Search NASA⌕ Search

SEARCH · Search NASA

Results for “programmable logic controller”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Towards generic memory forensic framework for programmable logic controllers

A Programmable Logic Controller (PLC) is a microprocessor-based controller that is used to automate physical processes in critical infrastructure and various other industries and manufacturing sectors. Initially, PLCs were completely isolated from the Internet, and cyber security was not incorporated at the time of development. The introduction of industry 4.0 and the evolution of ICS systems to communicate over public IP addresses from the Internet enhanced productivity and efficiency, but Internet connectivity exposed the systems and their vulnerabilities, which led to an increase in cyber attacks. When a system is sabotaged/compromised, security analysts need to get to the root cause of the attack as quickly as possible to recover the system. To do so, memory forensic analysis is critical to provide a unique insight into the run-time memory activities and extract a reliable source of evidence. In this paper, we analyze the memory structure of the Schneider Electric Modicon M221 PLC. To build a memory profile, we reverse engineer the communication protocol and conduct differential analysis to gain knowledge about the structure of the memory and the low-level representation of control logic instructions. We then identify dynamic and static memory regions by modifying different project fields and conducting differential analysis, which allows us to identify boundaries of critical memory structures and extract important forensic artifacts that can be found in the memory. The Python implementation of the memory profile can help reduce the time and effort required for manual analysis in case of cyber incident or system failure.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Automated Reconstruction of Control Logic for Programmable Logic Controller Forensics

This paper presents Similo, an automated scalable framework for control logic forensics in industrial control systems. Similo is designed to investigate denial of engineering operations (DEO) attacks, recently demonstrated to hide malicious control logic in a programmable logic controller (PLC) at field sites from an engineering software (at control center). The network traffic (if captured) contains substantial evidence to investigate DEO attacks including manipulation of control logic. Laddis, a state-of-the-art forensic approach for DEO attacks, is a binary-logic decompiler for the Allen-Bradley’s RSLogix engineering software and MicroLogix 1400 PLC. It is developed with extensive manual reverse engineering effort of the underlying proprietary network protocol and the binary control logic. Unfortunately, Laddis is not scalable and requires similar efforts to extend on other engineering software/PLCs. The proposed solution, Similo, is based on the observation that engineering software of different vendors are equipped with decompilers. Similo is a virtual-PLC framework that integrates the decompilers with their respective (previously-captured) ICS network traffic of control logic. It recovers the binary logic into a high-level source code (of the programming languages defined by IEC 61131-3 standard) automatically. Similo can work with both proprietary/open protocols without requiring protocol specifications and the binary formats of control logic. Thus, it is scalable to different ICS vendors. We evaluate Similo on three PLCs of two ICS vendors, i.e. MicroLogix 1400, MicroLogix 1100, and Modicon M221. These PLCs support proprietary protocols and the control logics written in two programming languages: Ladder Logic and Instruction List. The evaluation results show that Similo can accurately reconstruct a control logic from an ICS network traffic and can be used to investigate the DEO attacks effectively.

Ali qasim, Syed↗
DOE OSTI2022

Memory forensic analysis of a programmable logic controller in industrial control systems

In industrial control systems (ICS), programmable logic controllers (PLCs) are used to automate physical processes such as nuclear plants and power grid stations, and are often subject to cyber attacks. As in conventional IT domain, the memory analysis of the PLCs can help answer important forensic questions about the attack, such as the presence of malicious firmware, injection of modified control logic (the program running on the PLC), and manipulation of I/O devices (e.g., sensors and actuators). Unlike conventional IT domain, PLCs have heterogeneous hardware architecture, proprietary firmware and control software, making it challenging to employ a unified framework for their memory forensics. For merely extracting artifacts of forensic importance, reverse-engineering the firmware is a tedious task, and the effort needs to be repeated for every PLC model. As a community, a step-wise approach to tackle this challenge is to analyze the memory of specific PLCs, and subsequently find a generic framework applicable to all PLCs. Our work is a step forward in this direction. By following a methodology that focuses on the functional layer of PLCs instead of reverse engineering the firmware, we analyze the digital forensic artifacts available in a common PLC, Allen-Bradley ControlLogix 1756-L61. Before diving into the memory dump, we analyze the PLC control software to create a list of important artifacts that are sure to exist in the PLC memory dump. The approach employs a setup where PLC control software RSLogix-5000 is connected to the PLC, and the memory dump can be obtained as and when needed. We create test cases that sequentially highlight each category of artifacts, followed by an examination of the resultant impact on memory. After attaining the listed artifacts, we employ conventional string and known data searches to extract interesting information present in this PLC's memory. The memory analysis profile, presented as a Python library and shared with the community, can help a forensic investigator to readily extract forensic artifacts from the same model's controller. The adopted approach may help researchers in creating memory profile of other PLCs, and ultimately formulating a generic PLC memory analysis framework.

Rais, Muhammad Haris↗
DOE OSTI2021

Attacking the IEC-61131 Logic Engine in Programmable Logic Controllers in Industrial Control Systems

In industrial control systems (ICS), programmable logic controllers (PLCs) directly monitor and control a physical process such as nuclear power plants, gas pipelines, and water treatment. They are equipped with a control logic written in IEC-61131 languages (e.g., ladder logic and structured text) that defines how a PLC should control a physical process. A PLC's control logic is a usual target of a cyberattack to sabotage a physical process. For instance, Stuxnet targets a control logic of a Siemens S7-300 PLC to damage a nuclear facility's centrifuges. The existing attacks in the literature generally focus only on injecting malicious control logic into a PLC. This paper presents a new dimension of control logic attacks that target the control logic engine (responsible for running a control logic) of a PLC. It demonstrates that a cyberattack can disable the control logic engine successfully by exploiting inherent PLC features such as program mode and starting/stopping engine. We develop two novel case studies on control logic engine attacks by employing the MITRE ATT\&CK knowledge base on the real-world PLCs used in industry settings, i.e., 1) Schweitzer Engineering Laboratory (SEL)'s Real-Time Automation Controller (SEL-3505 RTAC) equipped with security features such as encrypted traffic and device-level access control, and 2) traditional PLCs, i.e., Schneider Electric's Modicon M221, Allen-Bradley's MicroLogix 1400 and 1100 that do not have security features. The case studies present the internals of the logic engine attacks and facilitate the ICS research community and industry to understand the attack vectors on the control logic engine. We evaluate the effectiveness of the control engine attacks on a power substation, a 4-floor elevator, and a conveyor belt to demonstrate their real-world impact of halting a physical process.

Ali qasim, Syed↗
DOE OSTI2025

Automated Programmable Logic Controller Memory Forensics Using RGB Image Analysis and Deep Learning

The introduction of Industry 4.0 and Internet-based technologies has enhanced industrial control system operations but have inadvertently increased their vulnerabilities to cyber attacks. When an industrial control system is compromised, security analysts need to identify the root cause quickly to start the recovery process and develop mitigation strategies. Memory forensics is critical in the incident analysis process to ascertain what occurred. Approaches for analyzing the persistent memory in industrial control devices are limited and almost nonexistent for volatile memory. This chapter proposes an automated methodology for programmable logic controller memory dump analysis using computer vision and deep learning techniques. The methodology converts the sequences of bytes in a programmable logic controller memory dump to red-green-blue pixels and employs a deep learning model that learns the underlying patterns and features of pre-labeled forensic artifacts in images and segments them into distinct regions. The trained model is employed to automatically segment new memory images and identify forensic artifacts. Evaluation of the methodology on a Schneider Electric Modicon M221 programmable logic controller under code injection and code modification attacks demonstrates its ability to detect attack artifacts in memory dumps.

Asmar Awad, Rima [ORNL] (ORCID:0000000233407742)↗
DOE OSTI2021

Pressurizer dynamic model and emulated programmable logic controllers for nuclear power plants cybersecurity investigations

This work demonstrates the functionality of the pressurizer using a fast-running three regions, non-equilibrium model and control programs of emulated PLCs. The state variables from an integrated model of primary loop in a representative PWR plant are communicated to the pressurizer’s emulated PLCs using a synchronized data transfer function. In turn, the PLCs communicate back instructions to the pressurizer model to adjust the pressure and water level to remain within preprogramed setpoints. Pressurizer model simultaneously solves the coupled mass and energy conservation equations in the saturated vapor and saturated and subcooled liquid regions using fixed step solver. Results demonstrate the response of the pressurizer model linked to an emulated pressure and water level PLCs in a simulated transient involving surge-in and surge-out events. The 50 ms response delay time for the emulated PLC insignificantly affects operation and predictions of the pressurizer model.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2021

JTAG-based PLC memory acquisition framework for industrial control systems

In industrial control systems (ICS), programmable logic controllers (PLC) are the embedded devices that directly control and monitor critical industrial infrastructure processes such as nuclear plants and power grid stations. Cyberattacks often target PLCs to sabotage a physical process. A memory forensic analysis of a suspect PLC can answer questions about an attack, including compromised firmware and manipulation of PLC control logic code and I/O devices. Given physical access to a PLC, collecting forensic information from the PLC memory at the hardware-level is risky and challenging. It may cause the PLC to crash or hang since PLCs have proprietary, legacy hardware with heterogeneous architecture. This paper addresses this research problem and proposes a novel JTAG (Joint Test Action Group)-based framework, Kyros, for reliable PLC memory acquisition. Kyros systematically creates a JTAG profile of a PLC through hardware assessment, JTAG pins identification, memory map creation, and optimizing acquisition parameters. It also facilitates the community of interest (such as ICS owners, operators, and vendors) to develop the JTAG profiles of PLCs. Further, we present a case study of Kyros implementation over Allen-Bradley 1756-A10/B to help understand the framework's application on a real-world PLC used in industry settings. The sample PLC memory dumps are shared with the research community to facilitate further research.

Rais, Muhammad Haris↗
DOE OSTI2019

LCLS-II Cryomodule and Cryogenic Distribution Control

The new superconducting Linear Coherent Light Source (LCLS-II) at the SLAC National Accelerator Laboratory will be an upgrade to LCLS, the world’s first hard X-ray free-electron laser. LCLS-II is in an advanced stage of construction with equipment for both Cryoplants as well as more than half of the 37 cryomodules onsite. Jefferson Lab (JLab) is a partner lab responsible for building half of the LCLS-II cryomodules. Hence the Low Energy Recirculation Facility (LERF) at JLab was used to stage and test LCLS-II cryomodules before shipping them to SLAC. LERF was set up to test two cryomodules at a time. LERF used LCLS-II cryogenic controls instrumentation racks, Programmable Logic Controllers (PLC) controls and Experimental Physics and Industrial Control System (EPICS) Input/Output Controllers (IOCs) with the intention to use the LERF setup to check-out and verify cryogenic controls for LCLS-II. The cryogenic controls first utilized at LERF would then be replicated for controlling all 37 cryomodules via an EPICS user interface. This paper discusses the cryogenic controls currently developed for implementation in the LCLS-II project.

43 PARTICLE ACCELERATORS↗
DOE OSTI2024

Calibration of the analog beam-signal hardware for the credited engineered beam power limit system at the Proton Power Upgrade Project at the Spallation Neutron Source

A programmable signal processor-based credited safety control that calculates pulsed beam power based on beam kinetic energy and charge was designed as part of the Proton Power Upgrade (PPU) project at the Spallation Neutron Source (SNS). The system must reliably shut off the beam if the average power exceeds 2.145 MW averaging over 60 seconds. System calibration requires pedigree in measurements, calibration setup, and calculations. This paper discusses the calibration of the analog beam signal components up to and including the Analog Digital Convertors (ADCs) for implementation into the Safety Programmable Logic Controllers (PLCs) and Field Programmable Gate Arrays (FPGAs).

Bobrek, Miljko↗
DOE OSTI2020

Edge Deployed Cyber Security Hardware Architecture for Energy Delivery Systems

At a time of accelerated cyber conflict, an “edge deployed” system will supply sensor based cyber ground truth to live grid models, and under secure command, take complete control of suspected rogue programmable logic controllers (PLCs) to maintain bulk power delivery to chosen critical sites. This hardware solution is purpose built to be agnostic to PLC vendor or protocol with the realization that a widely deployed solution must function with existing devices for rapid adoption by industry. An overview of the situation and how this developed system functions is provided.

42 ENGINEERING↗
DOE OSTI2023

Strengthening Cybersecurity for Industrial Control Systems: Innovations in Protecting PLC-Based Infrastructure

In this paper, we propose two new approaches aimed at enhancing the security of industrial control systems (ICS) that utilize programmable logic controllers (PLCs) for the control of critical processes. The first approach involves the addition of a unique digital watermark to the PWM control that adjusts the motor speed to control the critical process. This enables efficient detection and identification of any unauthorized modifications to the sensor signals responsible for controlling the plant. The second approach focuses on monitoring the input current (i.e power) drawn by the PLC during the execution of critical process control tasks. Malicious intrusions to change the PLC parameters and/or unauthorized firmware updates can be rapidly detected. Both approaches demonstrate a substantial improvement in the security of ICS, effectively safeguarding against potential cyber-attacks. Experimental results from a laboratory scale water tank level controlled via PLC showcases rapid intrusion detection capabilities.

Huang, Peng-Hao↗
DOE OSTI2021

Automated Cyber Security Testing Platform for Industrial Control Systems

Nuclear Power Plants (NPPs) are a complex system of coupled physics controlled by a network of Programmable Logic Controllers (PLCs). These PLCs communicate process data across the network to coordinate control actions with each other and inform the operators of process variables and control decisions. Networking the PLCs allows more effective process control and provides the operator more information which results in more efficient plant operation. This interconnectivity creates new security issues, as operators have more access to the plant controls, so will bad actors. As plant networks become more digitized and encompass more sophisticated controllers, the network surface exposed to cyber interference grows. Understanding the dynamics of these coupled systems of physics, control logic, and network communications is critical to their protection. The research into the cybersecurity of the Operational Technologies of NPPs is developing and requires a platform that can allow high fidelity physics simulations to interact with digital networks of controllers. This will require three main components: a network simulation environment, a physics simulator, and virtual PLCs (vPLC) that represent typical industry hardware. A platform that incorporates these three components to provide the most accurate representation of actual NPP networks and controllers is developed in this paper.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2024

Primary Pump Motor Area - Transfer Fan Replacement PLC Design

My poster is about a project that I have worked on in my time at ATR as an intern. The Heating and Ventilation Control Panel (HVB-1) controls thirty-five heating and ventilation fans within the Advanced Test Reactor. This control panel needs replacement, as many of the components inside the existing panel are becoming old and degrading. In preparation for this replacement effort, concepts and component identification for the new control panel needed to be developed. Instead of replacing the new panel with replacement mechanical components, a Programmable Logic Controller (PLC) is proposed as a solution. Although multiple fans are associated with this panel, my poster focuses on the replacement design for the Primary Pump Motor Area Transfer Fan. This will provide an example of how the entire cabinet may be upgraded.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2022

Port Impedance Measurement and Current Injection Response Analysis for PLCs

Programmable Logic Controllers (PLCs) are used to control devices throughout the power system since they have fast control capabilities and can utilize multiple types of communication interfaces. Therefore, studying and mitigating their vulnerabilities to electromagnetic pulse is important for the reliability of PLC operations. Here, in this paper, an effective impedance measurement scheme is proposed and demonstrated for three PLCs to estimate their susceptibility to an electromagnetic pulse. The equivalent non-uniform transmission line model is established to eliminate the impact of the fixture in the de-embedding process. Then different parameters of the impedance measurement setup are explored. Based on the measured impedance, the equivalent circuit is established to calculate the response of the device when subjected to the electromagnetic pulse. The voltage and current responses of different interfaces are compared utilizing the developed pulsed Current Injection (CI) method. Finally, the impedance measurement scheme is verified through testing using three measuring instruments. And the CI simulation experiments reveal the characteristics and susceptibilities of different PLCs interfaces, indicating that some protection measures are required for the reliable operation of the PLC.

42 ENGINEERING↗
DOE OSTI2026

Modeling and Power-Hardware-in-the-Loop Validation of Synchronous Machine Governor

This paper introduces the development of a high-fidelity gas turbine governor model using a programmable logic controller for power-hardware-in-the-loop (PHIL) validation. The governor model is integrated with the National Renewable Energy Laboratory's (NREL) PHIL test bed, featuring a 2-MVA synchronous machine and a 2.5-MW variable-speed drive, to emulate NG-driven HRSGs and CTs under various operational scenarios. The primary objective of this research is to study the grid-connected and islanding operations of conventional generation sources, with representative startup sequences including turbine purge, ignition, speed ramp-up, synchronization, and breaker closure. Preliminary results of the generator governor model on NREL PHIL platform, particularly using the 2.5-MW dynamometer system, offered significant insights into the modeling techniques, hardware integration, scaling, and real-world simulation dynamics.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Synchronous Machine Governor Upgrade

Conventional generation sources play a critical role in the stability and reliability of the electrical grid, particularly as we transition towards more renewable energy sources. To understand and accurately emulate their behavior for optimizing grid operations and ensuring seamless integration with renewable technologies, it is essential to better emulate the grid- and plant-level impacts of conventional generation sources, such as natural gas (NG) driven heat recovery steam generators (HRSGs) and combustion turbines (CTs). Therefore, a governor model is developed in a programmable logic controller (PLC) to investigate the performance of the conventional generator under various dynamic operating conditions and to identify the impact on grid stability in a controlled environment. The governor model aims to enable the hardware-in-the-loop (HIL) based emulation of these conventional generation sources using the existing 2 MVA synchronous machine/generator that is driven by a flexible 2.5 MW variable speed drive. This setup will allow us to replicate the dynamic characteristics and response behaviors of NG-driven HRSGs and CTs. The controls for the emulated conventional plants follow the industry standard and are adjustable, ensuring they accurately reflect the operational capabilities and limitations of real-world systems. These controls include load-following capabilities, ramp rates, startup and shutdown sequences, and emissions characteristics. By incorporating these adjustable controls, we aim to capture the nuanced impacts of conventional generation, such as their ability to provide ancillary services like frequency regulation, voltage support, and spinning reserve. In this report, we simulate two types of dynamic operations: grid-connected and islanding. For each dynamic operation, representative starting sequences are tested, including turbine purge, ignition, speed ramping up, generator excitation and synchronizing, and breaker close. The HIL based tests provides insights for field deployment, specifically the high-fidelity governor model provides results to predict the potential stability and reliability risk and suggest possible integration measures (e.g., generation and load balancing, tuning of governor control parameters). Ultimately, this enhanced emulation capability will be integrated into our Advanced Research on Integrated Energy Systems (ARIES), enabling us to conduct comprehensive studies on the interactions between conventional and renewable energy sources. By better understanding these interactions, we can develop strategies to optimize the overall performance and reliability of the grid. This will support the deployment of advanced grid management techniques, such as demand response, grid-forming inverters, and energy storage systems. The main contributions are summarized as follows: (1) This report introduces a PLC-based governor model for gas turbines. This model accurately simulates the dynamic behavior of conventional generation sources under various operational scenarios; (2) The model is integrated with an HIL testbed that includes a 2.5 MW variable speed drive and a 2 MVA synchronous machine. This setup enables realistic, real-time emulation of conventional power plants, particularly NG driven HRSGs and CTs; (3) The developed model is adaptable to various gas turbine configurations and allows for precise control over parameters such as MW ramp rates. This flexibility makes it a valuable tool for future research and industry collaboration; and (4) By incorporating the model into the National Renewable Energy Laboratory's Advanced Research on Integrated Energy Systems, the report lays the groundwork for future studies on interactions between conventional and renewable energy sources, enhancing the ability to develop advanced grid management strategies.

24 POWER TRANSMISSION AND DISTRIBUTION↗