Sandbox-Enabled Digital Twin for Cyber-Physical Systems
For developers and testers of cyber-physical systems, this framework provides a more realistic validation environment by closing the loop between controller side-channels and plant feedback, addressing limitations of existing black-box or open-loop approaches.
The paper presents a closed-loop digital twin framework that integrates an unmodified controller binary within a Linux sandbox, rerouting I/O to an external plant simulator to capture synchronized side-channels and plant state. Demonstrated on an OpenPLC runtime with an IEEE 14-bus power-system model, the framework enables correlation of controller behavior with simulated plant events for improved observability.
Cyber-physical system (CPS) controllers are vulnerable to faults and malicious attacks, including failures triggered only under complex plant conditions, yet pre-deployment validation typically relies on plant models or digital twins that exercise the controller's I/O as a black box. Side-channels, used to detect those run-time behavioral anomalies, are complementary but also open-loop, detached from I/O instrumentation, and driven by synthetic inputs rather than realistic plant feedback. We present a closed-loop digital twin framework that bridges this gap by hosting an unmodified controller binary within the SaMOSA Linux sandbox with its I/O rerouted to an external plant simulator, allowing coupled capture of simulated plant conditions and events alongside the controller's behavioral side-channels. The framework captures four time-synchronized controller side-channels (hardware performance counters, system calls, disk activity, and network activity) alongside plant state, and uses orchestration hooks for repeatable, parameterized runs. We demonstrate the framework on an OpenPLC runtime executing a Structured Text control program against a Modbus-connected IEEE 14-bus power-system model, and also discuss the application to robotics systems. The captured side-channels correlate controller behavior with simulated plant events, establishing an observability foundation for online testing, coverage analysis, and anomaly detection in CPS controllers.