Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “PLC”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

JTAG-based PLC memory acquisition framework for industrial control systems

In industrial control systems (ICS), programmable logic controllers (PLC) are the embedded devices that directly control and monitor critical industrial infrastructure processes such as nuclear plants and power grid stations. Cyberattacks often target PLCs to sabotage a physical process. A memory forensic analysis of a suspect PLC can answer questions about an attack, including compromised firmware and manipulation of PLC control logic code and I/O devices. Given physical access to a PLC, collecting forensic information from the PLC memory at the hardware-level is risky and challenging. It may cause the PLC to crash or hang since PLCs have proprietary, legacy hardware with heterogeneous architecture. This paper addresses this research problem and proposes a novel JTAG (Joint Test Action Group)-based framework, Kyros, for reliable PLC memory acquisition. Kyros systematically creates a JTAG profile of a PLC through hardware assessment, JTAG pins identification, memory map creation, and optimizing acquisition parameters. It also facilitates the community of interest (such as ICS owners, operators, and vendors) to develop the JTAG profiles of PLCs. Further, we present a case study of Kyros implementation over Allen-Bradley 1756-A10/B to help understand the framework's application on a real-world PLC used in industry settings. The sample PLC memory dumps are shared with the research community to facilitate further research.

Rais, Muhammad Haris↗
DOE OSTI2025

Innovative PLC Design for Optimized Potable Water Managment

My project here at Idaho National Laboratory (INL) was to work on Potable Water PLC Design (Programmable Logic Controllers). I was tasked in making a new panel design for the PLC system that will be moved from TRA BLDG 696 to TRA BLDG 608. This design needed to be updated since the old PLC system being about 20 years old. The manufacturer of the MicroLogix 1200 life expectancy showed it to be 10-20 years, and the system was discontinued in 2017. The new system we implemented was called CompactLogix Controller 5380, along with a new 24 VDC/10 Amp Power Supply. I made a design using Microsoft Visio, with the new material. But we needed to add it onto an Aluminum Panel that the system will be mounted onto, we need Unistrut’s for the aluminum panel to be mounted to. Some of the material we will still be using, like the R1 Alarm Relay, will be moving with the PLC system. The rest of the material will be new supplies that need to be updated systems, which the site is waiting for to complete the PLC system.

47 - OTHER INSTRUMENTATION↗
DOE OSTI2024

PLC Vulnerabilities and Mitigations

Programmable Logic Controllers (PLCs) are used extensively in many high-importance industrial and nonindustrial settings including controlling elevators, manufacturing machines, and utility facilities such as power and natural gas, however cybersecurity protection for them has been neglected. Within recent years, PLCs have been put under more security scrutiny and experts have advocated for changes from the addition of protocol encryption and network segmentation to intrusion detection systems on the PLCs themselves. While PLC security is critical, a large portion of the PLCs available today will never receive these changes due to being legacy or the difficulty of overhauling the security on existing systems. Due to the infeasibility of applying many recommended security measures towards currently available machines, we aim to provide realistic and affordable best practices for hardening PLCs. We will first conduct security analysis and consider attack vectors within our target PLC. Once we’ve analyzed the device’s security, we will evaluate a variety of mitigation methods and create guidelines to effectively reduce the threat posed by PLC attacks with minimal disruption to operations.

42 ENGINEERING↗
DOE OSTI2014

Measurement and control system for cryogenic helium gas bearing turbo-expander experimental platform based on Siemens PLC S7-300

An experimental platform for cryogenic Helium gas bearing turbo-expanders is established at the Technical Institute of Physics and Chemistry, Chinese Academy of Sciences. This turbo-expander experimental platform is designed for performance testing and experimental research on Helium turbo-expanders with different sizes from the liquid hydrogen temperature to the room temperature region. A measurement and control system based on Siemens PLC S7-300 for this turbo-expander experimental platform is developed. Proper sensors are selected to measure such parameters as temperature, pressure, rotation speed and air flow rate. All the collected data to be processed are transformed and transmitted to S7-300 CPU. Siemens S7-300 series PLC CPU315-2PN/DP is as master station and two sets of ET200M DP remote expand I/O is as slave station. Profibus-DP field communication is established between master station and slave stations. The upper computer Human Machine Interface (HMI) is compiled using Siemens configuration software WinCC V6.2. The upper computer communicates with PLC by means of industrial Ethernet. Centralized monitoring and distributed control is achieved. Experimental results show that this measurement and control system has fulfilled the test requirement for the turbo-expander experimental platform.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2023

Strengthening Cybersecurity for Industrial Control Systems: Innovations in Protecting PLC-Based Infrastructure

In this paper, we propose two new approaches aimed at enhancing the security of industrial control systems (ICS) that utilize programmable logic controllers (PLCs) for the control of critical processes. The first approach involves the addition of a unique digital watermark to the PWM control that adjusts the motor speed to control the critical process. This enables efficient detection and identification of any unauthorized modifications to the sensor signals responsible for controlling the plant. The second approach focuses on monitoring the input current (i.e power) drawn by the PLC during the execution of critical process control tasks. Malicious intrusions to change the PLC parameters and/or unauthorized firmware updates can be rapidly detected. Both approaches demonstrate a substantial improvement in the security of ICS, effectively safeguarding against potential cyber-attacks. Experimental results from a laboratory scale water tank level controlled via PLC showcases rapid intrusion detection capabilities.

Huang, Peng-Hao↗
DOE OSTI2024

Beyond Binary: Automated PLC Memory Forensics through RGB Image Analysis and Deep Learning

The introduction of Industry 4.0 and the evolution of industrial control systems (ICS) to adopt Internet-based technologies enhanced productivity, but have inadvertently increased their vulnerability to cyber-based malicious attacks. When an ICS system is compromised, security analysts need to identify the root cause quickly to start the recovery process and develop mitigation strategies to safeguard against future instances. Memory forensics is critical in the analysis process to ascertain what occurred. To date, approaches to analyze the persistent memory in ICS devices are limited, and almost nonexistent for volatile memory. This paper proposes an automated methodology, COMA, for PLC memory dump analysis using computer vision and deep learning techniques. Specifically, COMA converts the sequences of bytes in a PLC memory dump to RGB pixels and creates a deep learning model that learns the underlying patterns and features of pre-labeled forensic artifacts in images and segments them into distinct regions. COMA then uses the trained model to automatically segment new memory images and extract forensic artifacts. We evaluate COMA on a Schneider Electric Modicon M221 PLC involving two cyber-based attack scenarios: (i) code injection and (ii) code modification. The empirical results show that COMA can successfully detect attack artifacts in memory dumps in both scenarios.

Asmar Awad, Rima↗
DOE OSTI2019

Overshadow PLC to Detect Remote Control-Logic Injection Attacks

Programmable logic controllers (PLCs) in industrial control systems (ICS) are vulnerable to remote control logic injection attacks. Attackers target the control logic of a PLC to manipulate the behavior of a physical process such as nuclear plants, power grids, and gas pipelines. Control logic attacks have been studied extensively in the literature, including hiding the transfer of a control logic over the network from both packet header-based signatures, and deep packet inspection. For instance, these attacks transfer a control logic code as data, into small fragments (one-byte per packet), that are further padded with noise data. To detect control logic in ICS network traffic, this paper presents Shade, a novel shadow memory technique that observes the network traffic to maintain a local copy of the current state of a PLC memory. To analyze the memory contents, Shade employs a classification algorithm with 42 unique features categorized into five types at different semantic levels of a control logic code, such as number of rungs, number of consecutive decompiled instructions, and n-grams. We then evaluate Shade against control logic injection attacks on two PLCs, Modicon M221 and MicroLogix 1400 from two ICS vendors, Schneider electric and Allen-Bradley, respectively. The evaluation results show that Shade can detect an attack instance (i.e., identifying at least one attack packet during the transfer of a malicious control logic) accurately without any false alarms.

Yoo, Hyunguk↗
DOE OSTI2026

PLC Integration for the Horn A Magnetic Field Mapping Device

This presentation summarizes the integration of a programmable logic controller (PLC) into the Horn A magnetic field mapping device for the Long-Baseline Neutrino Facility (LBNF). The device is used to position magnetic field probes along the centerline of the Horn A inner conductor to verify that the magnetic field within this region is approximately zero. The presentation covers the PLC hardware and electrical integration, stepper motor and encoder control, ladder logic development, mechanical integration, and system testing. Results include successful bidirectional motion and encoder feedback for the translation and rotation axes, as well as characterization of translational motion for repeatable probe positioning.

Bitakis, Kayla [Unlisted, US, IL]↗
DOE OSTI2023

Industrial PLC Network Modeling and Parameter Identification Using Sensitivity Analysis and Mean Field Variational Inference

A multiple input multiple output (MIMO) power line communication (PLC) model for industrial facilities was developed that uses the physics of a bottom-up model but can be calibrated like top-down models. The PLC model considers 4-conductor cables (three-phase conductors and a ground conductor) and has several load types, including motor loads. The model is calibrated to data using mean field variational inference with a sensitivity analysis to reduce the parameter space. The results show that the inference method can accurately identify many of the model parameters, and the model is accurate even when the network is modified.

47 OTHER INSTRUMENTATION↗
DOE OSTI2015

STEPPER MOTOR CONTROL, PLC VS VME

Traditionally, EPICS-based accelerator control systems have used VME-based motion control modules to interface with stepper motors. For systems that include some Programmable Logic Controllers (PLC), there is an option for using PLC-based stepper motor interface modules. As with all control system choices, there are trade-offs. This paper will delineate some of the pros and cons of both methods of interfacing with stepper motors.

Strong, William Herb↗
DOE OSTI2021

Sensitivity-Informed Bayesian Inference for Home PLC Network Models with Unknown Parameters

Bayesian inference is used to calibrate a bottom-up home PLC network model with unknown loads and wires at frequencies up to 30 MHz. A network topology with over 50 parameters is calibrated using global sensitivity analysis and transitional Markov Chain Monte Carlo (TMCMC). The sensitivity-informed Bayesian inference computes Sobol indices for each network parameter and applies TMCMC to calibrate the most sensitive parameters for a given network topology. A greedy random search with TMCMC is used to refine the discrete random variables of the network. This results in a model that can accurately compute the transfer function despite noisy training data and a high dimensional parameter space. The model is able to infer some parameters of the network used to produce the training data, and accurately computes the transfer function under extrapolative scenarios.

42 ENGINEERING↗
DOE OSTI2024

Primary Pump Motor Area - Transfer Fan Replacement PLC Design

My poster is about a project that I have worked on in my time at ATR as an intern. The Heating and Ventilation Control Panel (HVB-1) controls thirty-five heating and ventilation fans within the Advanced Test Reactor. This control panel needs replacement, as many of the components inside the existing panel are becoming old and degrading. In preparation for this replacement effort, concepts and component identification for the new control panel needed to be developed. Instead of replacing the new panel with replacement mechanical components, a Programmable Logic Controller (PLC) is proposed as a solution. Although multiple fans are associated with this panel, my poster focuses on the replacement design for the Primary Pump Motor Area Transfer Fan. This will provide an example of how the entire cabinet may be upgraded.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2012

Crystallization, optimization and preliminary X-ray characterization of a metal-dependent PI-PLC from Streptomyces antibioticus

A recombinant metal-dependent phosphatidylinositol-specific phospholipase C (PI-PLC) from Streptomyces antibioticus has been crystallized by the hanging-drop method with and without heavy metals. The native crystals belonged to the orthorhombic space group P 222, with unit-cell parameters a = 41.26, b = 51.86, c = 154.78 Å. The X-ray diffraction results showed significant differences in the crystal quality of samples soaked with heavy atoms. Additionally, drop pinning, which increases the surface area of the drops, was also used to improve crystal growth and quality. The combination of heavy-metal soaks and drop pinning was found to be critical for producing high-quality crystals that diffracted to 1.23 Å resolution.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2014

A robust and stable PLC based control system for 40kJ/25kV EMM system

This paper describes the PLC based control system developed for a 40kJ/25kV Electro-magnetic machining (EMM) system. In EMM system large capacitor banks is charged with high voltage to store large energy and the banks is made to discharge into a coil within few milli-seconds using a triggered spark gaps. During discharge of the capacitor large surges and transients are generated in the system. The control system monitors/controls and interlocks all the units of the system for proper operation. The control system is the only subsystem which is electrically connected to all the low and high voltage subsystems. Care should be taken at the signal interfacing with the control system to protect the control system. (author)

43 PARTICLE ACCELERATORS↗
DOE OSTI2021

PLC-based Impedance Measurement and Current Injection Response Analysis

Studying and mitigating the vulnerabilities of Programmable Logic Controllers (PLCs) to electromagnetic pulse is important for the reliability of the power system. In this paper, an effective impedance measurement scheme is proposed to estimate the susceptibility of PLCs to an electromagnetic pulse. The equivalent non-uniform transmission line model is established to eliminate the impact of the fixture in the de-embedding process. Based on the measured impedance, the equivalent circuit is established to calculate the response of the device when subjected to the electromagnetic pulse. The voltage and current responses of different interfaces are compared utilizing the developed pulse Current Injection (CI) method. Finally, the impedance measurement scheme is verified through testing using three measuring instruments. And the CI simulation experiments reveal the characteristics and susceptibilities of different PLCs interfaces, indicating that some protection measures are required for the reliable operation of PLC.

Qiu, Wei↗
DOE OSTI2025

Modernization of PLC-Based Control Systems at SNS

When the SNS site was built around 20 years ago, the Conventional Facilities (CF) control systems were de-signed using 2 communication protocols to allow pro-grammable logic controllers (PLCs) to interface with motors, variable frequency drives (VFDs), and remote input and output (I/O) devices. The protocol chosen to control motors and VFDs is DeviceNet, a CANbus-based protocol developed by Allen-Bradley, a subsidiary of Rockwell Automation. The protocol chosen to communi-cate with remote I/O is ControlNet, another protocol developed by Allen-Bradley. Both of these protocols are obsolete and present reliability and maintainability is-sues, particularly DeviceNet. As the Control Systems Section at SNS is working to modernize control systems throughout the machine, a major goal for PLC-based systems is to remove the obsolete communication proto-cols in favor of standard, ubiquitous Ethernet. To this end, any new VFDs installed use Ethernet communica-tion. Many VFDs are currently being replaced in the Central Utilities Building (CUB) and the Central Exhaust Facility (CEF) and are being removed from DeviceNet in favor of Ethernet communication. Planning is underway to retrofit Eaton Intelligent Technology motor control centers (MCCs) in the Target Building to remove particu-larly troublesome DeviceNet adaptors and replace them with Ethernet adaptors for each motor starter. The Con-trolNet network in the CUB has been demolished, with I/O drops integrated into a local Ethernet network, im-proving sustainability and maintainability.

Beaushaw, Isaiah [ORNL]↗