Reference no: EM132381176

PLC Programming with Ladder Logic

1 Part 1
Construct three different Ladder Logic programs, each building on the previous one:

Part 1A
Construct a program that will simulate a push button activated LED. The program should satisfy the following requirements:

1. When Input0 is activated, Output1 should activate;
2. When Input0 is deactivated, Output1 should deactivate;
3. Inversely, when Input1 is activated, Output0 should deactivate;
4. When Input1 is deactivated, Output0 should activate.

Note: Input0 and Input1 are not push buttons. For example, Output1 should be active as long as the Input0 is active. To be more clear, Input0 and Input1 are like light switches.

Part 1B
Construct a program that simulates an LED powered by an On-Off loop. Program re- quirements:
1. When Input0 is activated, Output0 should activate for 5 seconds, then deactivate for 5 seconds;
2. The on/off process should repeat infinitely until the input is deactivated;
3. Output0 should immediately turn on after the activation of Input0;
4. Output0 should immediately turn off after the deactivation of Input0.
Note: Similar to the previous part, Input0 is not a push button.

Part 1C
Many times in industrial control systems, devices such as Programmable Logic Controllers (PLCs) are commonly used to directly interact with sensors and actuators, and perform local automatic control. PLCs are often placed at relatively exposed locations in the field and are thus vulnerable to tampering by a nearby attacker. In particular, the attacker could attempt to manipulate firmware or logic to change the behavior of the PLC. Ladder logic bombs (LLB), i.e. malware written in ladder logic, can be inserted by an attacker into existing control logic on a PLC, and either persistently change the behavior, or wait for specific trigger signals to activate malicious behavior. For example, the LLB could lay dormant until a certain sequence of control actions is performed, or a certain point of time is reached. Then, the LLB could replace legitimate sensor readings that are

Table 1: Binary Map of the PLC

Axis	X			Y
Address	%IX0.0	%IX0.1	%IX0.2	%IX0.3	%IX0.4	%IX0.5
Value	0	1	1	1	0	0
Weight	20	21	22	20	21	22

being reported by the PLC to the ICS with manipulated values. Building on the Part 1B, construct a Ladder Logic Bomb that activates output 0 irrespective of the previous conditions and further changes to inputs when one of the following conditions occurs in the program:
1. Output0 activates 5 times;
2. 25 seconds passed from the activation of Input0.
Note that after the activation of LLB, Output0 remains active regardless of the timers and inputs status. Change the timer preset values to make sure your designed LLB works in both of the aforementioned cases.
Hint: You might need to use the counter module.

Note: There are some cases where condition 1 becomes true before condition 2 and vice versa. Think about it deeply!
If Input0 deactivates before the (25-second) timer operation (e.g., after 5
seconds), the (25-second) timer must be reset.
The counter that is used for modeling condition 1 (5 time operation of Out- put0 ) should not be reset under any circumstances.

2 Robot Path

The first process models a robot (shown as a black solid circle in Fig. 2) looking for its path on an 8 × 8 grid. The robot can only travel along the wires and stop at the intersections. It starts at the lowest and leftmost position in the grid, denoted as (0,0). The horizontal direction is the x axis, and the vertical direction is the y axis. The maximum coordinates in this grid is (7,7). The hollow circle is the target position.

Your task is to write a program that takes the current position of the robot (pos x, pos y) and the target position (target x, target y), and control the direction of the robot so that it will arrive at the target. Once it arrives, the robot should stay at the target until a new target has been assigned. Note that the robot can take only one direction at a time. If more than one direction output (%QX0.0 through %QX0.3) is activated, the robot will not move. This should never happen for your program. You may freely choose any of the viable paths, as long as it always gets closer to the target after each move.

The HMI can be conveniently used to test and debug the program. It shows the current position, target, direction control output and actual direction of the robot. You can also click anywhere on the grid to set a new target.

3 Traffic Light
The second process models a traffic light system at a pedestrian crossing. There are vehicles traveling easterly and westerly on the road, and pedestrians who wish to cross the road. A red/yellow/green traffic light is used for the vehicles. A red/green traffic light is used for the pedestrians. Normally, red light is displayed to the pedestrians and green light is displayed to the vehicles.

4 Tank Balancer

Part 4A

The tank balancer process in the OpenPLC is a system consisting of four tanks, as shown in the attached figure.

Each tank has 1 water inlet and 1 water outlet, as well as 3 water level sensors. Tank 1's outlet is connected to the inlet of tank 2. Similarly, tank 2's outlet is connected to the inlet of tank 3, and tank 3's outlet is connected to the inlet of tank 4. Water flowing out of tank 4's outlet is discarded. Additionally, each tank's inlet is also connected to an independent water source, which provides random water flow into the corresponding tank (denoted as RandomInput). The water source is NOT controlled by the PLC in this case. Three water level sensors on each tank are activated when the water level in the tank is above certain thresholds (i.e., low, medium, high).
The PLC program should take the 12 sensor readings as inputs, and output 4 control signals to the actuators of the 4 tanks' outlet valves. The goal is to maintain the water level in each tank between "low" and "high" levels exclusively by adjusting the water flow among the tanks. In other words, the "low" water level sensor should always be active and "high" water level sensor should never be active.
A special case is during the start of the simulation, when all tanks are empty and water is below the "low" level. You should let the water level increases initially, and make sure the goal is satisfied starting at 30s after the simulation has begun. Note that it is unnecessary to use a timer for "30s". It is merely a checkpoint that will be used during the grading process. The RandomInput is designed to provide adequate amount of water flow so that a well designed control program can fill each tank above the "low" level fast enough.

Part 4B
With a correctly behaving control program, you are now going to implement a malicious version of the program. Your goal is to remain stealth during the beginning "test run" of the malicious program and only start the sabotage afterwards. To do so, you need to modify your program for the Tank Balancer so that after X minutes, only tank 2 will start to overflow. In other words, the "high" water level sensor in tank 2 will always be activated after X minutes. All other tanks should remain the originally benign behavior. In a real attack, X may be chosen to be very large to evade discovery during the test run phase. For the purpose of this project, we will use a smaller value. Your goal is to overflow tank 2 no earlier than 60 seconds after the simulation has begun, but no later than 90 seconds. After 90 seconds, it should remain in the overflow state.

5 Stirring System

Part 5A
In this part, you need to write a control program for a mixing and stirring system. In this case, it's a single tank with 3 inlets for different materials (A, B, and C, respectively), a mixing blade which can be activated, and an outlet for exhausting the mixture. This tank also has 4 level sensors, namely the empty, low, medium, and high sensors. Note that the empty sensor is activated when the level is above 0.

The PLC program should take the 4 level sensors as inputs, and control the valves for the 3 inlets, the mixing blade, and the valve for the outlet. It should follow these specific sequence in order to properly mix the materials:

1. The tank starts in an empty state, i.e., "empty" level sensor is deactivated. All inlet and outlet valves are closed, and mixing blade is turned off.
2. Only open the valves for inlet 1 and 2 to add A and B into the tank at the same time, until the "low" level sensor is activated. Turn off the valve for inlet 1 only.
3. Keep adding B until the "medium" level sensor is activated. Leave the valve for inlet 2 open.
4. Open the valve for inlet 3 to add B and C at the same time until the "high" level sensor is activated. Turn off both valves for inlet 2 and inlet 3. At this point, all 3 inlet valves should be closed.
5. Turn on the mixing blade.
6. After the mixing blade has run for 5 seconds, open the outlet valve to drain the mixture and keep the mixing blade running. No inlet valve should be open during this process.
7. When all mixture has been drained, the "empty" sensor will be deactivated. As soon as this happens, turn off the mixing blade. Wait for 3 seconds with the outlet valve open, mixing blade turned off, and all inlet valves closed. Then close the outlet valve.
8. Start over from step 1.

Note that for a valve, a logical high or "True" means open and vice versa.

Part 5B
With a correctly behaving control program, you are now going to implement a malicious version of the program, again. As usual your goal is to remain stealthy during the begin- ning "test run" of the malicious program and only start the sabotage afterwards. To do so, you need to modify your program for the Stirring System so that after looping through the process Y times, it will invert the behavior of the mixing blade. In other words, the mixing blade needs to be turned off in step 5 and 6, and turned on during the rest of the time. In a real attack, Y may be chosen to be very large to evade discovery during the test run phase. For the purpose of this project, we will use a smaller one. Your goal is to invert the behavior of only the mixing blade after looping through the steps exactly 3 times, i.e., starting from the 4th time your program runs at step 1.

Attachment:- PLC Programming with Ladder Logic.rar