Malicious Manipulation of the Setpoint in the Temperature Control System of a Heating Process Based on Resistive Electric Heating

This article presents the potential for maliciously influencing a control system by interfering with the program code of an industrial controller, using a temperature control system for a heating process based on resistive electric heating as an example. The presented attack scenarios are crucial for the energy efficiency of electric heating systems, which is related to the issue of cybersecurity in the area of energy security. The aim of this research was to demonstrate that a cyberattack involving the malicious manipulation of the setpoint can be carried out in a manner invisible to the heating process operator and be difficult to detect using classical time-domain control quality indicators (time-response specifications). The first involves incorporating proportional elements with mutually inverted gains into the input and output of a closed-loop system. The second method is based on adding an additional transfer function G_m(s) in parallel to the control system. The difference between the correct and manipulated setpoints is introduced into the input, and the output signal is added to the actual (hidden) value of the controlled variable. In the first method, at the moment of starting the control system, there is a difference between the apparent (falsified) value and the ambient temperature. In the second method, the inclusion of an additional G_m(s) ensures that the apparent (falsified) value of the controlled variable matches the temperature at the moment of starting the system. PID control enables achieving satisfactory control quality in heating processes, which are characterized by high inertia and time delays. Compared to classical PID regulation, advanced control methods can, under certain conditions, provide better performance in terms of quality indicators. However, due to their high computational complexity and sensitivity to model uncertainty—particularly in methods relying on accurate system identification—PID controllers continue to be widely used in industrial practice. For this reason, the present study focuses on a control system based on a PID controller as a practical solution. Based on the results, it was found that the most effective manipulation occurred within the range from 0.9 to 1.1 of the actual setpoint value for both the first and second method, using a model with (Formula presented.) between 5 s and 30 s. In these cases, the quality indicators referenced to the nominal values, determined for the falsified control system responses to a step change in the setpoint, were as follows: overshoot—0.97 and 1.30 (method 1), and 0.90 and 1.10 (method 2 for 5 s), 0.75 and 1.30 (method 2 for 30 s); settling time—1.06 (method 1), and 0.98 and 1.17 (method 2 for 5 s), 0.85 and 1.14 (method 2 for 30 s). The settling times determined for the system’s response to a disturbance were: 1.00 and 1.15 (method 1), and 1.13 and 1.16 (method 2 for 5 s), 1.12 and 1.02 (method 2 for 30 s). Based on the conducted analysis, it was demonstrated that the relatively simple setpoint manipulation methods presented can effectively mask the impact of malicious interference on the temperature value in the control system of a heating process.