating the logical circuit within the FPGA, thus minimizing the required code to perform desired operations. The Modbus RTU communication protocol can be implemented within an FPGA using VHDL programming to establish a standardized and embedded serial communication pathway. This implementation provides a standardized communication protocol to streamline research efforts among researchers, thus increasing the efficiency of research efforts. Additionally, this Modbus RTU implementation requires fewer resources when compared to typical communication protocol implementations that utilize an IP core, reducing the hardware requirement for effective research efforts.

communication↗
DOE OSTI2023

Digital Twin for Hydropower System Object Modeling: Alder Dam (FY2023)

Hydropower is the world's largest source of renewable electricity, and hydropower plants are distributed all over the world. Typical major components of a hydropower plant are the governor, excitation, generator, thrust bearing, hydraulic turbine, transformer, the main lead, metering and control, tailwater depression, and dissolved oxygen. For each component, various measures are taken. The measurements are acquired by various heterogeneous systems, including standalone sensors, programmable logic controllers (PLC), Supervisory control and data acquisition (SCADA), Internet of Things (IoT), and data acquisition and integration platforms such as OSI/PI. The measured data are often archived within the plant by a data management platform, and many institutions have cloud-based archive systems, such as Hydropower Research Institution (HRI), U.S. Army Corps of Engineers (USACE), and Columbia River Data Access in Real Time (DART). Object Modeling is a general framework for designing information systems. It focuses on objects, the actions they perform, and the messages they send to one another to cause those actions to be taken. The major differences among object modeling, network modeling, data modeling, and process modeling are that in the first we focus on the actions in response to information, objects which form the system, the actions they perform, and how they pass information to one another, while in the second we concentrate on where, when and how much information is moved, while in the third we focus on what information is moved and where it is moved, while in the last we focus on how it is moved and when it is moved. Object modeling was developed basically as a method to develop object-oriented systems and to support object-oriented programming. It describes the static structure of the system. The object Modeling Technique is easy to draw and use. That is why we choose object modeling to connect physical hydropower plants to Digital Twin. It recognizes the objects and the relationship between them. It identifies the attributes and functions of each class. Dynamic Modeling: It explains how objects respond to events. Functional Modeling indicates the processes executed in an object and how data changes when it moves to objects. It has been used in many applications like telecommunication, transportation, etc.

13 HYDRO ENERGY↗
DOE OSTI2024

CDL2PLC translator v0.1.0

The CDL-PLC translator aims at translating control sequences for building energy systems from the CDL CXF format to the PLCopen XML format. The CDL CXF developed at LBL within the OpenBuildingControl project, and now being standardized via ASHRAE Standard 231P, enables expressing control sequences developed in the simulation environment Modelica in a JSON format. The PLCopen XML is an existing exchange format standardized in IEC 61131-10 for Programmable Logic Controllers (PLCs) following the IEC 61131 standard as one target system of CDL among others. The translation from the CDL CXF to the PLCopen XML contributes to a seamless workflow from the model-based development of control sequences in simulation environments, which is not building practice today, and their digital implementation on building controllers, which replaces graphical and textual documents used for this purpose today. The translator is at a prototypical stage and enables, as a proof of concept, the translation of very simple control sequences composed of 4 selected function blocks out of 137 function blocks defined in CDL. The translation includes the connection of inputs and outputs of function blocks and the expression of a control function in CDL to the equivalent code in IEC 61131-3.

Walther, Karl↗
DOE OSTI2020

Continuous Monitoring and Partial Water Softening for Cooling Tower Water Treatment

Cooling towers are an integral component of many refrigeration systems, providing comfort or process cooling across a broad range of applications. They are the point in the system where heat is dissipated to the atmosphere through the evaporative cooling process. Cooling towers are commonly found in industrial applications and are also often used in water-cooled chilled water plants in medium to large commercial buildings. Continuous monitoring and partial water softening for cooling towers used in medium to large commercial buildings are the focus of this paper. Cooling towers consume large amounts of water. Cooling tower-related water consumption is one of largest potable water loads within buildings in the United States, with substantial building water use associated with heating and cooling. Regional water shortages have highlighted a need to reduce water consumption; the U.S. General Services Administration (GSA) and Executive Order 13834 place priority on reducing water consumption. This priority has fueled interest in the identification, investigation, and potential broad deployment of cost-effective opportunities to reduce water use, such as alternative water treatment (AWT) technologies for cooling towers. Traditional water treatment approaches use chemicals to extend the ability of the water to hold scaling minerals in suspension, minimize corrosion, and prevent biological growth. This treatment protects the chillers and cooling tower equipment; however, even when chemicals are used regularly, a certain percentage of condenser water must be drained and made up with fresh water to maintain system water quality parameters. In addition, the use of chemicals sometimes creates a waste disposal issue and can cause building owners to incur additional fees, such as disposal or wastewater charges. To manage cooling tower water treatment, GSA typically contracts with a company specializing in conventional chemical maintenance for a fixed fee. While there are many types and vendors of AWT systems, this project assesses the effectiveness of one technology provided by Aqualogix. This system is a chilled water plant monitoring and control system aimed at optimizing system performance by reducing the blowdown occurrences used to remove mineral build-up. The technology consists of two components – continuous programmable logic control (PLC) monitoring and side-stream filtration with partial water softening. PLC monitoring calculates cycles of concentration (CoC) and determines the optimum amount of blowdown water required to satisfy all water chemistry requirements. Side-stream filtration removes suspended matter and improves biocide efficacy while precisely dispensing softened water to achieve optimal makeup water hardness. Unlike other AWT systems evaluated by GSA to date, this system does not replace the legacy treatment system but is used in addition to chemical water treatment. The vendor claims their technology will reduce water consumption, water discharge, and maintenance costs. The AWT system evaluated in this demonstration is a commercialized technology. Given its commercialized state, the system evaluated in this report is at a Technology Readiness Level 9 according to National Aeronautics and Space Administration (NASA) definitions.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗
DOE OSTI2025

Hardware-Based Demonstration of Temperature Control Functions for Reactor Systems

Establishing autonomy in reactor control systems has become essential for the expansion of nuclear technologies. Thermal regulation in particular remains crucial for maintaining stable operation and ensuring the integrity of fuel. To alleviate public skepticism of the safety of nuclear reactors, demonstrating control over this key factor is pivotal. Utilizing electric heat pads to simulate the heat released in a reactor core, thermocouples for temperature monitoring, and an Arduino micro programmable logic controller (PLC) for control, a hardware-based demonstration of a reactor heating system validates the efficacy of reactor control over this key parameter. To improve precision, a proportional-integral-derivative (PID) algorithm was implemented in the heating control loop to ensure meticulous control of reactor functions. In addition, the integration of this physical system with a digital simulator tool such as RELAP5-3D establishes a foundation for a comprehensive testing environment. This allows for a refinement of temperature control under various simulated reactor conditions, bringing another layer of reliability to the operation of the system. By facilitating a physical demonstration of reactor thermal management and control strategies, this project provides a foundation for expanded testing and educational outreach. Ultimately, this system advances the broader goal of demonstrating the safety and viability of autonomous reactor operations, contributing to public trust and future reactor deployment.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2025

Project Presentation: Hardware-Based Demonstration of Temperature Control Functions for Reactor Systems

Autonomous thermal regulation in nuclear reactors remains crucial for maintaining stable operation and ensuring the integrity of fuel. To alleviate public skepticism of the safety of nuclear reactors, demonstrating control over this key factor is pivotal. Utilizing electric heat pads to simulate the heat released in a reactor core, thermocouples for temperature monitoring, and an Arduino micro programmable logic controller (PLC) with an embedded proportional-integral-derivative (PID) algorithm for control, a hardware-based demonstration of a reactor heating system will validate the efficacy of reactor control over this key parameter. This report covers internship project presentation as well as relevant experience with nuclear and proposal for project upgrade.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2025

Poster: Hardware-Based Demonstration of Temperature Control Functions for Reactor Systems

Autonomous thermal regulation in nuclear reactors remains crucial for maintaining stable operation and ensuring the integrity of fuel. To alleviate public skepticism of the safety of nuclear reactors, demonstrating control over this key factor is pivotal. Utilizing electric heat pads to simulate the heat released in a reactor core, thermocouples for temperature monitoring, and an Arduino micro programmable logic controller (PLC) with an embedded proportional-integral-derivative (PID) algorithm for control, a hardware-based demonstration of a reactor heating system will validate the efficacy of reactor control over this key parameter.

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN↗
DOE OSTI2023

Creating a Digital Twin for a Hydropower System through 3D Object Modeling: Alder Dam FY23

Hydropower stands as the world's leading source of renewable electricity, with hydropower plants spanning the globe. A typical hydropower plant comprises essential components including the governor, excitation system, generator, thrust bearing, hydraulic turbine, transformer, main lead, metering and control devices, tailwater depression system, and dissolved oxygen monitoring. Each of these components undergoes various measures and monitoring procedures. These measurements are collected through a diverse array of systems, encompassing standalone sensors, programmable logic controllers (PLCs), Supervisory Control and Data Acquisition (SCADA) systems, Internet of Things (IoT) devices, and data acquisition and integration platforms like OSI/PI.

13 HYDRO ENERGY↗
DOE OSTI2024

Integrate Latimer Controls' Solution into RTAC (CRADA Final Report, CRD-23-24672)

Latimer Controls, Inc. was awarded two vouchers under the Department of Energy's American-Made Solar Prize Round 6 to conduct collaborative research at a national laboratory. The National Renewable Energy Laboratory (NREL) was selected as a partner to assist Latimer Controls in the performance evaluation of its photovoltaic (PV) control software. This collaboration focuses on developing a hardware-in-the-loop (HIL) testbed at NREL, which will be used to test and validate the Latimer PV control technology in a realistic yet de-risked environment. Both Latimer and NREL teams will work together to analyze the collected test data, derive insights, and disseminate the scientific findings. Recent studies underscore the potential of solar energy as a zero-marginal-cost and zero-emission flexibility resource within the bulk power system, particularly when integrated with advanced control systems. To enhance the performance of such systems, Latimer Controls has developed leading-edge technologies, including machine learning (ML) algorithms and hierarchical inverter set-point allocation methods. These innovations are designed to estimate the operational headroom of large PV plants for grid integration and control. However, comprehensive validation under real-world conditions remains necessary. To address this gap, the concurrent CRADA project proposes the real-world application and validation of the Latimer Control solution within a HIL environment. Initially, the Latimer algorithm was developed and tested within MATLAB Simulink, a platform suitable for research-level simulations and iterative development. However, transitioning this technology to a real solar site as an industry-ready solution necessitates implementation in a format compatible with widely used solar power plant controllers. In this additional CRADA work, the MATLAB Simulink-based logic will be translated into Structured Text, a programming language compliant with IEC 61131 standards, which is commonly used for custom logic implementations in industry-leading programmable logic controllers (PLCs), such as the Schweitzer SEL real-time automation controller (RTAC). This transition will facilitate the deployment of the Latimer Control solution in real-world solar power plants, thereby advancing the technology towards commercialization.

14 SOLAR ENERGY↗
DOE OSTI2022

Detecting Hardware Trojans in PCBs Using Side Channel Loopbacks

Malicious modifications to printed circuit boards (PCBs) are known as hardware Trojans. These may arise when malafide third parties alter PCBs premanufacturing or postmanufacturing and are a concern in safety-critical applications, such as industrial control systems. In this research, we examine how data-driven detection can be utilized to detect such Trojans at run-time. We develop a flexible and reconfigurable PCB test bed derived from the popular open-source programmable logic controller (PLC) platform “OpenPLC.” We then develop a Trojan detection framework, which utilizes and analyzes multimodal side channels (e.g., timing, magnetic signals, power, and hardware performance counters). We consider defender-configurable input/output (I/O) loopback test, comparison with design-document baselines, and magnetometer-aided monitoring of system behavior under defender-chosen excitations. Our approach can extend to golden-free environments. Golden (known-good) versions of the PCBs are assumed not available, but design information, datasheets, and component-level data are available. We demonstrate the efficacy of our approach on a range of Trojans instantiated in the test bed.

42 ENGINEERING↗
DOE OSTI2026

A New Era for Modern Bubble Chamber Technology: Cooling and Real-Time Control for the MAMBA Neutrino Bubble Chamber∗

Future neutrino experiments such as DUNE will be limited less by statistics than by how well neutrino--nucleus interactions are understood, and the cleanest way to improve that understanding is to measure interactions with light nuclei such as hydrogen or deuterium. The detector best suited to the job, the bubble chamber, has not been built for a neutrino beam in about fifty years. MAMBA (Modern Adaptive Modular Bubble chamber Archetype) is a small prototype at Fermilab intended to bring the technology back with modern cryogenics and automation, cycling continuously at 1~Hz. This paper summarizes my work on two of its subsystems during a summer internship. A new solid copper thermal link brought the coldhead to 21.3~K in a commissioning cooldown, near the 20~K operating target. An Industrial Shields Raspberry Pi programmable logic controller (PLC) running OpenPLC was characterized at a median round-trip response of 0.64~ms over 20,000 trials, with 0.66\% of trials exceeding 1~ms. Both results support continuous cycling.

Williams, Nicholas [Fermilab; DuPage Coll.]↗
DOE OSTI2025

Real-Time Automated pH Control within Batch Processes Relying on Raman pH Measurement

Nuclear fission is an energy source that can provide consistent power with very low associated carbon emissions. However, management of the used nuclear fuel is an important aspect of the application of nuclear power. Recycling of useful components from used fuel is an attractive option, but this involves chemical processing of the fuel. Possible chemical separation technologies that might be used in this regard are sensitive to solution pH. Raman spectroscopy is a promising technique for monitoring the pH of solutions in real time. Classical pH probes are too fragile to be used in the harsh environments encountered in nuclear fuel processing. Raman probes are robust and can withstand these harsh environments to track pH. Coupled with chemometric analysis, the demonstration of the use of Raman spectroscopy to track and predict the pH in carboxylate-buffered systems is made possible. Utilizing this spectroscopy in conjunction with Programmable Logic Controllers mimics industrial control systems used in many modern industrial settings. This showcases a pragmatic approach toward leveraging Raman spectroscopy and chemometric model outputs as inputs for a real-time control system. The model to predict pH created by chemometrics proved to be successful in tracking pH. The optimal pH for TALSPEAK extraction of lanthanides and actinides from aqueous solution is known to proceed in a narrow pH range of around pH = 2.8 ± 0.1. This study uses Raman optical monitoring and automated control to return and maintain solution pH within this range after acid or base perturbations move the solution pH well outside this region. Root-mean-square errors show that pH changes measured using Raman spectroscopy on the batch process solution are reliably measured and used to automatically correct and maintain solution pH. Measurement of solution pH tracks favorably with electrochemical pH probe comparison measurements. As a result, the ability to showcase Raman spectroscopy paired with chemometrics analysis acts as a durable, better alternative data source compared to traditional pH probes to optimize the separation efficiency in the used nuclear fuel processing.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗
DOE OSTI2021

PLC-based Impedance Measurement and Current Injection Response Analysis

Studying and mitigating the vulnerabilities of Programmable Logic Controllers (PLCs) to electromagnetic pulse is important for the reliability of the power system. In this paper, an effective impedance measurement scheme is proposed to estimate the susceptibility of PLCs to an electromagnetic pulse. The equivalent non-uniform transmission line model is established to eliminate the impact of the fixture in the de-embedding process. Based on the measured impedance, the equivalent circuit is established to calculate the response of the device when subjected to the electromagnetic pulse. The voltage and current responses of different interfaces are compared utilizing the developed pulse Current Injection (CI) method. Finally, the impedance measurement scheme is verified through testing using three measuring instruments. And the CI simulation experiments reveal the characteristics and susceptibilities of different PLCs interfaces, indicating that some protection measures are required for the reliable operation of PLC.

Qiu, Wei↗
DOE OSTI2021

ManiPIO - Manipulate Process I/O

SAND2021-15053 O ManiPIO is a Python-based tool used to test Programmable Logic Controllers (PLCs), Industrial Control Systems (ICS), and ICS networks. It reads an input script to construct complex Events on ICS networks and uses the ModBus communication standard to communicate. Users can use ManiPIO to construct complex timelines of ICS communication events to simulate any number of network-based scenarios. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Hahn, Andrew↗
DOE OSTI2023

Supply Chain Binary Program Assessment Annual Report

Secure environments face a steadily increasing threat from the introduction of scientific equipment that includes extensive software components. Devices such as powerful microscopes, 3d printers, programmable logic controllers, and many others, increase our capability and scientific output. Unfortunately, they now frequently include an entire computing stack with custom software bundled along with entire operating systems. Our ability to introspect and understand binary software is extremely limited, opening up the possibility of malicious third-parties including software that compromises our critical missions.

42 ENGINEERING↗
DOE OSTI2024

PLC Vulnerabilities and Mitigations

Programmable Logic Controllers (PLCs) are used extensively in many high-importance industrial and nonindustrial settings including controlling elevators, manufacturing machines, and utility facilities such as power and natural gas, however cybersecurity protection for them has been neglected. Within recent years, PLCs have been put under more security scrutiny and experts have advocated for changes from the addition of protocol encryption and network segmentation to intrusion detection systems on the PLCs themselves. While PLC security is critical, a large portion of the PLCs available today will never receive these changes due to being legacy or the difficulty of overhauling the security on existing systems. Due to the infeasibility of applying many recommended security measures towards currently available machines, we aim to provide realistic and affordable best practices for hardening PLCs. We will first conduct security analysis and consider attack vectors within our target PLC. Once we’ve analyzed the device’s security, we will evaluate a variety of mitigation methods and create guidelines to effectively reduce the threat posed by PLC attacks with minimal disruption to operations.

42 ENGINEERING↗