Environment Setup

The first mini project will be based on Ladder Logic programming. We will be using Schneider Electric's IDE called SoMachine Basic to do the programming. The latest ver- sion of SoMachine Basic for Windows machines can be downloaded from here: SoMachine

Basic V1.6 SP1.

SoMachine Basic requires Windows OS so if you do not have access to a Windows machine you can download a windows VM from here: Windows virtual machine.

If you are using this VM, follow these additional steps to set up your VM using Vir- tualBox (you are free to use any other virtual machine manager but we recommend Vir- tualBox):

1. Download and install VirtualBox for your OS: VirtualBox;

2. Open VirtualBox. Go to File Import Appliance. Open Appliance to browse your file system for the .ova file downloaded earlier;

3. The next window will show you the configuration of the current virtual appliance.
Do not change these configuration details. Click "Import";

4. Once the import process is complete, the new machine (i.e., CS-6263) will appear on the list of VMs. The password to log in is "cs6263user";

5. Install SoMachine Basic V1.6 SP1 on your VM.

SoMachine Basic
Ladder Logic, though different from mainstream coding languages is very easy to pick up. Here are a few tutorials on ladder logic to get you started. Tutorial 1, Tutorial 2,

Tutorial 3, Tutorial 4, Tutorial 5. Please refer to the following operating guide for more documentation on the IDE Reference Manual.

You will only be using the Programming and Commissioning Tabs to complete the project tasks. Once you're finished with the programming, to simulate your program go to the Commissioning tab. On the Commissioning Tab, click Launch Simulator. Then click

Start Controller, a small pop-up should appear that lets you activate/deactivate inputs and observe the corresponding behavior of the outputs. Note that there is no limitation on the methods you can use in the following sections unless it is explicitly mentioned.

Part 1
Construct three different Ladder Logic programs, each helping build the next one:

Part 1A

Construct a program that will simulate a push button activated LED. The program should satisfy the following requirements:

1. When Input 0 is activated, Output 1 should activate;

2.When input 0 is deactivated, Output 1 should deactivate;

3.Inversely, when Input 1 is activated, Output 0 should deactivate;

4.When input 1 is deactivated, Output 0 should activate.

Part 1B

Construct a program that simulates an LED powered by an On-Off loop. Program re- quirements:

1. When input 0 is activated, Output 0 should activate for 5 seconds, then deactivate for 5 seconds;

2. The on/off process should repeat infinitely until the input is deactivated; 3.Output 0 should immediately turn on after the activation of input 0; 4.Output 0 should immediately turn off after the deactivation of input 0.

Part 1C

Construct a program that simulates the same On-Off power loop, except the amount of time for the loop should be dictated by the Analog Inputs. Program requirements:

1. All of the requirements of Part 1B;

2. The "On" portion (Analog 0) should be 3 seconds; 3.The "Off" portion (Analog 1) should be 1.5 seconds.

Note that 3 and 1.5 seconds are just examples. Your final program must be able to work with any arbitrary timer settings.

For your convenience, the following can be used as a reference for how the above elements are referred in SoMachine Basic:
Input 0 = %I0.0 Input 1 = %I0.1 Output 0 = %Q0.0 Output 1 = %Q0.1
Timer 0 Preset = %TM0.P Timer 0 Finished = %TM0.Q Analog Input 0 = %IW0.0 Analog Input 1 = %IW0.1

Part 2

You are the Industrial Controls Systems Engineer at a Soft Drink Processing Plant. Having heard of recent attacks at similar plants that prevent the operators from shutting down their machinery when instructed, you were immediately suspicious when you saw your ladder logic program had been recently updated by someone other than you. You open the program to find it has been thoroughly tampered with to the point that a shutdown could not occur if instructed. Left alone, this would cause the machines to continue to operate nonstop, leading to soft drink spilling out and getting the floor all sticky, and possibly even irreversible machine damage.

The shutdown process, when functional, occurs in a series of checkpoints to ensure smooth and gradual cessation of the machinery. While an Emergency Shutdown button does exist, it is limited to life threatening situations, as such a sudden shutdown can damage machinery. The process should work as follows:

1. When the operator presses the Shutdown Button (Input 0), a 5 second timer begins before the first checkpoint (Output 0) is activated and the rest of the process can continue;

2. After this point the shutdown process can be canceled (Output 1) by the operator pressing the Cancel Shutdown Button (Input 1). This cancellation cannot occur unless the Shutdown Button (Input 0) has been activated. Note that the cancel shut down button should reset the timer;

3. For the process to continue, the pressure inside of the machines needs to be high enough such that the piping system doesn't get damaged. The operator needs to set the pressure of the machines to above the Pressure Checkpoint (Constant Word 0) using Analog Input 0. Then, the operator activates the Confirm Pressure Change button (Input 2) to register the change in the system. This will activate the second checkpoint (Output 2).

4. Finally, the operator confirms the shutdown process by pressing the Confirm Shut- down button (Input 3), resulting in the activation of the third and final checkpoint (Output 3), and the full shutdown of the system (Output 5).

5. In the case of an emergency, the Emergency Shutdown button (Input 4) can be pressed to activate the immediate shutdown procedure (Output 4) and result in subsequent shutdown (Output 5).

Use PLC+Vulnerabities.smbp and alter the code to any extent you wish, provided you adhere to these previous specifications for the Shutdown Process. You should assume that any rung of the ladder logic program, with the exception of the Shutdown Rung, can have no, one, or several problem(s) in them which you need to fix. Do not alter the Shutdown Rung, as this Rung is used to grade your code. Failure to adhere to this instruction will result in a deduction of points. It is clearly labeled with a comment, so it will be obvious which one it is.

For your convenience the following can be used as a reference for how the above elements are referred in SoMachine Basic:
Constant Word 0 = %KW0 Current Pressure = %MW0 Set Pressure = %IW0.0

Part 3
Many times in industrial control systems, devices such as Programmable Logic Controllers (PLCs) are commonly used to directly interact with sensors and actuators, and perform local automatic control. PLCs are often placed at relatively exposed locations in the field and are thus vulnerable to tampering by a nearby attacker. In particular, the attacker could attempt to manipulate firmware or logic to change the behavior of the PLC.

Ladder logic bombs, i.e. malware written in ladder logic can be inserted by an attacker into existing control logic on a PLC, and either persistently change the behavior, or wait for specific trigger signals to activate malicious behavior. For example, the LLB could lay dormant until a certain sequence of control actions is performed, or a certain point of time is reached. Then, the LLB could replace legitimate sensor readings that are being reported by the PLC to the ICS with manipulated values. Building on the Part 1B, construct a Logic Bomb that activates output 0 irrespective of the previous conditions and further changes to inputs when one of the following conditions occurs in the program:

1.Output 0 activates for a number of times, say 5;

2.25 seconds passed from the activation of input 0.

Note that after the activation of LLB, output 0 remains active regardless of the timers and inputs status. Change the timer preset values to make sure your designed LLB works in both of the aforementioned cases.

Hint: You might need to use the counter module.

4 Part 4

Imagine that you are responsible for designing a PLC program for controlling the entry of a parking. The parking's entry has two parts: a steel door and a gate. You should consider the following instructions when you are designing your program:

1. The steel door will be ready to open when it gets the signal from the remote. Then, if within 5 seconds the sensor verifies that there is a vehicle in front of the door, it starts opening; otherwise, the system should be reset;

2. Once the door opened completely (there is a sensor to check that), the gate starts opening after 2 seconds;

3. The gate should remain open for 7 seconds and then it should start closing. After the gate is closed, the door starts closing as well;

4. If a vehicle is still under the gate (a pressure sensor can detect this), it should open again and wait for another 5 seconds;

5. If another vehicle approaches the door while the door is closing, it should not close completely, instead, it should start the new process.

You are allowed to use the stated elements in your code: remote signal, the sensor that identifies the vehicles, two sensors that indicate the door closed/opened completely, two sensors that indicate that the gate closed/opened completely, the pressure sensor.