Emulate a PLC and it's functionalities using Pi

Hello there,
If I'd like to "emulate" a PLC (available in market) using a Raspberry Pi 3 (the HMI and other I/O operations should just resemble like the original PLC), what are the steps that I need to go through? Kindly advise me on this. Any detailed explanation would be highly appreciated.


P.S. - Am trying to do a project on "Securing PLCs" using "honeypot" method.

You can run Codesys on an rPI. You can download the runtime directly from them, and use the development software and program like you would any Codesys based PLC. Includes webvisu for a basic HMI.

I use that for testing/practice, works fine for me. The free version runs for 2 hours. After a reboot of your PI it will run another two hours, etc. For €50 you can buy an unlimited license (for one PI) to get rid of the 2 hrs limitation.

For emulation of commercial PLC it seems Codesys for RPi would be a good choice.
If you want something simpler and free, you could try with http://www.open***************/getting-started-rpi

codesys V3 is good to test security issues, and you can use your program in many PLC types as codesys is used in many factories of plc.

shooter said:

codesys V3 is good to test security issues, and you can use your program in many PLC types as codesys is used in many factories of plc.

Click to expand...

many what? I only come across it when a PLC seems to be [needed as] a part of another system... like servo's or hmi's...

I think he means to say that CodeSYS (or a port) is used to program many makes of PLC's.

http://devices.codesys.com/device-directory.html

Got lost in middle..:/

Hello everyone,
First of all, thank you all for the help.
As I told before, am trying to emulate the Allen Bradley PLC functionalities using rPI. The reason is to secure the actual industrial PLCs, by having this emulated PLC serve as a "honeypot" ( in simple terms, to evade a cyber physical attack ).
To accomplish the above task, my idea is as follows: If possible, design a microcontroller ( or something ) that can actually sense the difference between the actual PLC and the emulated PLC . ( I've to prove to the board of members, that my emulated PLC is pretty close enough to the actual PLC. The other plan is to have some ethical hackers try to attack my emulated PLC and see if they can find out the "fake" one. )

How can I make this ( the bold text ) happen using Codesys on rPI?

kihtrak said:

How can I make this ( the bold text ) happen using Codesys on rPI?

Click to expand...

Well you are not because Codesys is not Allen bradley. Codesys was a suggestion because it emulates a Codesys based controller on an rPI because Codesys has developed a runtime for it. So for emulating a PLC for the purpose of using it for actual PLC purposes it's a good suggestion assuming there was flexibility with the platform (ie...testing/educational).

Given what your after I don't think you'll have much luck. Even if you could build something to "emulate" a logix PLC, I'd guess it's be pretty easy to identify if the 'target' is an actual Logix or not by identifying if it is running VxWorks, the operating system it uses.

Why not just get an actual AB PLC? If you are talking security, surely there has to be much better options out there than something hacked on an rPI???

kihtrak said:

As I told before, am trying to emulate the Allen Bradley PLC functionalities using rPI.

Click to expand...

Originally it was just a PLC available in market.

kihtrak said:

To accomplish the above task, my idea is as follows: If possible, design a microcontroller ( or something ) that can actually sense the difference between the actual PLC and the emulated PLC . ( I've to prove to the board of members, that my emulated PLC is pretty close enough to the actual PLC. The other plan is to have some ethical hackers try to attack my emulated PLC and see if they can find out the "fake" one. )

How can I make this ( the bold text ) happen using Codesys on rPI?

Click to expand...

As far I know, Codesys is a software for programming PLCs, not for emulating a specific PLC brand.

There're several papers on internet about PLC honeypots. I found one titled "CryPLH: Protecting Smart Energy Systems from Targeted Attacks with a PLC Honeypot"; it seems a good start for getting a better understanding of the theme.

Paully's5.0 said:

So for emulating a PLC for the purpose of using it for actual PLC purposes it's a good suggestion assuming there was flexibility with the platform (ie...testing/educational).

Click to expand...

Guess, I can go around it to have a better understanding of how a software for PLC can be run on rPI.

Paully's5.0 said:

Given what your after I don't think you'll have much luck. Even if you could build something to "emulate" a logix PLC, I'd guess it's be pretty easy to identify if the 'target' is an actual Logix or not by identifying if it is running VxWorks, the operating system it uses.

Click to expand...

Exactly! We are trying to bring out shortcomings like these, which might lead us to the actual solution. ( Since it's a research! )

Paully's5.0 said:

Why not just get an actual AB PLC? If you are talking security, surely there has to be much better options out there than something hacked on an rPI???

Click to expand...

With the allocated grant, it's not quite possible to buy one ! We might get some chance to work on an actual AB PLC in an industry ( I highly doubt this! ). But, if not do you think is there a way out?

nhatsen said:

Originally it was just a PLC available in market.



As far I know, Codesys is a software for programming PLCs, not for emulating a specific PLC brand.

There're several papers on internet about PLC honeypots. I found one titled "CryPLH: Protecting Smart Energy Systems from Targeted Attacks with a PLC Honeypot"; it seems a good start for getting a better understanding of the theme.

Click to expand...

Thanks a ton! It might help us a lot. I'll keep you posted on this.

This came to my attention a few days ago. I haven't had time to read it yet.
https://www.raspberrypi.org/forums/viewtopic.php?f=41&t=455&start=100