Nuclear Instrumentation and Control Simulation (NICSim) and the LOBO NCS Platform
Nuclear Instrumentation and Control Simulation (NICSim)
The University of New Mexico's Institute for Space and Nuclear Power Studies (UNM-ISNPS), in collaboration with Sandia National Laboratories (SNL), Albuquerque, NM, is initiating a new program starting fall 2018 under a multi-year DOE-NEUP grant. The new program is led by Distinguished and Regent's Professor Mohamed El-Genk, with key participation and involvement by Dr. Christopher Lamb, member of technical staff at SNL and Research Assistant Professor at UNM, and Dr. Timothy Schriener, Research Assistant Professor with UNM-ISNPS. The primary focus of the effort is to develop a Nuclear Instrumentation and Control Simulation (NICSim) platform with novel emulytics capability to simulate control systems and components in nuclear power plants. The platform would use the DOE SCEPTRE emulation framework, developed at SNL to evaluate cyberattacks on energy grids, to simulate digital instrumentation & control (I&C) systems in nuclear power plants by running actual software images, or, if needed, specific hardware elements of these systems. It would simulate (via computational models), emulate (via precise firmware and software execution in emulated hardware environments), and embed hardware to evaluate the cybersecurity posture, vulnerability, and potential response of control systems in nuclear power plants to cyber-attacks. The hardware emulation of I&C system components, using real device firmware and software images, would enable the NICSim platform to evaluate with high fidelity the response and behavior of the actual software running system components under cyberattack. The emulated I&C system components would be coupled to simplified, physicsbased models of a given plant's components to enable real and direct feedback of the integrated I&C system's behavior, both nominally and while under cyber-attack. The results of this cooperative and joint effort between UNM-ISNPS and SNL will help increase the understanding of the real risks of cyber- compromise to I&C systems in the existing and future nuclear power plants. This effort will also help educate and train a new cadre of engineers and computer scientists and the next generation of researchers and security specialists.
LOBO Nuclear CyberSecurity (LOBO NCS) Platform
The LOBO Nuclear CyberSecurity (LOBO NCS) Platform is currently under development at ISNPS in collaboration with Sandia National Laboratories (SNL) to investigate cyber-vulnerabilities of nuclear reactor plants. In addition to cybersecurity research, the architecture of the LOBO NCS platform can also provide academic education and professional training. LOBO NCS can support both cybersecurity investigations of existing nuclear plant I&C systems as well as research developing next generation digital I&C systems for autonomous control and remote operation. It links MATLAB Simulink models of a nuclear power plant and components to the emulated or physical hardware Programmable Logic Controllers (PLCs) in the digital I&C systems. By emulating the I&C system using virtual machines (VMs), LOBO NCS provides a higher degree of fidelity than simple functional PLC models, expanding the types of cybersecurity investigations which may be performed on the platform. It can easily be extended to different nuclear power plant types and I&C system architectures including advanced Small Modular and Micro Reactors, research reactors, and space nuclear power systems.
Layout and components within the LOBO NCS Platform.
The Simulink models in the LOBO NCS platform communicate to the emulated PLCs in the I&C systems using a fast and reliable data transfer interface and broker program. The transfer interface and broker programs run on the main server node as the Simulink models. The communication with and between the PLCs in the plant's I&C systems uses real industrial control systems communication protocols, such as Modbus and DNP3. Each of the emulated PLCs in the I&C systems runs within separate VMs located on multi-processor server nodes connected to main server through the testing Ethernet network. Physical hardware PLCs can also be connected to the testing network in place of, or in conjunction with, the emulated PLCs. A user-friendly graphic interface with plotting capabilities in the LOBO NCS provides a real-time display of simulation results on a large format screen. The Manipulate Process Input/Output (ManiPIO) framework initiates simulated cybersecurity events on PLCs in the I&C systems. It is developed for testing purposes and are void of any cybersecurity risks. The ManiPIO data capture module records and performs deep packet inspection of the Modbus traffic sent through the network for further analysis.
Results of simulated transient of sequential surge-in and surge-out events and of proportional heater control functions for Allen-Bradley commercial hardware PLC and emulated PLC with OpenPLC during normal operation and while under a False Data Injection Attack (FDIA) targeting the Modbus holing register for the system pressure state variable to activate the heaters within the pressurizer.
In addition to supporting the development of next generation cybersecurity and autonomous control technology and methods for terrestrial nuclear reactor power plants and space nuclear power systems, and other energy systems, the LOBO NCS platform would be used for academic education and professional training of a new cadre of nuclear cybersecurity researchers and engineers. The LOBO NCS employs widely used and often open-source modeling and simulation technology and methods. These include the Simulink programing languages, POSIX IPC shared memory data transfer and semaphores in the developed data transfer interface, and the open sources PLCs using OpenPLC. Our team welcomes the opportunities to interact with other groups developing similar capabilities and to compare results of case studies.
