Network Blackout and MARK

VI/VIe Vulnerabilities
Presented By
OMRAN M. Al-Majid
Lead Control Engineer

10 May 2018 LAST PREVIOUS NEXT

OUTLINE
• Introduction.
•Network Blackout
•Measures Taken to Restore the Network
•Possible Reasons to Blackout
•Recommendations
•Vulnerabilities of MARK VI/VIe
•Proof.

2 FIRST PREVIOUS NEXT

Introduction

6 Power Blocks Total Power (4300 MW)

 Block (3 Gas Turbine x 3 HRSG x 1 Steam Turbine).
 Gas Turbine 7FA General Eclectic.
 Heat Recovery Steam Generator ( DOOSAN).
 Steam Turbine D-11 General Eclectic.
 Balance of Plant
 Gas Area, Liquid Fuel, MSF and Intake Area…..etc.

3
Control System

 Unit Control.
 MARK VI (Block1 to 5).
 MARK VIe (Block 6).
 DCS
 MARK VIe

4
QCCPP Network Overview

Power
Blocks

EPRIS SCADA

DCS
Balance OSM
of Plant

5
 THE INCIDENT

6
 MOST of HMI !!!!!!!!!!!!!!!!!!!

7
Cont. Incident

 114 HMIs are Black and No data on them.

 NO command can be issued from Most of
HMIs.
 4 Blocks where Running around (2800 MW)
 TWO HRSG where trip only.
 All other Units working normally.

8
 CAUSE

9
 ONE CARD OF BLADE SWTICHE 172 DAMAGE

10
Blade Switches 171/172

11
 ANALYSIS AND
RECOMMENDATIONS

12
Network Configration

13
After The Incident

14
Recommendation

 Replace any Enterays Switches N series

(End Life Product).
 Don’t Use EGD signals for Controlling.
 Keep a backup laptop which have Cimplicity
on it.

15
 MARK VI/VIE VULNERABILITIES

16
Control File
 The Control file of any GE unit divided on
two part:
 Custom Part.
 Unit Part.

 MOST of Unit Part is protected with LEVE 3

and 4 Password. CAN IT CHANGE ??

17
 PROOF MARK VIE
TRIP LOGIC BEFORE TRIP LOGIC AFTER

18
 PROOF MARK VIE
TRIP LOGIC BEFORE TRIP LOGIC AFTER

19
 PROOF MARK VI
TRIP LOGIC Before TRIP LOGIC AFTER

20
 Thank You

21