Programmable Logic Controller Code Research Articles

Obfuscation strategies for industrial control systems

Recently released scan data on Shodan reveals that thousands of Industrial Control Systems (ICSs) worldwide are directly accessible via the Internet and, thus, exposed to cyber-attacks aiming at financial gain, espionage, or disruption and/or sabotage. Executing sophisticated cyber–physical attacks aiming to manipulate industrial functionalities requires a deep understanding of the underlying physical process at the core of the target ICS, for instance, through unauthorized access to memory registers of Programmable Logic Controllers (PLCs). However, to date, countermeasures aiming at hindering the comprehension of physical processes remain largely unexplored.In this work, we investigate the use of obfuscation strategies to complicate process comprehension of ICSs while preserving their runtime evolution. To this end, we propose a framework to design and evaluate obfuscation strategies for PLCs, involving PLC memory registers, PLC code (user program), and the introduction of extra (spurious) physical processes. Our framework categorizes obfuscation strategies based on two dimensions: the type of (spurious) registers employed in the obfuscation strategy and the dependence on the (genuine) physical process. To evaluate the efficacy of proposed obfuscation strategies, we introduce evaluation metrics to assess their potency and resilience, in terms of system invariants the attacker can derive, and their cost in terms of computational overhead due to runtime modifications of spurious PLC registers. We developed a prototype tool to automatize the devised obfuscation strategies and applied them to a non-trivial use case in the field of water tank systems. Our results show that code obfuscation can be effectively used to counter malicious process comprehension of ICSs achieved via scanning of PLC memory registers. To our knowledge, this is the first work using obfuscation as a technique to protect ICSs from such threats. The efficacy of the proposed obfuscation strategies predominantly depends on the intrinsic complexity of the interplay introduced between genuine and spurious registers.

PLC orchestration automation to enhance human–machine integration in adaptive manufacturing systems

Current approaches to manufacturing must evolve to respond to increasing demands for short product life cycles and customised products. Adaptive manufacturing systems integrate advanced technologies, automation, and data-driven methodologies to develop adaptable, efficient, and responsive production processes. Central to this concept is the emphasis on human involvement and fostering synergy between human operators and the manufacturing system. Significant changes to the system’s controller are required to achieve adaptivity, with programmable logic controllers (PLCs) being a common controller type. After the necessary changes to the configuration of the manufacturing system, the PLC should be reconfigured to orchestrate the new required behaviour. Automated reconfiguration is vital to rapidly responding to change, but some changes cannot be entirely achieved without human input in collaboration with automated methods. Conventional practices in PLC programming include manual, repetitive coding practices subject to errors. As a result, to ensure operational safety, the changes must be tested before being deployed to operations, ensuring it is error-free. This paper presents a methodology to automatically reconfigure the simulation environment and controller in response to a new product request. We automate the PLC code generation and testing practices to support and free up the operators when performing repetitive manufacturing reconfiguration tasks. The methodology is based on human learning, software automation, customised program development, knowledge graphs, and Graph Neural Networks (GNNs). The presented solution is a generic, vendor-agnostic, and interoperable solution that facilitates information exchange among multiple heterogeneous environments. Lastly, we have validated the methodology as a proof of concept at an adaptive assembly cell at the University of Nottingham in the United Kingdom.

Fresh Approaches for Structured Text Programmable Logic Controllers Programs Verification

Programmable logic controllers (PLCs) are everywhere today and perform critical tasks in industries. They are considered as a key component for the Industry 4.0. Before they are put into operation, it is necessary to check the accuracy of the PLC programs. This verification operation can be performed using model checkers. This stage is often long and costly and requires a domain expert who can understand the system, as well as the different model checker tools able to verify the code implemented in the controller. Furthermore, this verification often requires a conversion of the PLC code into a language understood by a model checker which can influence the behavior of the observed PLC. Hence, there is a need to propose methods and tools which could be used by technicians and engineers. The aim of this paper is to propose methods that require little work to set up and are robust to program sizes used in Industry 4.0. This paper explores some fresh ideas for human-adapted PLC code verification. We present different methods to test codes in structured text (ST) compliant with the IEC 61131-3 standard. Hence, the first idea is to test the ST code that will be directly implemented on a controller. For that, we propose a method using the model checker UPPAAL which allows us to obtain exact results on short codes. Second, we propose verifying the generic properties that a PLC program must avoid: deadlocks, non-accessible states and fugitive states or actions. To solve combinatory explosion problems encountered with the UPPAAL software, the third proposition consists of using relational databases. The same verification as previously followed can be obtained, but the search time is longer. The fourth and last proposal is to process the ST code with a neural network composed of long short-term memory layers (LSTM) to quickly determine the validity of the code. This method could give an approximation of code errors in a few seconds. The different proposed methods are supported with several examples.

A Model-Based Approach to Automated Validation and Generation of PLC Code for Manufacturing Equipment in Regulated Environments

Validation is a critical stage of the equipment design process as it provides documentary evidence that the equipment is performing as per specification and ensures consistent product quality is maintained at all times. The advent of Industry 4.0 has led to a requirement for reconfigurable manufacturing systems as manufacturers adapt to an increased customer demand for personalised products. As equipment control software becomes increasingly complex to accommodate these requirements, a new approach to equipment validation is required. This paper presents a methodology for the design and validation of equipment in regulated manufacturing environments, using a model-based design platform (MathWorks® Simulink®) to model and digitally validate the Programmable Logic Controller (PLC) code required to control manufacturing equipment. A workflow is presented detailing the steps required to implement this approach and a demonstration model was developed as a proof of concept. Validation documentation and PLC code are automatically generated based on the system model and the functionality of the generated PLC code was successfully verified on a physical demonstrator, proving the feasibility of the proposed approach. Adoption of the approach outlined in this work would enable manufacturers in regulated industries, such as medical devices and pharmaceutical products, to rapidly design, build, reconfigure and revalidate manufacturing equipment as required to accommodate an increased demand for customised products.

A refinement development approach for enhancing the safety of PLC programs with Event-B

Programmable Logic Controllers (PLC) are widely used in Industrial Control Systems (ICS) with strict safety assurance requirements. Unfortunately, traditional techniques for debugging prefer to use post-development approaches, such as simulation and black-box testing, rather than enhancing safety before programing. In this paper, we propose a refinement-based approach to model and verify PLC systems, aiming to assure safety properties by construction. It uses the Event-B formalism and focuses on the levels of requirement analysis, specification refinement, and system development. This approach takes a three-layer framework stepwise to specify the behaviors and properties of PLC programs, thereby reducing the modeling complexity. The basic firmware layer models the general mechanisms of PLC firmware, such as periodical instruction execution and centralized I/O scanning, which are application-independent models with fundamental safety properties at an abstract level. The middle layer establishes configuration models. These models correspond to the PLC settings and interactive environments of a specific system, such as I/O addresses and peripheral devices. The business layer models business logic with more specific system-level safety requirements. With our approach, the safety properties of PLC systems can be verified throughout the modeling and refinement process. In addition, rules are proposed to convert the most concrete Event-B model into PLC code satisfying the IEC 61131-3 standard. We demonstrate this approach with a real-world running example of a pump control system for gas transmission. • A refinement-based approach for modeling PLC systems using Event-B. • Defining PLC features are modeled with a 3-layer framework. • It decomposes the complexity of modeling and verification by stepwise refinement. • The safety requirements of PLC systems can be verified during the development. • It generates PLC program code compatible with IEC 61131-3 standard from the model.

Advanced Control With PLC—Code Generator for aMPC Controller Implementation and Cooperation With External Computational Server for Dealing With Multidimensionality, Constraints and LMI Based Robustness

The manufacturers of Programmable Logic Controllers (PLC) usually equip their products with extremely simple control algorithms, such as PID and on-off regulators. However, modern PLCs have much more efficient processors and extensive memory, which enables implementing more sophisticated controllers. The paper discusses issues related to the implementation of matrix operations, time limitations for code execution within one PLC cycle, and memory requirements. The adaptive Model Predictive Controller (aMPC) algorithm is selected for predictive control with on-line adaptation of model parameters. The combination of predictive and adaptive properties in the regulator enables control of many industrial objects for which PID control is ineffective, e.g. nonstationary plants with time-varying delays. The presented generic approach consists in developing a C++ application for desktop PC that generates, based on user provided parameters - such as MPC horizons, the code in Structured Text (ST) language compliant with the IEC-61131 standard for PLCs. Despite the enhanced capabilities of programmable controllers, there are limitations to this platform that cannot be overcome. The implementation of optimization-based control algorithms requires cooperation with an external computing server. In the article, the PLC/external computer cooperation is used to implement the control with constraints taken into account. The robust control using the Linear Matrix Inequalities (LMI) for a multivariable plant is also presented. A number of tests were carried out to verify the correctness of implementation of this control in software-in-the-loop and hardware-in-the-loop structures.

A Service-Based Production Ecosystem Architecture for Industrie 4.0

Changeability is one major goal of Industrie 4.0. Existing production architectures limit changeability, because programmable logic controllers (PLC) that are responsible for the execution of real-time production steps also define the order of production steps that are executed for every product. PLC programming therefore implicitly defines the production process. Consequently, any change of a production process requires changes in PLC code, causes potential side effects due to unknown controller dependencies, and requires extensive testing. We propose a service-based architecture approach that encapsulates production steps into re-useable services. Production cells invoke services, and comparable to multi-agent systems autonomously decide about optimal service invocations based on shared information. In this article, we outline our service-based architecture concept and describe a use-case that illustrates the decentral organization of production systems and the cooperative optimization of production steps.

Generating Correct, Compact, and Efficient PLC Code from Scenario-based Assume-Guarantee Specifications

Cyber-physical systems can be found in many areas, e.g., manufacturing, health care or smart cities. They consist of many distributed components cooperating to provide increasingly complex functionality. The design and development of such a system is difficult and error-prone. To help engineers overcome these challenges we created a formal, scenario-based specification language. Short scenarios, i.e., event sequences, specify requirements and the desired behaviors by describing how components may, must, or must not behave. Scenarios provide an intuitive way for creating formal assume-guarantee (GR(1)) specifications, giving engineers easy access to simulation, for validating the specified behavior, and controller synthesis, for creating controller software which is correct by construction. In this paper we present an approach for generating Programmable Logic Controller (PLC) code from a scenario-based specification. Previous code generation efforts, including our own, created large, verbose source files causing some tools, e.g., compilers or editors, to perform slowly or even become unresponsive. Our new approach creates compact files, shifting significant amounts of code from executable instructions to data, to reduce the burden on the compiler and other tools. The generated code is efficient and introduces minimal to no latency between the occurrence of an event and the system’s reaction to it.

Intrusion Detection in PLC-Based Industrial Control Systems Using Formal Verification Approach in Conjunction with Graphs

Vulnerability in industrial control systems (ICS) has increased radically in the past few decades. This can be accounted to reasons including accessibility of ICS through Internet, development of sophisticated attack methods, and advancement in Internet of Things (IoT). The damage that can be caused by attackers on insecure ICS could cost hundreds of human lives and a huge state economy. Therefore, having such systems every where around us makes the concern for security nothing but a priority. Programmable logic controllers (PLCs) are the central devices of ICS and also a target to attacks which aim at gaining access and privilege to the control logic of the controller. A successful alteration or intrusion of the control logic by attackers can have a catastrophic effect on the plant. In this paper, control logic intrusion detection methodology for PLC-based control systems is proposed. The methodology implements the detection process by comparing a potentially intruded PLC program with a trusted version of the program. In order to achieve this goal, a scheme is proposed that operates in sequence of stages by first translating the PLC program to formal models (based on previous research work), then translating the formal models to graphs followed by performing a comparison between a trusted system model graph and a potentially intruded system graph. In the last stage of the methodology, graph discrepancy analysis is made in order to identify any intrusions. For demonstration purposes, a water level control system is presented as a case study, which is modeled using UPPAAL toolbox. We have verified our methodology by developing an in-house software. Our test results prove the concept that intrusions can be shown as discrepancies in the graphs generated from the UPPAAL-based formal modeling, which can be detected utilizing the proposed graph comparison approach. The premise of our study is that logic intrusions in PLC based ICS can be identified by the changes in the PLC code, and the methodology we proposed can successfully detect those changes by observing the code’s graph model.

Virtual Commissioning with Process Simulation (Tecnomatix)

ABSTRACTIn this paper a virtual environment in Tecnomatix, which is the exact reproduction of a manufacturing cell was built. The virtual cell interacts with a Programmable Logic Controller (PLC) Siemens S7-300 which enables the operator to build and validate a PLC code inside the virtual model. This prevents any possible mistakes from occurring when the PLC code is implemented in the actual work cell. This manufacturing reproduction took place in Instituto Tecnologico y de Estudios Superiores de Monterrey, Campus Estado de Mexico where the authors work. The first step in the design was to obtain the measurements of the components which are then designed in the NX software. Once the components are designed, the next step is to export them to a Tecnomatix software called Process Simulate. In one module of Process Simulate named Advanced Simulation it is possible to develop the 3D virtual environment and then introduce control information into that simulation environment. The platform built lets us test our...

Bringing Automated Model Checking to PLC Program Development — A CERN Case Study —

Verification of critical software is a high priority but a challenging task for industrial control systems. Model checking appears to be an appropriate approach for this purpose. However, this technique is not widely used in industry yet, due to some obstacles. The main obstacles encountered when trying to apply formal verification techniques at industrial installations are the difficulty of creating models out of PLC programs and defining formally the specification requirements. In addition, models produced out of real-life programs have a huge state space, thus preventing the verification due to performance issues. Our work at CERN (European Organization for Nuclear Research) focuses on developing efficient automatic verification methods for industrial critical installations based on PLC (Programmable Logic Controller) control systems.In this paper, we present a tool generating automatically formal models out of PLC code. The tool implements a general methodology which can support several input languages, like the PLC programming languages defined in the IEC 61131 standard, as well as the model formalisms of different model checker tools. The tool supports the three main stages of model checking: system modelization, requirement formalization and counterexample analysis. In addition, a verification case study of a PLC program, written in Structured Text (ST) language implemented at CERN is described. The paper shows that the verification process is automatized and supported by the proposed tool, thus its difficulty is completely hidden for the control engineer.

Efficient Handling of States in Abstract Interpretation of Industrial Programmable Logic Controller Code

This paper presents an efficient static analysis for programmable logic controller code. For each program line (or each function block call), the analysis calculates an over-approximation of the possible values each variable can assume during all possible executions. This information can then be used to automatically check for certain critical program conditions such as division-by-zero and array-out-of-bounds. To make this approach applicable to large programs comprising many variables, we present a technique that only stores the values of a subset of the variables based on their context and liveness. We show how to detect typical problems in real PLC code.

Developing control logic using aspect-oriented programming and sequence planning

A fundamental functionality of a Programmable Logic Controller (PLC) is to control and execute a set of operations. But a large part of the program code is more involved in supporting the user with concerns like alarm, HMI, communication, safety and manual control. Code related to these supporting concerns is often tangled with operation execution code, the core concerns, which makes it hard to reuse.This paper describes a method to reuse code and functionality when developing PLC programs and code libraries. The method proposes that core concerns are planned with a software tool called Sequence Planner, and the supporting concerns are integrated into the core concerns with a tool based on aspect-oriented programming.

Methods for Reliable Simulation-Based PLC Code Verification

Simulation-based programmable logic controller (PLC) code verification is a part of virtual commissioning, where the control code is verified against a virtual prototype of an application. With today's general OPC interface, it is easy to connect a PLC to a simulation tool for, e.g., verification purposes. However, there are some problems with this approach that can lead to an unreliable verification result. In this paper, four major problems with the OPC interface are described, and two possible solutions to the problems are presented: a general IEC 61131-3-based software solution, and a new OPC standard solution.

Formal modeling and synthesis of programmable logic controllers

Programmable logic controllers (PLCs) are complex cyber-physical systems which are widely used in industry. This paper presents a robust approach to design and implement PLC-based embedded systems. Timed automata are used to model the controller and its environment. We validate the design model with resort to model checking techniques. We propose an algorithm to generate PLC code from timed automata and implement this algorithm with a prototype tool. This method can condense the developing process and guarantee the correctness of PLC programs. A case study demonstrates the effectiveness of the method.

Auto-generation of IEC standard PLC code using t-MPSG

The objective of this paper is to reduce the development time of a PLC (Programmable Logic Controller) by automating the task of code generation. For this purpose, we applied t-MPSG (Timed-Message Based Part State Graph). The t-MPSG is an extended finite state automata used to model and generate an execution module for a real-time shop floor controller system. In our proposed method, t-MPSG is used to model the formal specification of the controller system that can be translated into textual structure. After the verification of the t-MPSG model, it can be used as an input to the plc-builder tool. The plc-builder tool is an extended version of a conventional MPSG simulator. It can be used to translate the textual structure of the t-MPSG into an IEC standard PLC code. Finally, the generated code can be downloaded to a PLC emulator or a PLC device for the purpose of simulation and execution. The similarity in the hierarchical structure of the t-MPSG and the IEC standard PLC program has made it convenient to transform from one form to another. Furthermore, an illustration of the methodology to auto-generate IEC standard PLC code using t-MPSG is explained with a suitable example.

Software safety analysis of function block diagrams using fault trees

As programmable logic controllers (PLCs) are often used to implement safety–critical embedded software, safety demonstration of PLC code is needed. In this paper, we propose a fault tree analysis technique on Function Block Diagrams (FBDs) which is one of the most widely used PLC programming languages. FBD is currently being used to develop Reactor Protection System (RPS) for a nuclear power plant in South Korea. Our approach to fault tree analysis, which combines fault-oriented and cause/effect-oriented viewpoints, is easy to understand and offers systematic guidelines to ensure safety of PLC code. Domain experts found the approach to be useful through a case study on RPS, and this paper compares completeness and comprehensiveness of the semi-automatically generated fault trees using the proposed approach against the one manually prepared by nuclear safety engineers.

Synthesis of FBD-based PLC design from NuSCR formal specification

NuSCR is a formal specification language to document requirements for real-time embedded software with nuclear engineering applications in mind. Domain experts actively participated in selecting how to best represent various aspects. It uses tabular notations to specify required computations and automata to document state- or time-dependent behavior. As programmable logic controllers (PLCs) are widely used to implement real-time embedded software, synthesis of PLC code from a formal specification is desirable if transformation rules can be rigorously defined. In addition to improved productivity, results of safety analysis performed on requirements remain valid. In this paper, we demonstrate how NuSCR specification can be translated into semantically equivalent function block diagram (FBD) code. The process, except the initial phase where user provides information on missing or implicit details, is automated. Since executable code can be automatically generated using CASE tools from FBD, much of software development is automated. Proposed technique is currently being used in developing reactor protection system (RPS) for nuclear power plants in Korea, and experience to date has been positive. We demonstrate the proposed approach using the fixed set-point rising trip which is one of the most complex trip logics included in the RPS.

Translation and Optimization in the Verification of Real-Time Systems

Compilation or translation is not only an issue at the level of program but also at the level of specification. This talk considers the design of real-time software for Programmable Logic Controllers (PLCs) and discusses questions of correctness and optimization for translations between different semantic models. The need for such translations arises in order to bridge the gap between conceptually clear models on the one hand and computationally feasible models on the other hand.To exemplify this, the talk considers so-called Constraint Diagrams as formalizations of behavioural requirements and so-called PLC-Automata as design specifications. Both Constraint Diagrams and PLC-Automata are given a formal semantics in the Duration Calculus, a logic for real-time systems. To enable an automatic verification (model-checking) of designs against requirements, translations of Constraint Diagrams and PLC-Automata into Timed Automata are presented. Semantic correctness and optimization of these translations are discussed.The concepts presented in the talk are implemented in a tool called Moby-RT that besides the above verification facilities also offers a compiler for PLC code generation.

Specification, design, and implementation of logic controllers based on colored Petri net models and the standard IEC 1131. II. Design and implementation

This work aims at designing and implementing logic control structures that allow a combination of the advantages of classical techniques for the development of programmable logic controller code and elimination of disadvantages such as the lack of formal validation. This paper introduces a method to automatically generate code for a programmable logic controller from a validated textual description of this kind of Petri nets. A special compiler that generates code according to the standard IEC 1131 is discussed. The modeling and implementation of a logic control system for flexible assembly cell using the method describe serves as an example.