Programmable Logic Controller Block Monitoring System for Memory Attack Defense in Industrial Control Systems

Cyberattacks targeting industrial control systems(ICS)are becoming more sophisticated and advanced than in the past.A programmable logic controller(PLC),a core component of ICS,controls and monitors sensors and actuators in the field.However,PLC has memory attack threats such as program injection and manipulation,which has long been a major target for attackers,and it is important to detect these attacks for ICS security.To detect PLC memory attacks,a security system is required to acquire and monitor PLC memory directly.In addition,the performance impact of the security system on the PLC makes it difficult to apply to the ICS.To address these challenges,this paper proposes a system to detect PLC memory attacks by continuously acquiring and monitoring PLC memory.The proposed system detects PLC memory attacks by acquiring the program blocks and block information directly from the same layer as the PLC and then comparing them in bytes with previous data.Experiments with Siemens S7-300 and S7-400 PLC were conducted to evaluate the PLC memory detection performance and performance impact on PLC.The experimental results demonstrate that the proposed system detects all malicious organization block(OB)injection and data block(DB)manipulation,and the increment of PLC cycle time,the impact on PLC performance,was less than 1 ms.The proposed system detects PLC memory attacks with a simpler detection method than earlier studies.Furthermore,the proposed system can be applied to ICS with a small performance impact on PLC.

NIPAD： a non-invasive power-based anomaly detection scheme for programmable logic controllers

Industrial control systems （ICSs） are widely used in critical infrastructures, making them popular targets for attacks to cause catastrophic physical damage. As one of the most critical components in ICSs, the programmable logic controller （PLC） controls the actuators directly. A PLC executing a malicious program can cause significant property loss or even casualties. The number of attacks targeted at PLCs has increased noticeably over the last few years, exposing the vulnerability of the PLC and the importance of PLC protection. Unfortunately, PLCs cannot be protected by traditional intrusion detection systems or antivirus software. Thus, an effective method for PLC protection is yet to be designed. Motivated by these concerns, we propose a non-invasive power- based anomaly detection scheme for PLCs. The basic idea is to detect malicious software execution in a PLC through analyzing its power consumption, which is measured by inserting a shunt resistor in series with the CPU in a PLC while it is executing instructions. To analyze the power measurements, we extract a discriminative feature set from the power trace, and then train a long short-term memory （LSTM） neural network with the features of normal samples to predict the next time step of a normal sample. Finally, an abnormal sample is identified through comparing the predicted sample and the actual sample. The advantages of our method are that it requires no software modification on the original system and is able to detect unknown attacks effectively. The method is evaluated on a lab testbed, and for a trojan attack whose difference from the normal program is around 0.63%, the detection accuracy reaches 99.83%.

HRPDF: A Software-Based Heterogeneous Redundant Proactive Defense Framework for Programmable Logic Controller

Programmable logic controllers(PLCs)play a critical role in many industrial control systems,yet face increasingly serious cyber threats.In this paper,we propose a novel PLC-compatible software-based defense mechanism,called Heterogeneous Redundant Proactive Defense Framework(HRPDF).We propose a heterogeneous PLC architecture in HRPDF,including multiple heterogeneous,equivalent,and synchronous runtimes,which can thwart multiple types of attacks against PLC without the need of external devices.To ensure the availability of PLC,we also design an inter-process communication algorithm that minimizes the overhead of HRPDF.We implement a prototype system of HRPDF and test it in a real-world PLC and an OpenPLC-based device,respectively.The results show that HRPDF can defend against multiple types of attacks with 10.22%additional CPU and 5.56%additional memory overhead,and about 0.6 ms additional time overhead.

Synchro Controller of Radar on FPGA

This paper mainly represents the realization of synchro controller based on the programmable logic devices FPGA by request of HF ground wave radar synchro controller under the instance of making the best of the virtues of FPGA. This design introduces the data communication between PC and synchro controller by PC Bus, which can carry the synchronous signals parameters to RAM of synchro controller, then according to the theory that the result of comparing counter value with signals parameters is the needed wave, we produce all waves HF ground wave radar needs, moreover all waves are produced time-sharing in order to save resources.

Real Time Control System for Metro Railways Using PLC & SCADA

This paper proposes to adopt SCADA and PLC technology for the improvement of the performance of real time signaling&train control systems in metro railways.The main concern of this paper is to minimize the failure in automated metro railways system operator and integrate the information coming from Operational Control Centre(OCC),traction SCADA system,traction power control,and power supply system.This work presents a simulated prototype of an automated metro train system operator that uses PLC and SCADA for the real time monitoring and control of the metro railway systems.Here,SCADA is used for the visualization of an automated process operation and then the whole opera-tion is regulated with the help of PLC.The PLC used in this process is OMRON(NX1P2-9024DT1)and OMRON’s Sysmac studio programming software is used for developing the ladder logic of PLC.The metro railways system has deployed infrastructure based on SCADA from the power supply system,and each station’s traction power control is connected to the OCC remotely which commands all of the stations and has the highest command priority.An alarm is triggered in the event of an emergency or system congestion.This proposed system overcomes the drawbacks of the current centralized automatic train control(CATC)system.This system provides prominent benefits like augmenting services which may enhance a network’s full load capacity and networkflexibility,which help in easy modification in the existing program at any time.

Design of PLC control system of RTG spreader in Qingdao Port Container Terminal

The control method of rubber tyre gantry （RTG） spreader in Qingdao Port Container Terminal is logic board control,which has many shortcomings such as expensive spare parts and high faults.This paper designs a new control system using programmable logic controller （PLC） centralized control to replace the original logic board control.The new system mainly contains complete ELME spreader control scheme design,hardware selection and PLC control program development.Its field application shows that the system has characteristics of high efficiency,low running cost,easy maintenance.

Measurement and control system for servo pressure pulse testing equipment

Servo pressure pulse testing equipment uses servo-hydraulic technology to build the model of hydraulic system. By improving measurement and control system, the equipment accomplishes signal acquisition, data processing and process con- trol. LabVIEW and programmable logic controller （PLC） are used to carry out the hardware configuration and software de- velopment. The system can communicate between LabVIEW and PLC by virtual instrumentation software architecture （VI- SA） and run automatically in accordance with setting commands. Therefore, accuracy and performance of the equipment are improved.

Research on rapid development platform of PLC control system

In the field of industrial process control,a fast-development platform for programmable logic controller(PLC)systems is designed in order to solve two main problems of rapid development of PLC control system and programmability of controlling software.In the aspect of design,the platform is composed of hardware controlling and software monitoring and is taking industrial computer as the core.Under the Windows environment,the platform establishes the control instruction set,develops the configuration function and visual programming function of the monitoring software and it integrates PLC controller based on Visual Basic software.In order to achieve the function of data monitoring,it has realized the serial communication between computer and PLC by using RS-485 and RS-232 serial ports line communication.The platform designs the intelligent instruction scheduling strategy by studying the encoding and decoding rules of the communication instruction set.It proposes a method for rapidly developing control programs by adopting the expert control mode,which enables clients to develop and modify programs conveniently by importing instructions in a non-coded manner.After experimental testing,the platform is proved successful achieving both the rapid development of PLC control system and the rapid modification of monitoring software.

Grouting Control for Deep-Water Jacket Skirt Pile

Deep-water jacket skirt pile grouting is a critical step in ocean platform construction. Because of the complexity of the skirt pile structure and grouting pipeline, the calculation of grouting pressure and the control of output pressure are involved. Beginning with the jacket skirt pile grouting construction scheme, grouting pressure is estimated on the basis of engineering fluid mechanics theory and variable frequency control technique. Programmable logic controller is the center of grouting pressure control system, which accomplishes the flow control of cement buffer tank, water buffer tank, additive buffer tank, cement metering tank, water metering tank, additive metering tank, mixer and agitator. Based on PROFIBUS-DP network, the output pressure of the slurry pump is controlled by the inverter. This method has been applied successfully in JZ20-2 Nor. high spot jacket platform construction.

Identifying and Verifying Vulnerabilities through PLC Network Protocol and Memory Structure Analysis

Cyberattacks on the Industrial Control System(ICS)have recently been increasing,made more intelligent by advancing technologies.As such,cybersecurity for such systems is attracting attention.As a core element of control devices,the Programmable Logic Controller(PLC)in an ICS carries out on-site control over the ICS.A cyberattack on the PLC will cause damages on the overall ICS,with Stuxnet and Duqu as the most representative cases.Thus,cybersecurity for PLCs is considered essential,and many researchers carry out a variety of analyses on the vulnerabilities of PLCs as part of preemptive efforts against attacks.In this study,a vulnerability analysis was conducted on the XGB PLC.Security vulnerabilities were identified by analyzing the network protocols and memory structure of PLCs and were utilized to launch replay attack,memory modulation attack,and FTP/Web service account theft for the verification of the results.Based on the results,the attacks were proven to be able to cause the PLC to malfunction and disable it,and the identified vulnerabilities were defined.

The Designed Operation of the Machine Control System on HL-2A Tokamak

The Ethernet and field-bus communications are used in the machine control system （MCS） of HL-2A. The control net, with a programmable logic controller （PLC） as its logic control master, an engineering control management station as its net server, and a timing control PC connected to a number of terminals, flexibly and freely transfers information among the nodes on it with the Ethernet transmission techniques. The PLC masters the field bus, which carries small pieces of information between PLC and the field sites reliably and quickly. The control net is connected into the data net, where Internet access and sharing of more experimental data are enabled. The communication in the MCS guarantees the digitalization, automation and centralization. Also provided are a satisfactory degree of safety, reliability, stability, expandability and flexibility for maintenance.

基于PLC和变频器技术在制冷压缩机电机正反转寿命试验装置的应用

制冷压缩机电机正反转寿命试验是压缩机电机出厂前所必需的环节。为解决传统压缩机电机正反转试验装置中设备易损坏,数据采集易出现误差以及功能单一,不易控制的不足,文章设计了基于PLC、触摸屏和变频器技术的制冷压缩机电机正反转寿命试验装置,详细介绍了该装置的PLC控制原理及程序流程。并将其进行了实际应用对比,测试结果表明:该试验装置具备能够长期运行,采集数据稳定良好,功能多样,操控简单等优势,并提高了此类试验装置的安全性。

A Control System of Material Handlingin FMS

The design of a control system for the material transport as used in gear-box flexible manufacturing system is presented in this paper. The scope of investigation covers material transport control, automatic vehicle, material exchange station, multi-storeyed warehouse system, NC and CNC machines and host computer etc. The paper describes the transport control system and its design, and briefly describes the communication among devices and warehouse access principles.

Design and Development of Mechatronic Application in Agricultural Irrigation Device

In order to help the small-scale farmer, an automatic irrigation control system was proposed. This system will provide an irrigation system that will ease the burden of the citizen to take care of the plant. This system will run automatically by referring to the time set by the user. As the name itself is a water control system, this system will only start irrigating when the time set triggered the water control level for the plant to grow healthily. It will automatically stop when the timer is off (1 hour). The brain of the system is the PLC (Programmable Logic Controller). This is the place where all the activities are done. The irrigation will be provided by a pump that is also connected to the microcontroller. The pump will be activated until the timer has reached its time set. This system will continue running until the user presses the OFF button.

一种用于精密铸造工艺的树脂模具高效多功能固化设备的开发与应用

开发了一种基于stereo lithography appearance(SLA)光固化增材制造技术的、用于精密铸造领域树脂模具制作的后处理高效多功能固化设备。通过对核心机械结构的全新设计和加工工艺的深入探究,实现了可变循环散热、可变紫外功率、可变速固化、可变固化时间、舱门互锁等多项新功能。以programmable logic controller(PLC)和human machine interface(HMI)为中央控制器和人机交互平台,通过图形化界面编程实现了一键固化、个性化参数匹配、温差限值安全锁定等控制功能。最后通过多组目标件测试及数据对比,验证了设备具有固化目标高质量、固化过程高效率、界面操作简便、使用过程高安全等特性。其作为高效多功能的SLA光固化树脂模具后处理核心设备,具有很高的使用和推广价值。

Design of transfer device for magnetic thin sheet material

In order to realize the processing and retrieval of magnetic thin sheet materials in industrial production, this paper proposed a kind of transfer device for magnetic thin sheet raw material, which uses rodless cylinders as the main motive device and the programmable logic controller （PLC） to achieve the required functions, and applies the finite element analysis method to analyze its main components in the end of the design.

The Knee Wear Prediction of UHMWPE Tibial Insert Using VIPRO Platform

The failure mechanism was postulated as a combination of the high level of loading during normal activities and a non-conforming contact mechanism between the femoral condyles and the tibial insert. The question that arises is： could be this phenomenon evaluated quantitatively a priori, e.g., could be the failure due to delamination wear predicted？ In order to do some finite element simulations were performed to dynamically determinate the contact area and contact pressure for three different activities. The results obtained using VIPRO platform lead to the conclusion that many clinically reported failures of the tibial tray are caused by the adhesive and fatigue wear.

Compact first and second order polarization mode dispersion emulator

We propose a 1st and 2nd order polarization mode dispersion emulator （PMDE） with one variable differential group delay （DGD） clement using birefringence crystals and four polarization controllers （PCs）. Monte Carlo simulations demonstrate that the output 1st and 2nd order polarization mode dispersion （PMD） generated by the PMDE consists with statistic theory. Compared with former PMDEs, this design is tunable, lower-cost, and more integrated for fabrication, which shows response time of 150μs, response frequency of 3.8 kHz, working wavelength of 1550 nm, total power consumption of less than 3 W, working range of 0 84 ps and 0 3600 ps^2 for 1st and 2nd order PMD emulation, respectively. Also, it is programmable and can be controlled by either singlechip or computer. It can be applied to study the outage probability of optical communication systems due to PMD effect and the effectiveness of PMD compensation.

The machine protection system for CSNS

Background The China Spallation Neutron Source(CSNS)accelerator consists of an 80 MeV H-LINAC,a 1.6 GeV rapid cycling synchrotron(RCS)and two beam transport lines.The uncontrolled beam may permanently damage the components or lead to very high residual radiation dose along the beam line.So the equipment protection must be deliberately designed and implemented.Purpose The machine protection system(MPS)protects components from being damaged by the beam.The response time requirement for the CSNS MPS is less than 20 ms,so the PLC(programmable logic controller)was adopted to implement the interlock logic.Methods The MPS was implemented as a two-tier architecture system,and developed through utilizing PLC and Experimental Physics and Industrial Control System(EPICS)software toolkits.The application logic was taken into careful consideration during the implementation stage.An embedded CPU module can function as an IOC accessing PLC I/O modules through the sequence CPU,with an embedded Linux operation system.Results The interlock logic and heartbeat functions were tested with all functions ok.Time consumption has been measured thoroughly since the important requirement,which is around 15 ms to stop the beam.Conclusions MPS was completed in Sep.2017 and then put into operation.It has been operating smoothly for more than 3 years.MPS has played an important role in every stage of CSNS’s commissioning and operation and achieved high reliability during the user’s experiment operation.The accelerator recently runs stably with low equipment failure.