Search NASA⌕ Search

SEARCH · Search NASA

Results for “Programmable Logic Controllers (PLCs)”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Port Impedance Measurement and Current Injection Response Analysis for PLCs

Programmable Logic Controllers (PLCs) are used to control devices throughout the power system since they have fast control capabilities and can utilize multiple types of communication interfaces. Therefore, studying and mitigating their vulnerabilities to electromagnetic pulse is important for the reliability of PLC operations. Here, in this paper, an effective impedance measurement scheme is proposed and demonstrated for three PLCs to estimate their susceptibility to an electromagnetic pulse. The equivalent non-uniform transmission line model is established to eliminate the impact of the fixture in the de-embedding process. Then different parameters of the impedance measurement setup are explored. Based on the measured impedance, the equivalent circuit is established to calculate the response of the device when subjected to the electromagnetic pulse. The voltage and current responses of different interfaces are compared utilizing the developed pulsed Current Injection (CI) method. Finally, the impedance measurement scheme is verified through testing using three measuring instruments. And the CI simulation experiments reveal the characteristics and susceptibilities of different PLCs interfaces, indicating that some protection measures are required for the reliable operation of the PLC.

42 ENGINEERING↗
DOE OSTI2024

Calibration of the analog beam-signal hardware for the credited engineered beam power limit system at the Proton Power Upgrade Project at the Spallation Neutron Source

A programmable signal processor-based credited safety control that calculates pulsed beam power based on beam kinetic energy and charge was designed as part of the Proton Power Upgrade (PPU) project at the Spallation Neutron Source (SNS). The system must reliably shut off the beam if the average power exceeds 2.145 MW averaging over 60 seconds. System calibration requires pedigree in measurements, calibration setup, and calculations. This paper discusses the calibration of the analog beam signal components up to and including the Analog Digital Convertors (ADCs) for implementation into the Safety Programmable Logic Controllers (PLCs) and Field Programmable Gate Arrays (FPGAs).

Bobrek, Miljko↗
DOE OSTI2023

Modbus RTU for Embedded Cyber Secure Inverter Controller

The Modbus communication protocol is a widely adopted communication standard in industrial control systems. This communication protocol is known for being reliable and straightforward to implement while being versatile in terms of its operating parameters while supporting multiple formats over various hardware infrastructures and architectures. Many intelligent devices such as Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), Internet-of-Things (IoT), and various Operational Technologies (OT) utilize Modbus for their communication systems. These types of systems must communicate with each other through a standardized and central communication process. To support the integration of these modular systems, a Field-Programmable Gate Array (FPGA) can act as an embedded central routing fabric for this communication to take place. Embedded systems are versatile enough to interface with various devices and systems to accomplish various goals. Additionally, embedded systems require relatively small physical designs to minimize the required resources to facilitate the intended application by providing low-level system access. This minimization of system resources goes hand in hand with reducing the financial cost of a proposed solution or system. As remotely collaborating researchers often use FPGAs to prototype designs that are required to have a method for data transmission among systems, it is imperative to provide a baseline standard for communications among devices and systems. A typical method of implementing the Modbus RTU communication protocol in an embedded environment is using integrated logic architectures within the FPGA called “Intellectual Property (IP) cores.” IP cores can be designed using integrated logic or circuit designs to function as an embedded processor. These IP cores can then perform the required computational actions to support the Modbus RTU communication protocol by utilizing high-level programming languages such as the C programming language. The hardware description language of Very High-Speed Integrated Circuit Hardware Description Language (VHDL) allows for the control of real hardware at the logic gate and signal level. These logic gates and signals can be designed and controlled to perform desired actions based on the system design. Programming an FPGA using VHDL allows an individual to access the lowest abstraction level of the system during FPGA development. This level of abstraction is referred to as the register-transfer level (RTL), which gives access to manipulating values and variables at the register level. This register-level manipulation provides precision over creating the logical circuit within the FPGA, thus minimizing the required code to perform desired operations. The Modbus RTU communication protocol can be implemented within an FPGA using VHDL programming to establish a standardized and embedded serial communication pathway. This implementation provides a standardized communication protocol to streamline research efforts among researchers, thus increasing the efficiency of research efforts. Additionally, this Modbus RTU implementation requires fewer resources when compared to typical communication protocol implementations that utilize an IP core, reducing the hardware requirement for effective research efforts.

communication↗
DOE OSTI2022

Memory forensic analysis of a programmable logic controller in industrial control systems

In industrial control systems (ICS), programmable logic controllers (PLCs) are used to automate physical processes such as nuclear plants and power grid stations, and are often subject to cyber attacks. As in conventional IT domain, the memory analysis of the PLCs can help answer important forensic questions about the attack, such as the presence of malicious firmware, injection of modified control logic (the program running on the PLC), and manipulation of I/O devices (e.g., sensors and actuators). Unlike conventional IT domain, PLCs have heterogeneous hardware architecture, proprietary firmware and control software, making it challenging to employ a unified framework for their memory forensics. For merely extracting artifacts of forensic importance, reverse-engineering the firmware is a tedious task, and the effort needs to be repeated for every PLC model. As a community, a step-wise approach to tackle this challenge is to analyze the memory of specific PLCs, and subsequently find a generic framework applicable to all PLCs. Our work is a step forward in this direction. By following a methodology that focuses on the functional layer of PLCs instead of reverse engineering the firmware, we analyze the digital forensic artifacts available in a common PLC, Allen-Bradley ControlLogix 1756-L61. Before diving into the memory dump, we analyze the PLC control software to create a list of important artifacts that are sure to exist in the PLC memory dump. The approach employs a setup where PLC control software RSLogix-5000 is connected to the PLC, and the memory dump can be obtained as and when needed. We create test cases that sequentially highlight each category of artifacts, followed by an examination of the resultant impact on memory. After attaining the listed artifacts, we employ conventional string and known data searches to extract interesting information present in this PLC's memory. The memory analysis profile, presented as a Python library and shared with the community, can help a forensic investigator to readily extract forensic artifacts from the same model's controller. The adopted approach may help researchers in creating memory profile of other PLCs, and ultimately formulating a generic PLC memory analysis framework.

Rais, Muhammad Haris↗
DOE OSTI2023

Strengthening Cybersecurity for Industrial Control Systems: Innovations in Protecting PLC-Based Infrastructure

In this paper, we propose two new approaches aimed at enhancing the security of industrial control systems (ICS) that utilize programmable logic controllers (PLCs) for the control of critical processes. The first approach involves the addition of a unique digital watermark to the PWM control that adjusts the motor speed to control the critical process. This enables efficient detection and identification of any unauthorized modifications to the sensor signals responsible for controlling the plant. The second approach focuses on monitoring the input current (i.e power) drawn by the PLC during the execution of critical process control tasks. Malicious intrusions to change the PLC parameters and/or unauthorized firmware updates can be rapidly detected. Both approaches demonstrate a substantial improvement in the security of ICS, effectively safeguarding against potential cyber-attacks. Experimental results from a laboratory scale water tank level controlled via PLC showcases rapid intrusion detection capabilities.

Huang, Peng-Hao↗
DOE OSTI2021

PLC-based Impedance Measurement and Current Injection Response Analysis

Studying and mitigating the vulnerabilities of Programmable Logic Controllers (PLCs) to electromagnetic pulse is important for the reliability of the power system. In this paper, an effective impedance measurement scheme is proposed to estimate the susceptibility of PLCs to an electromagnetic pulse. The equivalent non-uniform transmission line model is established to eliminate the impact of the fixture in the de-embedding process. Based on the measured impedance, the equivalent circuit is established to calculate the response of the device when subjected to the electromagnetic pulse. The voltage and current responses of different interfaces are compared utilizing the developed pulse Current Injection (CI) method. Finally, the impedance measurement scheme is verified through testing using three measuring instruments. And the CI simulation experiments reveal the characteristics and susceptibilities of different PLCs interfaces, indicating that some protection measures are required for the reliable operation of PLC.

Qiu, Wei↗
DOE OSTI2021

ManiPIO - Manipulate Process I/O

SAND2021-15053 O ManiPIO is a Python-based tool used to test Programmable Logic Controllers (PLCs), Industrial Control Systems (ICS), and ICS networks. It reads an input script to construct complex Events on ICS networks and uses the ModBus communication standard to communicate. Users can use ManiPIO to construct complex timelines of ICS communication events to simulate any number of network-based scenarios. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Hahn, Andrew↗
DOE OSTI2024

CDL2PLC translator v0.1.0

The CDL-PLC translator aims at translating control sequences for building energy systems from the CDL CXF format to the PLCopen XML format. The CDL CXF developed at LBL within the OpenBuildingControl project, and now being standardized via ASHRAE Standard 231P, enables expressing control sequences developed in the simulation environment Modelica in a JSON format. The PLCopen XML is an existing exchange format standardized in IEC 61131-10 for Programmable Logic Controllers (PLCs) following the IEC 61131 standard as one target system of CDL among others. The translation from the CDL CXF to the PLCopen XML contributes to a seamless workflow from the model-based development of control sequences in simulation environments, which is not building practice today, and their digital implementation on building controllers, which replaces graphical and textual documents used for this purpose today. The translator is at a prototypical stage and enables, as a proof of concept, the translation of very simple control sequences composed of 4 selected function blocks out of 137 function blocks defined in CDL. The translation includes the connection of inputs and outputs of function blocks and the expression of a control function in CDL to the equivalent code in IEC 61131-3.

Walther, Karl↗
DOE OSTI2021

Automated Cyber Security Testing Platform for Industrial Control Systems

Nuclear Power Plants (NPPs) are a complex system of coupled physics controlled by a network of Programmable Logic Controllers (PLCs). These PLCs communicate process data across the network to coordinate control actions with each other and inform the operators of process variables and control decisions. Networking the PLCs allows more effective process control and provides the operator more information which results in more efficient plant operation. This interconnectivity creates new security issues, as operators have more access to the plant controls, so will bad actors. As plant networks become more digitized and encompass more sophisticated controllers, the network surface exposed to cyber interference grows. Understanding the dynamics of these coupled systems of physics, control logic, and network communications is critical to their protection. The research into the cybersecurity of the Operational Technologies of NPPs is developing and requires a platform that can allow high fidelity physics simulations to interact with digital networks of controllers. This will require three main components: a network simulation environment, a physics simulator, and virtual PLCs (vPLC) that represent typical industry hardware. A platform that incorporates these three components to provide the most accurate representation of actual NPP networks and controllers is developed in this paper.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2023

Creating a Digital Twin for a Hydropower System through 3D Object Modeling: Alder Dam FY23

Hydropower stands as the world's leading source of renewable electricity, with hydropower plants spanning the globe. A typical hydropower plant comprises essential components including the governor, excitation system, generator, thrust bearing, hydraulic turbine, transformer, main lead, metering and control devices, tailwater depression system, and dissolved oxygen monitoring. Each of these components undergoes various measures and monitoring procedures. These measurements are collected through a diverse array of systems, encompassing standalone sensors, programmable logic controllers (PLCs), Supervisory Control and Data Acquisition (SCADA) systems, Internet of Things (IoT) devices, and data acquisition and integration platforms like OSI/PI.

13 HYDRO ENERGY↗
DOE OSTI2024

PLC Vulnerabilities and Mitigations

Programmable Logic Controllers (PLCs) are used extensively in many high-importance industrial and nonindustrial settings including controlling elevators, manufacturing machines, and utility facilities such as power and natural gas, however cybersecurity protection for them has been neglected. Within recent years, PLCs have been put under more security scrutiny and experts have advocated for changes from the addition of protocol encryption and network segmentation to intrusion detection systems on the PLCs themselves. While PLC security is critical, a large portion of the PLCs available today will never receive these changes due to being legacy or the difficulty of overhauling the security on existing systems. Due to the infeasibility of applying many recommended security measures towards currently available machines, we aim to provide realistic and affordable best practices for hardening PLCs. We will first conduct security analysis and consider attack vectors within our target PLC. Once we’ve analyzed the device’s security, we will evaluate a variety of mitigation methods and create guidelines to effectively reduce the threat posed by PLC attacks with minimal disruption to operations.

42 ENGINEERING↗
DOE OSTI2024

Integrate Latimer Controls' Solution into RTAC (CRADA Final Report, CRD-23-24672)

Latimer Controls, Inc. was awarded two vouchers under the Department of Energy's American-Made Solar Prize Round 6 to conduct collaborative research at a national laboratory. The National Renewable Energy Laboratory (NREL) was selected as a partner to assist Latimer Controls in the performance evaluation of its photovoltaic (PV) control software. This collaboration focuses on developing a hardware-in-the-loop (HIL) testbed at NREL, which will be used to test and validate the Latimer PV control technology in a realistic yet de-risked environment. Both Latimer and NREL teams will work together to analyze the collected test data, derive insights, and disseminate the scientific findings. Recent studies underscore the potential of solar energy as a zero-marginal-cost and zero-emission flexibility resource within the bulk power system, particularly when integrated with advanced control systems. To enhance the performance of such systems, Latimer Controls has developed leading-edge technologies, including machine learning (ML) algorithms and hierarchical inverter set-point allocation methods. These innovations are designed to estimate the operational headroom of large PV plants for grid integration and control. However, comprehensive validation under real-world conditions remains necessary. To address this gap, the concurrent CRADA project proposes the real-world application and validation of the Latimer Control solution within a HIL environment. Initially, the Latimer algorithm was developed and tested within MATLAB Simulink, a platform suitable for research-level simulations and iterative development. However, transitioning this technology to a real solar site as an industry-ready solution necessitates implementation in a format compatible with widely used solar power plant controllers. In this additional CRADA work, the MATLAB Simulink-based logic will be translated into Structured Text, a programming language compliant with IEC 61131 standards, which is commonly used for custom logic implementations in industry-leading programmable logic controllers (PLCs), such as the Schweitzer SEL real-time automation controller (RTAC). This transition will facilitate the deployment of the Latimer Control solution in real-world solar power plants, thereby advancing the technology towards commercialization.

14 SOLAR ENERGY↗
DOE OSTI2026

Cybersecurity Center for Offshore Wind Energy (Final Project Report)

This project establishes a Cybersecurity Center for Offshore Wind Energy with the objective of designing and operating a cyber-physical testbed for wind energy farms (WEFs) that enables comprehensive cybersecurity research. The testbed incorporates a Supervisory Control and Data Acquisition (SCADA) system connected to turbine models via industrial-grade programmable logic controllers (PLCs) and remote terminal units (RTUs). It supports side-channel data acquisition, implementation and analysis of various cyberattack scenarios, and development of attack detection, mitigation, and best-practice guidance tailored to wind energy systems. During the project, the team expanded the number and fidelity of mathematical turbine models (MTMs), integrated these models with SCADA infrastructure, and deployed a scaled physical turbine and associated sensors. High-resolution operational and side-channel data streams were collected and used to refine machine-learning (ML)-based attack detection systems and to extend the WindCRAFT framework to multi-turbine threat scenarios. The project demonstrated a realistic, scalable environment for evaluating cyber threats, validated attack detection approaches using enriched datasets, and identified new multi-turbine and inter-turbine communication attack vectors. The resulting testbed, models, and security mechanisms provide a foundation for ongoing R&D and deployment of cyber-resilient offshore wind energy systems.

17 WIND ENERGY↗
DOE OSTI2024

StructuredFuzzer: Fuzzing Structured Text-Based Control Logic Applications

Rigorous testing methods are essential for ensuring the security and reliability of industrial controller software. Fuzzing, a technique that automatically discovers software bugs, has also proven effective in finding software vulnerabilities. Unsurprisingly, fuzzing has been applied to a wide range of platforms, including programmable logic controllers (PLCs). However, current approaches, such as coverage-guided evolutionary fuzzing implemented in the popular fuzzer American Fuzzy Lop Plus Plus (AFL++), are often inadequate for finding logical errors and bugs in PLC control logic applications. They primarily target generic programming languages like C/C++, Java, and Python, and do not consider the unique characteristics and behaviors of PLCs, which are often programmed using specialized programming languages like Structured Text (ST). Furthermore, these fuzzers are ill suited to deal with complex input structures encapsulated in ST, as they are not specifically designed to generate appropriate input sequences. This renders the application of traditional fuzzing techniques less efficient on these platforms. To address this issue, this paper presents a fuzzing framework designed explicitly for PLC software to discover logic bugs in applications written in ST specified by the IEC 61131-3 standard. The proposed framework incorporates a custom-tailored PLC runtime and a fuzzer designed for the purpose. We demonstrate its effectiveness by fuzzing a collection of ST programs that were crafted for evaluation purposes. We compare the performance against a popular fuzzer, namely, AFL++. The proposed fuzzing framework demonstrated its capabilities in our experiments, successfully detecting logic bugs in the tested PLC control logic applications written in ST. On average, it was at least 83 times faster than AFL++, and in certain cases, for example, it was more than 23,000 times faster.

47 OTHER INSTRUMENTATION↗
DOE OSTI2020

Edge Deployed Cyber Security Hardware Architecture for Energy Delivery Systems

At a time of accelerated cyber conflict, an “edge deployed” system will supply sensor based cyber ground truth to live grid models, and under secure command, take complete control of suspected rogue programmable logic controllers (PLCs) to maintain bulk power delivery to chosen critical sites. This hardware solution is purpose built to be agnostic to PLC vendor or protocol with the realization that a widely deployed solution must function with existing devices for rapid adoption by industry. An overview of the situation and how this developed system functions is provided.

42 ENGINEERING↗
DOE OSTI2021

Attacking the IEC-61131 Logic Engine in Programmable Logic Controllers in Industrial Control Systems

In industrial control systems (ICS), programmable logic controllers (PLCs) directly monitor and control a physical process such as nuclear power plants, gas pipelines, and water treatment. They are equipped with a control logic written in IEC-61131 languages (e.g., ladder logic and structured text) that defines how a PLC should control a physical process. A PLC's control logic is a usual target of a cyberattack to sabotage a physical process. For instance, Stuxnet targets a control logic of a Siemens S7-300 PLC to damage a nuclear facility's centrifuges. The existing attacks in the literature generally focus only on injecting malicious control logic into a PLC. This paper presents a new dimension of control logic attacks that target the control logic engine (responsible for running a control logic) of a PLC. It demonstrates that a cyberattack can disable the control logic engine successfully by exploiting inherent PLC features such as program mode and starting/stopping engine. We develop two novel case studies on control logic engine attacks by employing the MITRE ATT\&CK knowledge base on the real-world PLCs used in industry settings, i.e., 1) Schweitzer Engineering Laboratory (SEL)'s Real-Time Automation Controller (SEL-3505 RTAC) equipped with security features such as encrypted traffic and device-level access control, and 2) traditional PLCs, i.e., Schneider Electric's Modicon M221, Allen-Bradley's MicroLogix 1400 and 1100 that do not have security features. The case studies present the internals of the logic engine attacks and facilitate the ICS research community and industry to understand the attack vectors on the control logic engine. We evaluate the effectiveness of the control engine attacks on a power substation, a 4-floor elevator, and a conveyor belt to demonstrate their real-world impact of halting a physical process.

Ali qasim, Syed↗
DOE OSTI2026

CONTROL AND DATA ACQUISITION IN A CYBER-PHYSICAL MIDSTREAM TESTBED

This thesis presents the development of a laboratory-scale cyber–physical midstream pipeline testbed designed to address this gap and support research in industrial control systems security. The platform integrates pumps, valves, sensors, programmable logic controllers (PLCs), and a human–machine interface (HMI) to emulate the monitoring and control architecture of real pipeline operations. The physical process is implemented as a closed-loop liquid circulation system designed to replicate flow behavior characteristic of midstream pipeline infrastructure. The testbed enables real-time data acquisition of key process variables, including flow rate and pressure facilitating the generation of datasets representative of normal pipeline operation. A threat model encompassing common ICS attack vectors was developed, including sensor spoofing, command injection, false data injection, denial-of-service attacks, and relay manipulation. Multiple attack scenarios were implemented and evaluated to demonstrate how cyber intrusions targeting sensors, actuators, networks, and software propagate into measurable physical consequences in pipeline flow and pressure. The developed platform serves as a practical, cost-effective environment for experimentation, education, and future cybersecurity research in midstream pipeline systems.

42 ENGINEERING↗
DOE OSTI2021

Pressurizer dynamic model and emulated programmable logic controllers for nuclear power plants cybersecurity investigations

This work demonstrates the functionality of the pressurizer using a fast-running three regions, non-equilibrium model and control programs of emulated PLCs. The state variables from an integrated model of primary loop in a representative PWR plant are communicated to the pressurizer’s emulated PLCs using a synchronized data transfer function. In turn, the PLCs communicate back instructions to the pressurizer model to adjust the pressure and water level to remain within preprogramed setpoints. Pressurizer model simultaneously solves the coupled mass and energy conservation equations in the saturated vapor and saturated and subcooled liquid regions using fixed step solver. Results demonstrate the response of the pressurizer model linked to an emulated pressure and water level PLCs in a simulated transient involving surge-in and surge-out events. The 50 ms response delay time for the emulated PLC insignificantly affects operation and predictions of the pressurizer model.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗