VirtuaPlant

Introduction

VirtuaPlant is a Industrial Control Systems simulator which adds a “similar to real-world control logic” to the basic “read/write tags” feature of most PLC simulators. Paired with a game library and 2d physics engine, VirtuaPlant is able to present a GUI simulating the “world view” behind the control system allowing the user to have a vision of the would-be actions behind the control systems.

Motivation

I regularly receive emails asking for PLC simulators suggestions and I really didn’t find many options rather than simple soft-PLCs with no embedded control logic (mostly because this is implemented according to client’s needs) thus leaving to the user the job of implementing their own control logic behind.

Also, many demos are made with custom-built or off-the-shelf kits involving hardware which raises the cost of the simulators for newcomers and low budget users and the idea of having everything (Control System + Plant parts) on software came to my mind.

Finally, the “Gamification” paradigm is hype, cool and makes the learning process even more phun!

Inspiration

The inspiration for starting with a bottle filling factory came from an article found on electrical-engineering-portal.com named “PLC implementation of the bottle-filling application”.

Even the project being inspired on the process described in the article, the process implemented in the Bottle-filling factory isn’t 100% faithful, but hey, it works!

Overview

All the software is written in (guess what?) Python. The idea is for VirtuaPlant to be a collection of different plant types using different protocols in order to be a learning platform and testbed.

The first release introduces a as-simple-as-it-can-get one-process “bottle-filling factory” running Modbus as its protocol.

World View

World View consits on the game and 2d physics engine, simulating the effects of the control systems’ action on virtual (cyberz!) assets.

It uses python’s pygame and pymunk (Chipmunk engine for python — intended to be replaced by pybox2d due the lack of swept collision handling which currently limits us a little).

VirtuaPlant - World View

PLC controller

The soft-plc is implemented over the pymodbus library which runs on a separate thread in the World View component and shares its context (i.e. Registers/Inputs/Tags) with the World View functions in order to simulate assets being “plugged in” to the controller.

HMI

The HMI is written using GTK3 and is quite dead simple. Also runs pymodbus client on a separate thread and connects over TCP/IP to the server (so it could be technically on a separate machine), constantly polling (i.e. reading) the server’s (soft PLC in World View) tags. Control is also possible by writing in the soft-PLC tags.

Poor Man's HMI

Attack scripts

You didn’t thought I was leaving this behind, did you? The phun on having a World View is to see the results when you start messing around with the soft-PLCs tags! Some pre-built scripts for determined actions are available so you can unleash the script-kiddie on yourself and make the plant go nuts! YAY!

Attacking VirtuaPlant

Demo

Check out this YouTube video demonstrating the attacks on the VirtuaPlant Bottle-Filling Factory:

Download

All the code can be found under the VirtuaPlant GitHub repository.

Installation requirements

The following packages are required:

  • PyGame
  • PyMunk
  • PyModbus (requires pycrypto, pyasn1)
  • PyGObject / GTK

On Debian-based systems (like Ubuntu) you can apt-get the packages which are not provided over pip:

apt-get install python-pygame python-gobject python-pip

Then install the pip ones:

pip install pymunk
pip install pymodbus
pip install pyasn1
pip install pycrypto

or install all of the pip packages by using our provided requirement.txt file:

pip install < requirements.txt

Running

Enter the /plants directory, select the plant you want (currently only one available) and start both the world simulator and the HMI with the start.sh script. Parts can be ran individually by running world.py and hmi.py (self-explanatory). All the attack scripts are under the /attacks subdirectory.

Future

The following plant scenarios are being considered:

  • Oil Refinery Boiler
  • Nuclear Power Plant Reactor
  • Steel Plant Furnace

The following protocols are being considered:

Suggestions? Found bugs? Wanna help? Hit me an email or send me a message on Twitter! Contact information on my about page.

Contents

comments powered by Disqus