Programmable Logic Controller Network Research Articles

SIHQR model with time delay for worm spread analysis in IIoT-enabled PLC network

Industrial Internet of Things (IIoT) is a product of deep integration between Internet of Things (IoT) and industrial control networks. As an important component of IIoT, Programmable Logic Controller (PLC) has become a springboard for many hackers to disrupt industrial networks by spreading viruses. It is known that worm can cause enormous loss. Therefore, revealing the rules of worm spread in PLC networks and exploring methods to inhibit worm spread are increasingly important. To this end, we propose a new worm spread model named SIHQR with time delay. Additionally, we establish a game model between susceptible and infected nodes in order to express the infection rate by several game parameters. Through analysis, we discuss the conditions for the emergence of three scenarios: disease-free equilibrium, endemic equilibrium and Hopf bifurcation. We study the stability at the equilibrium points and obtain an expression for a threshold value which determines whether the system exhibits endemic equilibrium or Hopf bifurcation. In the experimental section, we analyze the impact of initial values of node states and the magnitude of game parameters on worm spread in the three aforementioned scenarios. Finally, we propose a method to mitigate or even eliminate the Hopf bifurcation. The experimental results show that the proposed model has welldone performance.

Armor PLC: A Platform for Cyber Security Threats Assessments for PLCs

Programmable Logic Controllers (PLCs) are essential parts in industrial manufacturing plants. With the emerging Industry 4.0 environment, legacy PLCs are now connected to the Internet to be better automated. However, these PLCs are especially vulnerable when connected to a network, since there is limited inherent security mechanisms built in. In this paper, we discuss various vulnerabilities in these PLCs. We describe threat models, detection and protection techniques. We consider vulnerabilities as compromised PLC logic, which is introduced by over-the-network malicious data injection. We leverage Host-Based Intrusion Detection System (HIDS) techniques, such as output value comparison using majority voting, timing comparison and using known I/O values for detecting such attacks for our Network-Based Intrusion Detection System for PLCs. We mimic functionalities of PLCs, through virtualization of PLCs’ ladder logic on OpenPLC [7]. We use a record & replay technique for attack mitigation and system restoration. The record & replay system captures pin values of a Pulse Width Modulated (PWM) signal with sensitivity of 50 microseconds. We implement the attacks and our proposed security solution on the control flow logic of a sample industrial gas pipeline PLC network. We achieve a false positive rate of 1% along with a latency of 25 milliseconds in our abnormal detection with setting of 4 virtual PLCs (using OpenPLC [7]), and generated receiver operating characteristic results on different attack rates and ST file logic settings.

Embedding Encryption and Machine Learning Intrusion Prevention Systems on Programmable Logic Controllers

During its nascent stages, programmable logic controllers (PLCs) were made robust to sustain tough industrial environments, but little care was taken to raise defenses against potential cyberthreats. The recent interconnectivity of legacy PLCs and supervisory control and data acquisition (SCADA) systems with corporate networks and the Internet has significantly increased the threats to critical infrastructure. To counter these threats, researchers have put their efforts in finding defense mechanisms that can protect the SCADA network and the PLCs. Encryption and intrusion prevention systems (IPSs) have been used by many organizations to protect data and the network against cyber-attacks. However, since PLC vendors do not make available information about their hardware or software, it becomes challenging for researchers to embed security mechanisms into their devices. This letter describes an alternative design using an open source PLC that was modified to encrypt all data it sends over the network, independently of the protocol used. Additionally, a machine learning-based IPS was added to the PLC network stack providing a secure mechanism against network flood attacks like denial of service (DoS). Experimental results indicated that the encryption layer and the IPS increased the security of the link between the PLC and the supervisory software, preventing interception, injection, and DoS attacks.

On PLC network security

Programmable Logic Controller (PLC) is an important component in modern Industrial Control Systems (ICS) particular in Supervisory Control and Data Acquisition (SCADA) systems. Disturbing the normal operation of PLCs can lead to significant damages ranging from minor annoyance to large scale incidents threatening the life of people. While most of existing work in the SCADA security literature focuses on the communication between PLCs and field devices, this paper presents a network security analysis of the communication between PLCs and the engineering stations in charge of setting up and configuring them. Interestingly, this aspect of SCADA security was exploited by the most famous SCADA attack, namely, Stuxnet. Using a testbed with a common PLC device, we successfully carried out three network attacks leading to serious compromise of typical PLCs.

Consumer energy management system with integration of smart meters

This paper develops an energy management system with integration of smart meters for electricity consumers in a smart grid context. The integration of two types of smart meters (SM) are developed: (i) consumer owned SM and (ii) distributor owned SM. The consumer owned SM runs over a wireless platform–ZigBee protocol and the distributor owned SM uses the wired environment–ModBus protocol. The SM are connected to a SCADA system (Supervisory Control And Data Acquisition) that supervises a network of Programmable Logic Controllers (PLC). The SCADA system/PLC network integrates different types of information coming from several technologies present in modern buildings. The developed control strategy implements a hierarchical cascade controller where inner loops are performed by local PLCs, and the outer loop is managed by a centralized SCADA system, which interacts with the entire local PLC network. In order to implement advanced controllers, a communication channel was developed to allow the communication between the SCADA system and the MATLAB software.

Application of the classical levels of intelligence to structuring the control system in an automated distribution centre

Traditional management and control models can benefit from added levels of intelligence to increase their capability to adapt to the continuous changes in global markets. After reviewing the classical definition of intelligence and its levels, this paper provides a new approach to help increase the responsiveness of management and control to changes and disturbances in the manufacturing supply chain. The ancient concept of the "Tertium Quid" has inspired a three-level community of agents (MAS-TRIO) that is proposed to improve the coordination of all actors involved. The proposed model combines Multi-Agent Systems (MAS) with Radio-Frequency Identification (RFID) to make possible a certain level of Autonomous Intelligence in the decision-taking process. This paper analyses how these levels of intelligence can be applied to management and control, and the performance of the proposed model has been tested at low and mid-levels on an experimental platform representing the facilities of a distribution centre controlled by a network of programmable logic controllers (PLCs).

Distributed Automatic Control System Supported by RFID Applied to a Logistic Centre Test Bench

With the aim of incorporating new techniques and methodologies, this article presents the use of distributed control methods based on Multi-Agent Systems (MAS) enhanced with Radio-Frequency Identification (RFID). RFID is here applied as the technological base of a new generation of automatic distributed control systems in which traceability and tracking are key characteristics. The research on this area has grown rapidly in late years. However, the lack of alignment and visibility between the management and control system has hardly been explored. This paper shows a way to face this problem, and also presents the application and analysis of the proposed control philosophies in an experimental platform, controlled by a network of programmable logic controllers (PLCs).

Energy Management in Intelligent Buildings using Predictive Control

This paper develops an operational control platform for intelligent buildings using a SCADA system (Supervisory Control And Data Acquisition). This SCADA system integrates different types of information coming from the several technologies present in modern buildings (control of ventilation, temperature, illumination, etc.). The developed control strategy implements an hierarchical cascade controller where inner loops are performed by local PLCs (Programmable Logic Controller), and the outer loop is managed by the centralized SCADA system, which interacts with the entire local PLC network. In this paper a Predictive Controller is implemented at the centralized SCADA platform. Tests applied to the control of temperature and luminosity in huge-area rooms are presented. The developed Predictive Controller tries to optimize the satisfaction of user explicit preferences coming from several distributed user-interfaces, subjected to the constraints of energy waste minimization. In order to run the Predictive Controller at the SCADA platform a communication channel was developed to allow communication between the SCADA application and the MATLAB application where the Predictive Controller runs.

Operative Platform Applied to Building Automation

Abstract: This article introduces an advanced control structure to be applied to building automation. This structure is composed by three interrelated levels: the Operational level—where the field equipment is controlled, the Inter‐Active level—where inhabitants communicate the building their preferences regarding control variables (lights, temperature, etc.), and the higher‐level control, the Overall Building Well‐Being Model, which manages the global building, taking into account the optimization of the inhabitants preferences, constrained by the available resources. At this third level, the inter‐building communication is available. Each building has the capability to communicate with its neighbors, informing about fires, floods, security problems, power consumption expectations, and so on. This article implements one of the three above‐referred interrelated control levels: the Operational‐level control. This operative platform is structured over a cascade hierarchical control architecture where inner loops are performed by local PLCs (Programmable Logic Controllers), and the outer loop is managed by a centralized SCADA system (Supervisory Control and Data Acquisition) that interacts with the entire PLC network. The lower‐level control loop assures high processing velocity tasks, the upper‐level control loop updates the local references, knowing the complete system state. This operative model is tested on two prototypes, where all instrumentation in place is controlled by the industrial PLC network. Both prototypes worked perfectly showing the huge potential of communication systems between distributed processes. These communication systems allow intelligent centralized algorithms to manage decision‐making problems in real‐time environments. The system presented in this article combines several technologies (local PLCs, SCADA systems, and network communications) to reach the goal of efficient management of intelligent buildings.

PREDICTIVE CONTROL APPLIED TO BUILDING AUTOMATION: AN EXPERIMENTAL SETUP

In this paper a control and monitoring platform for an intelligent building is developed using a SCADA system (Supervisory Control And Data Acquisition). The control strategy develops a two-level architecture where inner-loops are performed by local PLCs (Programmable Logic Controller), and the outer-loop is managed by the centralized SCADA system that interacts with the entire local PLC network. The outer loop performs an intelligent Generalized Predictive Control strategy (GPC). Tests on a prototype are shown, where all the instrumentation in place is controlled by an industrial PLC master/slave network. The master PLC is connected, in real-time acquisitions, with the SCADA system via MultiPoint Interface (MPI). The experimental work shows the potential of instrumentation, control and monitoring in the future buildings to prevent accidents and improve the quality of living.

Standardising control systems for the water industry

Mechanical and electrical systems have developed into more complex interdependencies that, by their nature, require more sophisticated control systems. Industrial computer-based processors, such as programmable logic controllers (PLCs), have been developed to perform control functions and provide the operator with visual information to allow him to operate and control the plant. The PLCs first used by United Utilities had limited functionality and display capability. Nowadays the equipment used typically comprises several networked PLCs and colour human machine interfaces (HMIs) offering both graphical and tabular displays. Connection of the telemetry outstation to the plant control and monitoring system is commonly via the PLC network. The outstation accesses data tables within the PLC memory to avoid the need for costly telemetry I/O and its associated wiring.

Programmable logic controllers find a home in wastewater treatment

Efforts to computerize wastewater treatment plants have had mixed results. A wastewater treatment plant presents significant obstacles to computer automation. One of the most challenging problems is coping with the aggressive environment of the plant. Industrially hardened programmable logic controllers (PLCs) have found a home in the wastewater treatment field. These small, reliable, and rugged computers are gaining acceptance in this conservative industry. Standard process control and data acquisition software packages are available from most PLC manufacturers for use on a supervisory personal computer workstation networked to their PLCs. In addition, similar third-party generic software packages, which support the PLCs of multiple manufacturers, can be procured. These packages provide functions such as interactive graphics, database, trending, historic storage, and report generation. Networks containing personal computers and PLCs offer an attractive alternative to the conventional large distributed computer system (DCS). A compomplex PLC network can equal a DCS in capability, while a simple PLC network can offer fast, reliable control of a single process. In each case, PLCs offer the advantage of a rugged input/output (I/O) system designed for the factory floor. Process control applications with fail-safe provisions are suitable to PLCs and can be demonstrated throughout the plant. Although they are industrially hardened, caution must be exercised in the application of PLCs. The corrosive nature of the atmosphere at a wastewater treatment plant still presents challenges. However, properly installed, PLCs maintain their reputation for reliability.

A distributed control system for the lower-hybrid current drive system on the Tokamak de Varennes

An rf current drive system with an output power of 1 MW at 3.7 GHz is under development for the Tokamak de Varennes. The control system is based on an Ethernet local-area network of programmable logic controllers as front end, personal computers as consoles, and CAMAC-based DSP processors. The DSP processors ensure the PID control of the phase and rf power of each klystron, and the fast protection of high-power rf hardware, all within a 40 μs loop. Slower control and protection, event sequencing and the run-time database are provided by the programmable logic controllers, which communicate, via the LAN, with the consoles. The latter run a commercial process-control console software. The LAN protocol respects the first four layers of the ISO/OSI 802.3 standard. Synchronization with the tokamak control system is provided by commercially available CAMAC timing modules which trigger shot-related events and reference waveform generators. A detailed description of each subsystem and a performance evaluation of the system will be presented.