The University of Alabama in Huntsville

~ 08/29/2019 ~

Testing Method – OpenPLC

A list and description of how to test Thurst 2: Open PLC Project.

● Unconnected
o Future Work - Develop tool for testing this type
● Connected
o Analog
▪ Using AdvancedHMI, we are creating a simulated blinking LED and
changing the frequency of the blinking LED using buttons on
AdvancedHMI.
o Digital
▪ Using AdvancedHMI, we are creating a simulated blinking LED ( 0 – OFF
1 – ON)
● Unknown
o Ethersploit -> send_raw_pccc [data]
▪ Using Cygwin, run this exploit tool just sends raw data to the PLC.
● ./ethersploit
● Connect 127.0.0.1
● Send_raw_pcc [data]

*Programs and Tools Used for Testing:

● OpenPLC Runtime – Virtual PLC

● Cygwin – Application that allows Linux native apps on Windows
● Wireshark – Packet capture tool to verify contents are sending and receiving
● AdvancedHMI – HMI that was used to test usability and application
o Replace the folder “AdvancedHMI” with the folder from Google Drive
o https://drive.google.com/drive/folders/1tPYGuvh1GNW0lMSPyFzmMyou3HzI3V4q
o Select the form in AdvancedHMI from the “AllTest” folder
 The University of Alabama in Huntsville
~ 08/29/2019 ~

AdvancedHMI Tests
A description of the successfully tested functions and how to set up AdvancedHMI in
order to test those functions. All testing and verification can be done with the ladder logic file
“alltest3.st” and with the single Advanced HMI setup provided. Wireshark is also used to verify
the correct format of the packets.

Functions
PCCC supports three different overarching functions. Protected Logical Read is used to read data
from memory. Protected Logical Write is used to write byte size data into memory. Protected
Logical Write with Mask is used to write bitwise data into memory.

File Types & Numbers

The PCCC protocol stores data in sections of memory blocked off in “files”. Each of these
sections has a corresponding File Type and File Number. The four file types implemented in
OpenPLC are Input Logical by Slot, Output Logical by Slot, Integer, and Float.

Read Digital Output

Description of Test​: The PLC returns a binary value from the digital output memory.
Function Code ​0xA2 File Type ​0x8B File Number ​0x00
Ladder Logic File​: alltest.st
AdvancedHMI Interface Components List:

● Driver – EthernetIPforSLCMicroCom1
● Basic Indicator – Reads from the Address either a 1 or 0
● Basic Button ON – Writes a 1
● Basic Button OFF – Writes a 0

Drive Location:​ ​https://drive.google.com/drive/folders/1ouMFUaN8jH8vUa8VN8xtN5qIWeaL2NJB

 The University of Alabama in Huntsville
~ 08/29/2019 ~

Read Digital Input

Description of Test​: The PLC returns a binary value from the digital input memory.
Function Code ​0xA2 File Type ​0x8C File Number ​0x01
Ladder Logic File​: alltest.st
AdvancedHMI Interface Components List:

● Driver – EthernetIPforSLCMicroCom1
● Basic Indicator – Reads from the Address either a 1 or 0
● Basic Button ON – Writes a 1
● Basic Button OFF – Writes a 0

Drive Location:​ ​https://drive.google.com/drive/folders/1ouMFUaN8jH8vUa8VN8xtN5qIWeaL2NJB

Read Integer
Description of Test for Analog​: The PLC return an integer value from memory.
Function Code ​0xA2 File Type ​0x89 File Number ​0x07
Ladder Logic File​: alltest.st
AdvancedHMI Interface Components List: ​Integer (Bottom Four Labels)

● Driver – EthernetIPforSLCMicroCom1
● Basic Label – Keypad -> Double Click Label “Int1” (Writes)
● Basic Label – Keypad -> Double Click Label “Int2” (Writes)
● Basic Label – Number Display Above Int1 -> Int1 Value (Reads)
● Basic Label – Number Display Above Int2-> Int2 Value (Reads)

Drive Location:​ ​https://drive.google.com/drive/folders/1ouMFUaN8jH8vUa8VN8xtN5qIWeaL2NJB

 The University of Alabama in Huntsville
~ 08/29/2019 ~

Read Float
Description of Test for Analog​: The PLC return a floatr value from memory.
Function Code ​0xA2 File Type ​0x8A File Number ​0x08
Ladder Logic File​: alltest.st
AdvancedHMI Interface Components List: ​Floating Point (Top Three Labels)

● Driver – EthernetIPforSLCMicroCom1
● Basic Label – Keypad -> Double Click Label “Float1” (Writes)
● Basic Label – Number Display Top Left -> Float1 Value (Reads)
● Basic Label – Number Display Top Right -> Float1 Value + 10.0 (Reads)

Drive Location:​ ​https://drive.google.com/drive/folders/1ouMFUaN8jH8vUa8VN8xtN5qIWeaL2NJB

Write Digital Output

Description of Test​: The PLC stores a binary value into digital output memory.
Function Code ​0xAB File Type ​0xAB File Number ​0x00
Ladder Logic File​: alltest.st
AdvancedHMI Interface Components List: analogint.st

● Driver – EthernetIPforSLCMicroCom1
● Basic Indicator – Reads from the Address either a 1 or 0
● Basic Button ON – Writes a 1
● Basic Button OFF – Writes a 0

Drive Location:​ ​https://drive.google.com/drive/folders/1ouMFUaN8jH8vUa8VN8xtN5qIWeaL2NJB

 The University of Alabama in Huntsville
~ 08/29/2019 ~

Write Integer
Description of Test for Analog​: The PLC stores an integer value into memory.
Function Code ​0xAA File Type ​0x89 File Number ​0x07
Ladder Logic File​: alltest.st
AdvancedHMI Interface Components List: ​Integer (Bottom Four Labels)

● Driver – EthernetIPforSLCMicroCom1
● Basic Label – Keypad -> Double Click Label “Int1” (Writes)
● Basic Label – Keypad -> Double Click Label “Int2” (Writes)
● Basic Label – Number Display Above Int1 -> Int1 Value (Reads)
● Basic Label – Number Display Above Int2-> Int2 Value (Reads)

Drive Location:​ ​https://drive.google.com/drive/folders/1ouMFUaN8jH8vUa8VN8xtN5qIWeaL2NJB

Write Float
Description of Test for Analog​: The PLC stores a float value into memory.
Function Code ​0xA2 File Type ​0x8A File Number ​0x08
Ladder Logic File​: alltest.st
AdvancedHMI Interface Components List: ​Floating Point (Top Three Labels)

● Driver – EthernetIPforSLCMicroCom1
● Basic Label – Keypad -> Double Click Label “Float1” (Writes)
● Basic Label – Number Display Top Left -> Float1 Value (Reads)
● Basic Label – Number Display Top Right -> Float1 Value + 10.0 (Reads)

Drive Location:​ ​https://drive.google.com/drive/folders/1ouMFUaN8jH8vUa8VN8xtN5qIWeaL2NJB

 The University of Alabama in Huntsville
~ 08/29/2019 ~

Figure 1: Reading Digital Inputs & Outputs with LED Indicators. Writing Digital Outputs with
push buttons

Figure 2: Response to a Read Input Logical by Slot request for 2 bytes. The first 3 least
significant bits are all set to 1. (Notice the little endian format of the two bytes)
 The University of Alabama in Huntsville
~ 08/29/2019 ~

Figure 3: Reading Integers along the top row. Writing an integer value with the keypad.

Figure 4: Response to Read Integer with for 12 Bytes.

 The University of Alabama in Huntsville
~ 08/29/2019 ~

Figure 5: Reading Floats along the top row. Writing a float value with the keypad.

Figure 6: Writing a Float value.