SEARCH · Search NASA

Results for “PLC (Programmable Logic Controller)”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records

All sources NASA NTRS DOE OSTI

DOE OSTI2024

Primary Pump Motor Area - Transfer Fan Replacement PLC Design

My poster is about a project that I have worked on in my time at ATR as an intern. The Heating and Ventilation Control Panel (HVB-1) controls thirty-five heating and ventilation fans within the Advanced Test Reactor. This control panel needs replacement, as many of the components inside the existing panel are becoming old and degrading. In preparation for this replacement effort, concepts and component identification for the new control panel needed to be developed. Instead of replacing the new panel with replacement mechanical components, a Programmable Logic Controller (PLC) is proposed as a solution. Although multiple fans are associated with this panel, my poster focuses on the replacement design for the Primary Pump Motor Area Transfer Fan. This will provide an example of how the entire cabinet may be upgraded.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2021

JTAG-based PLC memory acquisition framework for industrial control systems

In industrial control systems (ICS), programmable logic controllers (PLC) are the embedded devices that directly control and monitor critical industrial infrastructure processes such as nuclear plants and power grid stations. Cyberattacks often target PLCs to sabotage a physical process. A memory forensic analysis of a suspect PLC can answer questions about an attack, including compromised firmware and manipulation of PLC control logic code and I/O devices. Given physical access to a PLC, collecting forensic information from the PLC memory at the hardware-level is risky and challenging. It may cause the PLC to crash or hang since PLCs have proprietary, legacy hardware with heterogeneous architecture. This paper addresses this research problem and proposes a novel JTAG (Joint Test Action Group)-based framework, Kyros, for reliable PLC memory acquisition. Kyros systematically creates a JTAG profile of a PLC through hardware assessment, JTAG pins identification, memory map creation, and optimizing acquisition parameters. It also facilitates the community of interest (such as ICS owners, operators, and vendors) to develop the JTAG profiles of PLCs. Further, we present a case study of Kyros implementation over Allen-Bradley 1756-A10/B to help understand the framework's application on a real-world PLC used in industry settings. The sample PLC memory dumps are shared with the research community to facilitate further research.

Rais, Muhammad Haris↗

DOE OSTI2026

PLC Integration for the Horn A Magnetic Field Mapping Device

This presentation summarizes the integration of a programmable logic controller (PLC) into the Horn A magnetic field mapping device for the Long-Baseline Neutrino Facility (LBNF). The device is used to position magnetic field probes along the centerline of the Horn A inner conductor to verify that the magnetic field within this region is approximately zero. The presentation covers the PLC hardware and electrical integration, stepper motor and encoder control, ladder logic development, mechanical integration, and system testing. Results include successful bidirectional motion and encoder feedback for the translation and rotation axes, as well as characterization of translational motion for repeatable probe positioning.

Bitakis, Kayla [Unlisted, US, IL]↗

DOE OSTI2019

Detecting control system misbehavior by fingerprinting programmable logic controller functionality

In recent years, attacks such as the Stuxnet malware have demonstrated that cyberattacks against control systems cause extensive damage. These attacks can result in physical damage to the networked systems under their control. In this paper, we discuss our approach for detecting such attacks by distinguishing between programs running on a programmable logic controller (PLC) without having to monitor communications. Using power signatures generated by an attached, high-frequency power measurement device, we can identify what a PLC is doing and when an attack may have altered what the PLC should be doing. To accomplish this, we generated labeled data for testing our methods and applied feature engineering techniques and machine learning models. The results of this research demonstrate that Random Forests and Convolutional Neural Networks classify programs with up to 98% accuracy for major program differences and 84% accuracy for minor differences. Our results can be used for both online and offline applications.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2025

Synchronous Machine Governor Upgrade

Conventional generation sources play a critical role in the stability and reliability of the electrical grid, particularly as we transition towards more renewable energy sources. To understand and accurately emulate their behavior for optimizing grid operations and ensuring seamless integration with renewable technologies, it is essential to better emulate the grid- and plant-level impacts of conventional generation sources, such as natural gas (NG) driven heat recovery steam generators (HRSGs) and combustion turbines (CTs). Therefore, a governor model is developed in a programmable logic controller (PLC) to investigate the performance of the conventional generator under various dynamic operating conditions and to identify the impact on grid stability in a controlled environment. The governor model aims to enable the hardware-in-the-loop (HIL) based emulation of these conventional generation sources using the existing 2 MVA synchronous machine/generator that is driven by a flexible 2.5 MW variable speed drive. This setup will allow us to replicate the dynamic characteristics and response behaviors of NG-driven HRSGs and CTs. The controls for the emulated conventional plants follow the industry standard and are adjustable, ensuring they accurately reflect the operational capabilities and limitations of real-world systems. These controls include load-following capabilities, ramp rates, startup and shutdown sequences, and emissions characteristics. By incorporating these adjustable controls, we aim to capture the nuanced impacts of conventional generation, such as their ability to provide ancillary services like frequency regulation, voltage support, and spinning reserve. In this report, we simulate two types of dynamic operations: grid-connected and islanding. For each dynamic operation, representative starting sequences are tested, including turbine purge, ignition, speed ramping up, generator excitation and synchronizing, and breaker close. The HIL based tests provides insights for field deployment, specifically the high-fidelity governor model provides results to predict the potential stability and reliability risk and suggest possible integration measures (e.g., generation and load balancing, tuning of governor control parameters). Ultimately, this enhanced emulation capability will be integrated into our Advanced Research on Integrated Energy Systems (ARIES), enabling us to conduct comprehensive studies on the interactions between conventional and renewable energy sources. By better understanding these interactions, we can develop strategies to optimize the overall performance and reliability of the grid. This will support the deployment of advanced grid management techniques, such as demand response, grid-forming inverters, and energy storage systems. The main contributions are summarized as follows: (1) This report introduces a PLC-based governor model for gas turbines. This model accurately simulates the dynamic behavior of conventional generation sources under various operational scenarios; (2) The model is integrated with an HIL testbed that includes a 2.5 MW variable speed drive and a 2 MVA synchronous machine. This setup enables realistic, real-time emulation of conventional power plants, particularly NG driven HRSGs and CTs; (3) The developed model is adaptable to various gas turbine configurations and allows for precise control over parameters such as MW ramp rates. This flexibility makes it a valuable tool for future research and industry collaboration; and (4) By incorporating the model into the National Renewable Energy Laboratory's Advanced Research on Integrated Energy Systems, the report lays the groundwork for future studies on interactions between conventional and renewable energy sources, enhancing the ability to develop advanced grid management strategies.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2023

Towards generic memory forensic framework for programmable logic controllers

A Programmable Logic Controller (PLC) is a microprocessor-based controller that is used to automate physical processes in critical infrastructure and various other industries and manufacturing sectors. Initially, PLCs were completely isolated from the Internet, and cyber security was not incorporated at the time of development. The introduction of industry 4.0 and the evolution of ICS systems to communicate over public IP addresses from the Internet enhanced productivity and efficiency, but Internet connectivity exposed the systems and their vulnerabilities, which led to an increase in cyber attacks. When a system is sabotaged/compromised, security analysts need to get to the root cause of the attack as quickly as possible to recover the system. To do so, memory forensic analysis is critical to provide a unique insight into the run-time memory activities and extract a reliable source of evidence. In this paper, we analyze the memory structure of the Schneider Electric Modicon M221 PLC. To build a memory profile, we reverse engineer the communication protocol and conduct differential analysis to gain knowledge about the structure of the memory and the low-level representation of control logic instructions. We then identify dynamic and static memory regions by modifying different project fields and conducting differential analysis, which allows us to identify boundaries of critical memory structures and extract important forensic artifacts that can be found in the memory. The Python implementation of the memory profile can help reduce the time and effort required for manual analysis in case of cyber incident or system failure.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

Detecting Hardware Trojans in PCBs Using Side Channel Loopbacks

Malicious modifications to printed circuit boards (PCBs) are known as hardware Trojans. These may arise when malafide third parties alter PCBs premanufacturing or postmanufacturing and are a concern in safety-critical applications, such as industrial control systems. In this research, we examine how data-driven detection can be utilized to detect such Trojans at run-time. We develop a flexible and reconfigurable PCB test bed derived from the popular open-source programmable logic controller (PLC) platform “OpenPLC.” We then develop a Trojan detection framework, which utilizes and analyzes multimodal side channels (e.g., timing, magnetic signals, power, and hardware performance counters). We consider defender-configurable input/output (I/O) loopback test, comparison with design-document baselines, and magnetometer-aided monitoring of system behavior under defender-chosen excitations. Our approach can extend to golden-free environments. Golden (known-good) versions of the PCBs are assumed not available, but design information, datasheets, and component-level data are available. We demonstrate the efficacy of our approach on a range of Trojans instantiated in the test bed.

42 ENGINEERING↗

DOE OSTI2019

LCLS-II Cryomodule and Cryogenic Distribution Control

The new superconducting Linear Coherent Light Source (LCLS-II) at the SLAC National Accelerator Laboratory will be an upgrade to LCLS, the world’s first hard X-ray free-electron laser. LCLS-II is in an advanced stage of construction with equipment for both Cryoplants as well as more than half of the 37 cryomodules onsite. Jefferson Lab (JLab) is a partner lab responsible for building half of the LCLS-II cryomodules. Hence the Low Energy Recirculation Facility (LERF) at JLab was used to stage and test LCLS-II cryomodules before shipping them to SLAC. LERF was set up to test two cryomodules at a time. LERF used LCLS-II cryogenic controls instrumentation racks, Programmable Logic Controllers (PLC) controls and Experimental Physics and Industrial Control System (EPICS) Input/Output Controllers (IOCs) with the intention to use the LERF setup to check-out and verify cryogenic controls for LCLS-II. The cryogenic controls first utilized at LERF would then be replicated for controlling all 37 cryomodules via an EPICS user interface. This paper discusses the cryogenic controls currently developed for implementation in the LCLS-II project.

43 PARTICLE ACCELERATORS↗

DOE OSTI2020

Continuous Monitoring and Partial Water Softening for Cooling Tower Water Treatment

Cooling towers are an integral component of many refrigeration systems, providing comfort or process cooling across a broad range of applications. They are the point in the system where heat is dissipated to the atmosphere through the evaporative cooling process. Cooling towers are commonly found in industrial applications and are also often used in water-cooled chilled water plants in medium to large commercial buildings. Continuous monitoring and partial water softening for cooling towers used in medium to large commercial buildings are the focus of this paper. Cooling towers consume large amounts of water. Cooling tower-related water consumption is one of largest potable water loads within buildings in the United States, with substantial building water use associated with heating and cooling. Regional water shortages have highlighted a need to reduce water consumption; the U.S. General Services Administration (GSA) and Executive Order 13834 place priority on reducing water consumption. This priority has fueled interest in the identification, investigation, and potential broad deployment of cost-effective opportunities to reduce water use, such as alternative water treatment (AWT) technologies for cooling towers. Traditional water treatment approaches use chemicals to extend the ability of the water to hold scaling minerals in suspension, minimize corrosion, and prevent biological growth. This treatment protects the chillers and cooling tower equipment; however, even when chemicals are used regularly, a certain percentage of condenser water must be drained and made up with fresh water to maintain system water quality parameters. In addition, the use of chemicals sometimes creates a waste disposal issue and can cause building owners to incur additional fees, such as disposal or wastewater charges. To manage cooling tower water treatment, GSA typically contracts with a company specializing in conventional chemical maintenance for a fixed fee. While there are many types and vendors of AWT systems, this project assesses the effectiveness of one technology provided by Aqualogix. This system is a chilled water plant monitoring and control system aimed at optimizing system performance by reducing the blowdown occurrences used to remove mineral build-up. The technology consists of two components – continuous programmable logic control (PLC) monitoring and side-stream filtration with partial water softening. PLC monitoring calculates cycles of concentration (CoC) and determines the optimum amount of blowdown water required to satisfy all water chemistry requirements. Side-stream filtration removes suspended matter and improves biocide efficacy while precisely dispensing softened water to achieve optimal makeup water hardness. Unlike other AWT systems evaluated by GSA to date, this system does not replace the legacy treatment system but is used in addition to chemical water treatment. The vendor claims their technology will reduce water consumption, water discharge, and maintenance costs. The AWT system evaluated in this demonstration is a commercialized technology. Given its commercialized state, the system evaluated in this report is at a Technology Readiness Level 9 according to National Aeronautics and Space Administration (NASA) definitions.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗

DOE OSTI2023

Digital Twin for Hydropower System Object Modeling: Alder Dam (FY2023)

Hydropower is the world's largest source of renewable electricity, and hydropower plants are distributed all over the world. Typical major components of a hydropower plant are the governor, excitation, generator, thrust bearing, hydraulic turbine, transformer, the main lead, metering and control, tailwater depression, and dissolved oxygen. For each component, various measures are taken. The measurements are acquired by various heterogeneous systems, including standalone sensors, programmable logic controllers (PLC), Supervisory control and data acquisition (SCADA), Internet of Things (IoT), and data acquisition and integration platforms such as OSI/PI. The measured data are often archived within the plant by a data management platform, and many institutions have cloud-based archive systems, such as Hydropower Research Institution (HRI), U.S. Army Corps of Engineers (USACE), and Columbia River Data Access in Real Time (DART). Object Modeling is a general framework for designing information systems. It focuses on objects, the actions they perform, and the messages they send to one another to cause those actions to be taken. The major differences among object modeling, network modeling, data modeling, and process modeling are that in the first we focus on the actions in response to information, objects which form the system, the actions they perform, and how they pass information to one another, while in the second we concentrate on where, when and how much information is moved, while in the third we focus on what information is moved and where it is moved, while in the last we focus on how it is moved and when it is moved. Object modeling was developed basically as a method to develop object-oriented systems and to support object-oriented programming. It describes the static structure of the system. The object Modeling Technique is easy to draw and use. That is why we choose object modeling to connect physical hydropower plants to Digital Twin. It recognizes the objects and the relationship between them. It identifies the attributes and functions of each class. Dynamic Modeling: It explains how objects respond to events. Functional Modeling indicates the processes executed in an object and how data changes when it moves to objects. It has been used in many applications like telecommunication, transportation, etc.

13 HYDRO ENERGY↗

DOE OSTI2025

Hardware-Based Demonstration of Temperature Control Functions for Reactor Systems

Establishing autonomy in reactor control systems has become essential for the expansion of nuclear technologies. Thermal regulation in particular remains crucial for maintaining stable operation and ensuring the integrity of fuel. To alleviate public skepticism of the safety of nuclear reactors, demonstrating control over this key factor is pivotal. Utilizing electric heat pads to simulate the heat released in a reactor core, thermocouples for temperature monitoring, and an Arduino micro programmable logic controller (PLC) for control, a hardware-based demonstration of a reactor heating system validates the efficacy of reactor control over this key parameter. To improve precision, a proportional-integral-derivative (PID) algorithm was implemented in the heating control loop to ensure meticulous control of reactor functions. In addition, the integration of this physical system with a digital simulator tool such as RELAP5-3D establishes a foundation for a comprehensive testing environment. This allows for a refinement of temperature control under various simulated reactor conditions, bringing another layer of reliability to the operation of the system. By facilitating a physical demonstration of reactor thermal management and control strategies, this project provides a foundation for expanded testing and educational outreach. Ultimately, this system advances the broader goal of demonstrating the safety and viability of autonomous reactor operations, contributing to public trust and future reactor deployment.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2025

Project Presentation: Hardware-Based Demonstration of Temperature Control Functions for Reactor Systems

Autonomous thermal regulation in nuclear reactors remains crucial for maintaining stable operation and ensuring the integrity of fuel. To alleviate public skepticism of the safety of nuclear reactors, demonstrating control over this key factor is pivotal. Utilizing electric heat pads to simulate the heat released in a reactor core, thermocouples for temperature monitoring, and an Arduino micro programmable logic controller (PLC) with an embedded proportional-integral-derivative (PID) algorithm for control, a hardware-based demonstration of a reactor heating system will validate the efficacy of reactor control over this key parameter. This report covers internship project presentation as well as relevant experience with nuclear and proposal for project upgrade.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2019

Automated Reconstruction of Control Logic for Programmable Logic Controller Forensics

This paper presents Similo, an automated scalable framework for control logic forensics in industrial control systems. Similo is designed to investigate denial of engineering operations (DEO) attacks, recently demonstrated to hide malicious control logic in a programmable logic controller (PLC) at field sites from an engineering software (at control center). The network traffic (if captured) contains substantial evidence to investigate DEO attacks including manipulation of control logic. Laddis, a state-of-the-art forensic approach for DEO attacks, is a binary-logic decompiler for the Allen-Bradley’s RSLogix engineering software and MicroLogix 1400 PLC. It is developed with extensive manual reverse engineering effort of the underlying proprietary network protocol and the binary control logic. Unfortunately, Laddis is not scalable and requires similar efforts to extend on other engineering software/PLCs. The proposed solution, Similo, is based on the observation that engineering software of different vendors are equipped with decompilers. Similo is a virtual-PLC framework that integrates the decompilers with their respective (previously-captured) ICS network traffic of control logic. It recovers the binary logic into a high-level source code (of the programming languages defined by IEC 61131-3 standard) automatically. Similo can work with both proprietary/open protocols without requiring protocol specifications and the binary formats of control logic. Thus, it is scalable to different ICS vendors. We evaluate Similo on three PLCs of two ICS vendors, i.e. MicroLogix 1400, MicroLogix 1100, and Modicon M221. These PLCs support proprietary protocols and the control logics written in two programming languages: Ladder Logic and Instruction List. The evaluation results show that Similo can accurately reconstruct a control logic from an ICS network traffic and can be used to investigate the DEO attacks effectively.

Ali qasim, Syed↗

DOE OSTI2025

Poster: Hardware-Based Demonstration of Temperature Control Functions for Reactor Systems

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN↗

DOE OSTI2025

IOTA Pre-Bake Test Development

The IOTA (Integrable Optics Test Accelerator) Bakeout project is intended to improve the quality of the vacuum within the IOTA ring. Impurities consisting of hydrogen and oxygen that build within the beampipe are reduced through applying heat to the beampipe’s exterior. Two versions of the Bakeout project exist, one as a smaller scale test setup, and one five times larger located within the IOTA ring. During my internship, I worked together with a team to bring this project from an effectively dormant state to ready for testing, working together to create full documentation of the PLC (Programmable Logic Controller) programs, making multiple new hardware configurations of this test possible, as well as an additional safety system.

Seagrave, Kayla [DuPage Coll.; Fermilab]↗

DOE OSTI2025

From Obsolete to Optimal (ATR Demineralized Water System)

My project was migrating a Human-Machine Interface (HMI) and Programmable Logic Controller (PLC) program from legacy software to a modern platform, enhancing operational efficiency and eliminating unsupported, obsolete equipment. Initially, I used a migration tool to transfer the programs to the new software, then manually updated variables to align with the new PLC. I optimized the PLC code by leveraging new scaling features in the I/O cards, removing over 45 obsolete rungs, and enhancing clarity with functional tag aliases. Next, I modernized the HMI's visuals with an updated color scheme and 3D buttons. I developed multiple interface versions iteratively refining them based on operator feedback. I also designed and created a dedicated "Rounds" screen incorporating insights from a previous intern’s project to streamline daily rounds. To improve clarity, consistency, and efficiency I redesigned the entire interface. Adding visual indicators to enhance operational awareness: red is used for values outside normal specifications, green for normal operating modes, yellow for manual mode, and grey for offline units. Additionally, I added a dynamic visual representation of tank levels, creating PLC logic to show the level in inches as well as inches and feet. I then incorporated a navigation sidebar to facilitate efficient screen transitions. Risk of human error was mitigated by defining narrow input ranges for tank level shutoff and password protecting setpoint changes. I also fixed issues with datatypes that caused inaccuracies in the original code. Overall, this comprehensive upgrade significantly enhanced the HMI's functionality, user experience, and operational reliability.

47 - OTHER INSTRUMENTATION↗

DOE OSTI2025

Control System Upgrade for Battery State-of-Charge Indications

The Advanced Test Reactor (ATR) Complex at Idaho National Laboratory (INL) relies on Battery Backed Power (BBP) systems and Uninterruptible Power Supplies (UPS) to ensure continuous power supply to critical components. This project aims to enhance the reliability and functionality of the battery monitoring and control systems by updating the State-of-Charge (SOC) system, Programmable Logic Controller (PLC), and Human-Machine Interface (HMI) for the nuclear safety-related battery banks. The current system, while functional, has areas for improvement, particularly in recharging calculations and alarm functions. The project objectives include developing flow charts, programming the new PLC and HMI, conducting bench tests, and updating design documentation. Additionally, the project ensures compliance with safety standards, develops training materials, creates comprehensive documentation, and integrates seamlessly with existing ATR infrastructure. The new SOC system is designed to be scalable for future upgrades, improve efficiency, enhance data accuracy, implement redundancy features, and achieve project goals within budget constraints while considering environmental impact. The methodology involved familiarizing with BBP and UPS systems, collecting current readings, rescaling signals, learning ladder logic, and updating the HMI. The transition from SLC 5/03 PLC using RS Logix 500 to CompactLogix 5380 using Studio 5000 was a key step. Despite challenges in transferring outdated PLC ladder logic and HMI code, starting from scratch led to a more accurate and efficient monitoring system, contributing to improved safety and operational efficiency. The project is currently awaiting approval of the Engineering Calculation and Analysis Report (ECAR) before implementation.

42 - ENGINEERING↗

DOE OSTI2025

ON THE EFFECTIVENESS OF LLMS IN UNIT TEST GENERATION FOR STRUCTURED TEXT PROGRAMS

The reliability of industrial automation systems heavily depends on the correctness of Programmable Logic Controller (PLC) programs, which are often written in Structured Text (ST). While Large Language Models (LLMs) have shown promise in automating test generation for mainstream programming languages, their effectiveness for the syntactically strict ST language remains underexplored. This thesis presents a systematic empirical evaluation of three state-of-the-art LLMs—GPT-4o, Gemini 2.5 Pro, and Claude Sonnet 4.5—for generating ST unit tests. We examine three prompting strategies: Natural Language (NL), Code Language (CL), and Chain-of-Thought (CoT), across a curated set of 11 ST function blocks. The quality of the generated tests is assessed using Compilation Success Rate (CSR), Statement Coverage (SC), and Branch Coverage (BC). In the zero-shot setting, Claude Sonnet 4.5 achieves the highest CSR, while Gemini 2.5 Pro consistently delivers the best statement and branch coverage, particularly under CL prompts. By incorporating a one-shot CL prompt, all models exhibit substantial improvements—most notably GPT-4o, whose CSR increases from 45.45% to 90.91%, with substantial gains in both SC and BC. To further contextualize these findings, we compare GPT-4o’s one-shot results with PLCAutoTester, a state-ofthe- art ST unit test generation tool, on an additional benchmark dataset. While LLMgenerated tests approach competitive coverage levels, PLCAutoTester maintains significantly higher and more stable coverage across programs. This study provides the first comprehensive benchmark of modern LLMs for ST unit testing, highlighting their strengths, limitations, and improvements through one-shot prompting, and positioning their performance relative to specialized automated testing tools in industrial automation.

42 ENGINEERING↗