SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Industrial Control Systems protocol parsers plugins for the Zeek network security monitoring framework. Currently we have four fully developed protocol parsers but we plan on adding more in the future. The protocol parsers we currently have developed are for BACnet, DNP3, Ethernet/IP, and Modbus.
Integration of information and communication technology (ICT) offers new opportunities in improving the management and operation of critical infrastructures such as power systems as it allows connection of different sensors and control components via a communication network, leading to the so-called networked control systems (NCS). However, the use of open and pervasive ICT such as the Internet or wireless communication technologies comes at a price of making NCS vulnerable to cyber intrusions/attacks which may cause physical damage. Here, this chapter presents control algorithms to ensure resilient and safe operation of NCS under unknown cyberattacks. Specifically, a variant of dynamic watermarking strategies is presented by embedding encoding/decoding components of chaotic signals into the NCS for secure control for critical locations where the measurement/control signals are transmitted to/from the control center via a communication network. In addition, resilient cooperative control algorithms are discussed to ensure safe operation at edge of the NCS which consists of a large number of distributed controllable devices. Several numerical examples are provided to illustrate the proposed control strategies.
OpDefender is a new system designed to enhance the cyber security of control system networks. It accomplishes this by inspecting each network packet using a novel, patent-pending method that extends software defined networking into the application/ICS protocol layer. OpDefender consists of two key components: 1. Smart, “ICS-aware” network switches that analyze and filter network traffic in real time. 2. A network management human machine interface (HMI) that allows an operator to monitor and control network traffic in real time. The “ICS-aware” switches can serve as a drop-in replacement for typical network switches, or they can be used in conjunction with existing network switches. OpDefender is configured and controlled in real time via a custom-built, web-based HMI designed with the operator in mind.
The Internet of Things (IoT) technology has dramatically improved the efficiency of today's building operation and management. By connecting controllable devices into a communication network, control signals can be easily passed to the devices, and operating status can be acquired from measurable ends with minimal effort. However, this all-connected configuration could also expose the network-based control system (NBCS) to malicious actions, such as cyberattacks. One of the common NBCSs is the building automation system. With the promotion of grid-interactive efficient buildings (GEBs), there has been increasing attention on securing the buildings from the network perspective. This research proposes a maximum-impact adversary design framework so that the adversary can provide the most adversarial impact on the controlled system while remaining stealthy. The proposed framework is numerically demonstrated on a network-based building energy and control system. The building energy system is built in a Modelica-based simulation environment and controlled by the state-of-the-art ASHRAE Guideline 36 control sequences. The control commands at the supervisory level, generated from the Guideline 36 controller, are assumed to be sent to local devices through communication networks using the BACnet protocol. Simulation results show that the proposed maximum-impact adversary on such a system can stealthily affect the building system's performance to its maximum extent. It is anticipated that results can be used by researchers and practitioners in the building automation industry to design efficient and robust cyber-attack detection algorithms, especially for stealthy attacks.
An islanded microgrid can be used to serve critcal load as a resiliency source when a severe outage occurs. In an islanded mode, control of a microgrid relies on the communication system significantly. Hence, microgrids are cyberphysical systems and, therefore, the cyber system plays a crucial role in the performance of the cyber-power system. A microgrid control scheme is proposed for power dispatch and regulation based on the droop and proportional-integral (PI) feedback control. The proposed control strategy is validated for transient stability following dynamic events. To evaluate the impact of a networked control system on control performance, a cyber model is developed to represent data acquisition periods and communication delays. An analytical method is proposed to determine the critical values for the data reporting periods and communication delays. The analytical method based on a state space model of a networked control system is applicable for large-scale systems. A 2-dimensional stability region of a microgrid in the space of cyber parameters can be obtained by the proposed method, and the critical values of cyber parameters are determined based on the stability region. Simulation results validate that the design of a microgrid as a cyber-physical system needs to be guided by critical values for the data reporting period and communication delay to prevent system instability.
In this article, we introduce an adaptive on-line model update algorithm designed for predictive control applications in networked systems, particularly focusing on power distribution systems. Unlike traditional methods that depend on historical data for offline model identification, our approach utilizes real-time data for continuous model updates. This method integrates seamlessly with existing online control and optimization algorithms and provides timely updates in response to real-time changes. This methodology offers significant advantages, including a reduction in the communication network bandwidth requirements by minimizing the data exchanged at each iteration and enabling the model to adapt after disturbances. Furthermore, our algorithm is tailored for non-linear convex models, enhancing its applicability to practical scenarios. The efficacy of the proposed method is validated through a numerical study, demonstrating improved control performance using a synthetic IEEE test case.
Techniques for ripple-type control of networked physical systems such as power systems, water systems, and others are provided. As one example, a device includes at least one processor configured to determine, for a first controllable device in a system, based on a measurement of an output parameter and a minimum output parameter value, an output violation value for the first device. The processor is further configured to determine, based on a present input value for the first device, the output violation value, and an assistance requisition value corresponding to a second device, a target input value for the first device. The processor is further configured to cause the first controllable device to modify operation based on the target input value and a maximum input value for the first controllable device.
A system for decoding an unknown automotive controller area network (“CAN”) message definitions. CAN data vehicle signal mappings are typically held in secret and varied by automotive model and year. Without knowledge of the mappings, the wealth of real-time vehicle data hidden in the automotive CAN packets is uninterpretable—impeding research, after-market tuning, efficiency and performance monitoring, fault diagnosis, and privacy-related technologies. This system can ascertain the CAN signals' boundaries (start bit and length), endianness (byte ordering), signedness (binary-to-integer encoding) from raw CAN data. This allows conversion of CAN data to time series. Interpreting the translated CAN data's physical meaning and finding a linear mapping to standard units (e.g., knowing the signal is speed and scaling values to represent units of miles per hour) can be achieved for many signals by leveraging diagnostic standards to obtain real-time measurements of in-vehicle systems. The system can be integrated into lightweight hardware enabling an OBD-II plugin for real-time in-vehicle CAN decoding or run on standard computers. The system can output a standard DBC file with the signal definition information.
The OT Emulation Data Broker system allows Simulink models to be connected to an emulated control system network. The package includes a Simulink S-Function that allows communication to the data broker via inter process communication; a data broker, which orchestrates communication between the emulated control system network and the simulation; an endpoint, which facilitates communication between the data broker and PLC's on the control network using ModBus/TCP; and an example PLC structured text files that work with OpenPLC, an open source emulated PLC. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2021-11479 O
SAND2021-11479 O The OT Emulation Data Broker system allows Simulink models to be connected to an emulated control system network. The package includes a Simulink S-Function that allows communication to the data broker via inter process communication; a data broker, which orchestrates communication between the emulated control system network and the simulation; an endpoint, which facilitates communication between the data broker and PLC's on the control network using ModBus/TCP; and an example PLC structured text files that work with OpenPLC, an open source emulated PLC. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.
This project advances a unified, open-source framework for the optimal co-design of thermal, electrical, and control systems in grid-interactive efficient districts (GEDs). As communities integrate growing levels of distributed energy resources, traditional approaches that model thermal and electrical networks independently lead to reduced efficiency, limited flexibility, and missed opportunities for coordinated operation. To address these challenges, the research team developed a comprehensive suite of physics-based models, control algorithms, and software tools that enable holistic simulation, optimization, and demonstration of district-scale energy systems.
Cyber-Physical Systems (CPS) are deployed to monitor physical processes in critical cyber-enabled services like power generation. However, CPS ecosystems are typically designed without robust security. While it is important to ensure optimal performance of the Operational Technology (OT) environments, security cannot be overlooked. To modernize traditional OT services, 5G technology is being integrated. 5G technology offers low latency and high availability, making it a suitable infrastructure for managing and monitoring physical processes. How-ever, integrating 5G mechanisms into large-scale OT networks introduces new implementation and performance challenges. Therefore, this paper presents a 5G-enabled CPS architecture (5G-CPS) that describes the necessary components, services, and communication protocols and conducts feasibility study to integrate 5G technology in industrial control system networks to understand the performance merits. The 5G-CPS architecture aims to minimize implementation and operational challenges associated with integrating 5G technology into constrained OT.
Recent cyber-attacks on industrial control systems, and inadvertent exposure of nuclear plant systems to cyber-exploits underscore the need for plant operators to adopt and deploy cyber-security defense solutions made for industrial control systems. Of increasing concern is the fact that international cyber hackers are beginning to target critical infrastructure, and because these more modern controls systems depend on advanced use of digital systems, they are more vulnerable than ever before to cyber-attacks. Traditional cyber defense strategies and products that have been available for decades are tailored for use on IT or corporate networks but can cause interruptions and catastrophic damage when deployed on industrial control system networks. The Department of Energy (DOE) Office of Nuclear Energy established the Gateway for Accelerated Innovation in Nuclear (GAIN) program to provide private companies pursuing innovative nuclear energy technologies with access to the technical support necessary to move toward commercialization. One of these GAIN small business vouchers was awarded to Dragos, Inc. to enable collaboration with Oak Ridge National Laboratory (ORNL) to evaluate the Dragos Platform on a production nuclear reactor test bed, hence laying the path for future commercial adoption. The vision was to provide a guide for industrial operators on implementing an industrial monitoring solution and to show how these solutions can be deployed without causing safety and reliability issues. This report documents the results of the collaboration between ORNL and Dragos, Inc.
Technologies relating to monitoring communications traffic to detect potential attacks on industrial control system networks and building automation system networks are described herein. In an embodiment, a monitoring device receives a plurality of communications from a control network. The monitoring device transmits the communications to a computing device. Based on the communications, the computing device generates a listing of devices that communicated by way of the control network over a period of time, and computes a volume of traffic between each pair of devices in the listing of devices. The computing device then outputs a graphical user interface (GUI) by way of display, the GUI comprising data indicative of the computed volumes of traffic, which may be indicative of a potential attack on the control network.
The increasing penetration of inverter-based resources (IBRs) into the existing power systems introduces tremendous benefits for enhanced sustainability but also poses inevitable challenges in terms of insufficient inertia, potential instability, and complex network dynamics, among others. However, the additional coupling introduced by the interactions among gridfollowing (GFL) and grid-forming (GFM) IBRs and the other components (i.e., synchronous generators [SGs], loads, and network, etc.) has not been clearly explored. A holistic, scalable, and quantitative stability analysis framework with the control systems and power networks is still missing. Here, in this paper, to fill in the technical gaps, a holistic small-signal model of the entire system with both rotating generation units and IBRs is established. An extended power flow model with operation dynamics from both generator control schemes and power networks is proposed to provide the varying steady-state operating points for small-signal modeling. The proposed method is compared with MATLAB solvers, and the results show that the proposed approach has a minimum calculation time, which can be less than 12 seconds for a large-scale power system with up to 2,000 buses. Furthermore, a quantitative method is developed to identify the impacts of IBRs on system performance with emphases on the potential stability issues with GFL IBRs, additional benefits of employing GFM IBRs, the feasibility of replacing SGs with GFM IBRs, and the impact of penetration level of different kinds of generation units. Finally, a field island power system is used to verify the proposed approach, and hardware-in-the-loop (HIL) tests are provided to further demonstrate the effectiveness of the proposed analysis.
The next generation of high-power lasers enables repetition of experiments at orders of magnitude higher frequency than what was possible using the prior generation. Facilities requiring human intervention between laser repetitions need to adapt in order to keep pace with the new laser technology. A distributed networked control system can enable laboratory-wide automation and feedback control loops. These higher-repetition-rate experiments will create enormous quantities of data. A consistent approach to managing data can increase data accessibility, reduce repetitive data-software development and mitigate poorly organized metadata. An opportunity arises to share knowledge of improvements to control and data infrastructure currently being undertaken. We compare platforms and approaches to state-of-the-art control systems and data management at high-power laser facilities, and we illustrate these topics with case studies from our community
Current proposed work is: See if the inherent security that comes with Named Networking (NDN) can be applied to Industrial Control Systems; and, Every packet is required to be cryptographically signed which makes every single piece of data communicated in the system secure and authenticated.
Quantum communications have progressed significantly, moving from a theoretical concept to small-scale experiments to recent metropolitan-scale demonstrations. As the technology matures, it is expected to revolutionize quantum computing in much the same way that classical networks revolutionized classical computing. Quantum communications will also enable breakthroughs in quantum sensing, metrology, and other areas. However, scalability has emerged as a major challenge, particularly in terms of the number and heterogeneity of nodes, the distances between nodes, the diversity of applications, and the scale of user demand. This article describes InterQnet, a multidisciplinary project that advances scalable quantum communications through a comprehensive approach that improves devices, error handling, and network architecture. InterQnet has a two-pronged strategy to address scalability challenges: InterQnet-Achieve focuses on practical realizations of heterogeneous quantum networks by building and then integrating first-generation quantum repeaters with error mitigation schemes and centralized automated network control systems. The resulting system will enable quantum communications between two heterogeneous quantum platforms through a third type of platform operating as a repeater node. InterQnet-Scale focuses on a systems study of architectural choices for scalable quantum networks by developing forward-looking models of quantum network devices, advanced error correction schemes, and entanglement protocols. Here, we report our current progress toward achieving our scalability goals.