Model Verification of Resilient Third-Party Monitoring System Against Cyberattacks

Industrial control systems (ICS) are required to be designed and operated safely even when subjected to cyberattacks. Fallback control is necessary for the safe operation of ICS. One of fallback control systems is a resilient third-party monitoring system. This system consists of Programmable Logic Controllers (PLCs) for normal control and for fallback control. The normal PLC controls field devices, and the fallback PLC takes over the control after the normal PLC is attacked. The fallback control of this paper is the control takeover of a robot arm control system. In order to quickly transition to this fallback control, it is necessary to incorporate a supervisor function to manage each PLC function in an integrated manner. This paper aims to propose a modeling method of ICS functions and its analysis method to ensure that the supervisor can work properly under cyberattacks. For modeling, we use UPPAAL and implement the models of each PLC and supervisor on UPPAAL. In order to quantitatively analyze whether the supervisor can really realize the incident response during cyberattacks, we give the specifications necessary for fallback control to the supervisor model using TCTL.