Aviation Runway Lights Management Simulation System

This article will give a general introduction of the Mini OT Aviation CAT-II Airport Runway Lights Management Simulation System , It is a compact cyber twin platform developed to simulate the PLC based operations of a Category II airport precision instrument runway lighting control system. Currently I have released the version v_0.0.1. As I am not an expert in aviation field, some info of this article may not accuracy, if there is any thing need to improve or correct, please feel free to contact me.

Project Design Purpose :

The aviation system is a critical pillar of modern transportation infrastructure, integrating complex networks of airports, aircraft, air traffic control systems, and supporting digital technologies. As the sector increasingly adopts interconnected complex OT and IT systems, it becomes an attractive target for cyber threats.

According to the International Civil Aviation Organization (ICAO) Aviation Cybersecurity Report, cyberattacks on the aviation sector have grown in frequency and sophistication. These threats affect a wide range of aviation systems, including aircraft avionics, airport SCADA systems, airline IT infrastructure, and supporting services such as private jet operations and supply chain management.

This project specifically focuses on a critical subset of aviation airport OT infrastructure—the airport runway control system, which is managed by the Air Traffic Control (ATC) tower. The purpose is to design and develop a cyber twin platform to simulate three SCADA systems (Runway Lights, Airport Radar and VHF Radio Comm) and show how cyber threats targeting these runway SCADA systems may disrupt air traffic operation.

# Author:      Yuancheng Liu
# Version:     v_0.0.1
# Created:     2025/06/16
# Doc_Copyright:   Copyright (c) 2025 LiuYuancheng

Introduction

The Mini OT Aviation CAT-II Airport Runway Lights Management Simulation System is a compact cyber-physical simulation platform developed to simulate the operations of a Category II airport precision instrument runway lighting control system. Designed for cybersecurity exercises, technical training, and educational purposes, this system provides a cyber twin platform that mimic the realistic civilian land-based airport CAT-II runway environment including three key SCADA systems relevant to ATC tower operations.

CAT-II Runway Lights Management System : The core system simulate 11 types of tower controlled runway lights and visual indicators (such as ILS and ALS) for guiding aircraft during takeoff, landing, and taxiing operations.
Weather and Aircraft Tracking Radar System : The minor assistant system simulate weather radar and aircraft position tracking radar and the tower radar data monitor system.
VHF Radio Communication System : The minor assistant system simulated VHF pilot-tower communications.

To enhance realism and interactivity, the system includes a scripted aircraft behavior module, which provides multiple virtual airplanes follow standard ATC decision-making logic (such as the ATC manual from CAAS ) based on the lighting, radar, and radio subsystems' information.

The system usage demo video is shown below:

The simulation is structured across multiple levels (level0 to level3) of the OT-System environment , the main objectives include:

Demonstrate the potential impact of cyberattacks on a single OT/SCADA system and how it can cascade to disrupt airport operations or service.
Support OT cyber exercises, professional training, and awareness programs in aviation and critical infrastructure protection.
Provide a cost-effective, scalable, and simplified simulation platform suitable for labs, academic institutions, and cyber events.

Intended Use Cases of the project:

Cybersecurity training and exercises for aviation infrastructure operators, defenders, and students.
Technical demonstration platform for cyber risk awareness in OT-controlled airport systems.
Testbed for security researchers to simulate real-world OT vulnerabilities in aviation SCADA systems.
Support for OT-ICS curriculum in academic or professional development settings.

Main Reference : All the technology used follow the FAA air traffic publications' "General Information" section https://www.faa.gov/air_traffic/publications/atpubs/aim_html/

System Structure

The simulation system is structured across multiple levels of the OT environment—from Level 0 physical processes to Level 3 Operations Management Zone. It mirrors the real-world functional and network architecture of airport runway light control systems, integrating SCADA operations, field devices, and data management services. The system follows a layered OT model, spanning from Level 0 (physical I/O devices) to Level 3 (operations management zone), allowing users to test and analyze both normal operations and cyber-compromised scenarios.

The system structure diagram is shown below :

OT-Level 0: Physical Process Field I/O Devices

In this level, the system simulates the physical world of the airport runway using a game-like environment that models the interactions between aircraft, runway lights, radio comm and radar sensors. It acts as the virtual field layer and includes:

ALS (Approach Lighting System) lights
ISL (Intermediate Stage Lighting) and taxiway indicators
Aircraft tracking radar, weather radar, and runway surface movement radar
VHF communication antennas and broadcast systems

These components receive simulated electrical control signals from next Level 1 PLCs and return virtual feedback signals, such as light status, radar echo data, or VHF communication messages.

OT-Level 1: OT System Controller LAN

This level emulates the industrial controller network using six simulated PLCs and one radar data processor. The components and their roles include:

Runway Power and State PLCs (W & E sides): Simulate ABB AC500 PLCs that control power supply and light status (ALS, ISL, taxiway, and zone lights) on runway
Tower Control PLC: Manages supporting systems such as VHF antennas, building obstruction lights, and airport beacon towers.
Radar Control PLC: Controls the radar systems including weather, aircraft tracking, and surface radar.
Radar Processor (Simrad radar simulation): Simulates the data acquisition from radar units and processes outputs as digital radar echo "spoke" data.

All devices communicate using simulated high-frequency UDP signals representing electrical states to bridge the lvl0 virtual physical field and lvl1 layer OT controllers.

OT-Level 2: Runway Control Tower Processing LAN

This level represents the operation in Runway ATC (Air Traffic Control) tower, equipped with different human-machine interfaces (HMIs) and processing workstations:

Runway Light Control HMI: Allows operators to issue light power and state change commands and monitor runway light status in real time. Communication with PLCs uses the IEC 60870-5-104 protocol.
Airport Surveillance Radar HMI: Displays radar tracking data (aircraft height, speed, position), weather overlays (cloud coverage, wind data), and surface movement detections.
VHF Radio Simulation Panel: Shows simulated ATC communications between tower and pilot agents (such as the channel state).
Maintenance Workstations: Used for system diagnostics, configuration, and SCADA event logging.

This level forms the main control and monitoring interface used by simulation participants.

OT-Level 3: Operations Management Zone

This level simulates the airport's back-end operations data zone, which supports:

Runway OT Data Management Server: Central server for live OT system monitoring and data retrieval.
OT Historian Data Server: Archives raw OT data such as PLC logs, radar data packets, and simulated VHF audio communications.
Intermedia Database Server: Provides structured access to runway operational records for IT or analytics teams.

This layer supports data-driven decision-making, incident analysis, and reporting as part of training or red-blue team simulation scenarios. I will also integrate the runway surveillance camera system in this layer.

System Modules Overview

The current release (v_0.0.1) of the system is built around three core simulation modules that together replicate a realistic airport runway OT environment:

2D Physical World Visualization Module: This module provides a top-down view 2D visualization of the airport layout, simulating the physical-world behavior of runway lights, aircraft movements, and taxiing operations. It visually represents takeoff, landing, holding and ground navigation, offering users an intuitive interface to observe the effects of control system actions in real time.
PLC Controller Simulation Module: This module simulates key OT components such as PLCs and radar control units. It manages the virtual electrical signal exchange between the physical layer (Level 0) and the control systems (Level 1), enabling accurate simulation of lighting systems, radar activation, and communication subsystems.
Tower SCADA-HMI System Module: Serving as the tower main control interface, this module includes HMIs for runway light control, radar monitoring, and VHF communication. It allows users to issue control commands, monitor system states, and simulate supervisory tower operations under both normal and adversarial conditions.

The future versions will expand the system’s adding the radar echo spoke signal simulation, enhancing the fidelity of aircraft tracking and weather monitoring features.

2D Physical World Visualization

The 2D Airport Runway Physical World Visualization module is a central component of the simulation system, offering a game-like interface with a top-down view of a CAT-II precision instrument runway environment. Designed to resemble a real-world airport layout, it provides users with a detailed visual representation of aircraft movement, runway lighting behavior, and radar surveillance zones—essential for understanding operational and security aspects of runway management. For each simulated aircraft and environmental object is dynamically linked to OT data—allowing users to observe and analyze how PLC commands and HMI operations affect physical-world behavior.

The interface is designed for clarity, providing color-coded lights, aircraft icons, radar arcs, and airport signage symbols consistent with two international standards:

The lighting layout and configurations follow Category II runway lights standard (FAA Order 8400.13 and ICAO Annex 10) link
The sign, icon, marking and alert signal on the runway follows the precision instrument runway standard. link

The 2D Physical World Visualization Program UI is shown below:

This module simulates both the physical environment and the dynamic behavior of the aircraft, runway lights, and surveillance systems. Three core features are simulated in this program:

Real-Time Aircraft Simulation

The system simulates up to 15 unique aircraft flight patterns across four altitude levels will different aircraft speed and attitude configuration (Roll, Pitch, Yaw, COG) , including realistic transitions between:

Level 4 Height (Above 15,000 ft) – Airport area entry patterns ( max 265 KIAS)
Level 3 (6,000–14,000 ft) – Holding patterns (max 230 KIAS)
Level 2 (1,000–6,000 ft) – Flight circuit patterns such as upwind, crosswind, downwind, base leg, final approach, and emergency go-around (max 200 KIAS)
Level 1 (Ground–1,000 ft) – Detailed ground operations: taxiing, pre-takeoff, rotation, climb, and post-takeoff transitions

The user can select display the simulated components on different height level in the display selection panel:

Each aircraft’s simulated behavior dynamically affects and responds to system variables such as lighting commands, radar inputs, and virtual communication cues at the specific "check area" in the program. When the aircraft entering the check area, it will simulate the VHF radio communication with the tower and select the relate pattern with the correct speed and height, if it is height level 1, 2, 3, the program will simulate pilot check the runway light to confirm the state and make decision. The visualization also generates simulated CDI (Course Deviation Indicator) and HSI (Horizontal Situation Indicator) values based on aircraft heading, attitude, and speed, offering a pilot-level navigational experience.

Runway Light and Indicator Simulation

On the program runway the visualization integrates 11 categories of CAT-II precision runway lights and indicators, following real-world lighting specifications as shown below:

[1] Civilian Airport Beacon: Helps pilots identify airport location and assists ATC tower operator in evaluating SMR alerts (e.g., bird flocks or drone activity).reference link
[2] ALS Approach Bar Lights: Crossbar lights on the centerline for aiding final instrument approach. reference link
[3] Runway Caution Zone Indicator: Yellow lights indicating shortened runway areas for safe landing assessments or highlight emergency situation.
[4] Runway Edge Lights: White boundary lights enhancing visibility during low-visibility conditions.
[5] Precision Approach Path Indicators (PAPI): Provides glide slope guidance to prevent descent anomalies.reference link
[6] Runway Extension Lights: Extends visual reference along runway ends during takeoff or landing.
[7] Airport Obstruction Lights: Marks hazardous objects or structures near the runway in the airport area.
[8] Taxiway Centerline Lights: Embedded green lights guiding aircraft safely along taxi paths.reference link
[9] Taxiway Clearance Bar Lights: Indicate holding or intersection points on taxi way, enhancing runway incursion prevention.
[10] Runway Threshold Lights: Green unidirectional lights marking the usable landing threshold.
[11] Takeoff Hold Lights: Integrated with the RWSL system to prevent premature takeoff or runway entry.

Each lighting element is controlled via simulated PLCs in coordination with the tower HMI and monitored for operational states and anomalies.

Radar System Integration

Three types of Airport Surveillance Radar (ASR) systems are visually represented and interact with the aircraft movement in real time:

Aircraft Tracking Radar – Simulates aircraft detection and tracking at all flight height levels.
Weather Monitoring Radar – Displays localized weather events (e.g., wind, clouds, storms) on height level 2 and 3 for tower-based decision-making.
Surface Movement Radar (SMR) – Monitors objects and activity on the ground (e.g., bird flocks, rogue drones) under height level1 and generates alerts for runway incursions.

These radar inputs support scenario development, training, and OT cyber threat simulations involving manipulated or spoofed sensor data.

PLC Controller Simulation Module

The PLC Controller Simulation Module is a critical part of the system architecture, emulating the behavior of industrial-grade controllers used in real-world airport OT systems. In this simulation, I use the IEC 60870-5-104 protocol PLC simulator module https://www.linkedin.com/pulse/python-virtual-plc-simulator-iec-60870-5-104-protocol-yuancheng-liu-bov7c I developed before to simulate part of the basic function of the ABB AC500 PLC (https://www.abb.com/global/en/areas/motion/plc/programmable-logic-controllers/ac500), The PLC simulation framework is responsible for receiving control requests from tower SCADA HMIs, executing logic functions (LD/ST), monitoring field states via simulated electrical signals, and reporting status values back to the HMI.

Controller Structure and Simulation Roles

Each runway light or indicator are managed by two types of PLCs:

Power Control PLC:

Controls the power supply to specific lights or subsystems.
Monitors electrical states such as voltage, current, and operational status.
Requires indirect control via the Power HMI, with multi-step safety confirmation for activation or shutdown.
Cannot be directly manipulated from the main runway light HMI.

State Management PLC:

Controls operational parameters of the lights (e.g., color, intensity, flash mode).
Communicates directly with the Runway Light Control HMI.
Enables dynamic runway light adjustments based on ATC operations or simulation scenarios.

PLC Control Workflow

The control workflow between the PLCs and other system components is illustrated in the diagram below:

Each PLC reports its measured values (e.g., M_SP_NA, M_DP_NA, M_ME_NB) and receives control commands (C_SC_NA, C_RC_NA) through a consistent internal mapping structure. These values are dynamically visualized in the simulation, allowing users to observe both physical state changes and digital signal exchanges.

Workflow Components:

Input Map Module receives real-time control signals from the HMI (via IEC104 Client).
Memory Management Module stores both measured points (e.g., power status, radar feedback) and changeable points (e.g., on/off commands, brightness).
Ladder Logic / Structured Text Calculation Module performs internal logic operations based on industrial automation standards or overload control.
Output Map Module converts internal results into simulated analog/digital electrical signals, sent to Level 0 field I/O devices via high frequency UDP message to simulate the electrical signal changes.

PLC-HMI and Device Mapping

In the current version (v_0.0.1), the system implements six virtual PLCs that communicate with the 2D Physical World Visualization Module and SCADA HMIs as shown below:

Each PLC is mapped to specific airport subsystems:

PLC Name	PLC_ID	Controlled Elements	Linked HMI
West Runway Power PLC	PLC-01	ALS, ISL, zone lights, and taxiway indicators (Runway 12 - West)	Tower’s Power Control HMI
East Runway Power PLC	PLC-02	ALS, ISL, zone lights, and taxiway indicators (Runway 23 - East)	Tower’s Power Control HMI
West Runway State PLC	PLC-03	ALS, ISL, zone lights, and taxiway indicators state (color, intensity, flash) on Runway 12	Runway Light Control HMI (Runway 12 tab)
East Runway State PLC	PLC-04	ALS, ISL, zone lights, and taxiway indicators state (color, intensity, flash) on Runway 23	Runway Light Control HMI (Runway 23 tab)
Runway System Control PLC	PLC-05	Runway beacons, edge lights, VHF antenna, obstruction lights, broadcast system	Runway System Control HMI
Radar System Control PLC	PLC-06	Aircraft tracking radar, weather radar, surface movement radar, radar tower power	Radar HMI Control Panel

Tower SCADA-HMI System Module

The Tower SCADA-HMI System is the supervisory layer of the Mini OT Aviation CAT-II Airport Runway Lights Management Simulation System. It provides interactive monitoring and control over all airport runway lighting and radar subsystems through a set of integrated Human-Machine Interfaces (HMIs) connected to six Programmable Logic Controllers (PLCs) via four types of OT communication buses, as shown below:

HMI–PLC Communication Buses:

System Control Bus (IEC-104): Controls system and subsystem power state (on/off) via the System Control HMI [ HMI program under editing(v_0.0.1), currently it is set as a tab under the light HMI, later I will split it out as one individual HMI].
Light State Control Bus (IEC-104): Manages all 11 types of runway lighting elements from the Runway Light HMI.
Radar Antenna Control Bus (IEC-104): Switches 3 types of radar antennas' modes (e.g., standby or active transmission) through the Radar Control HMI and control the radar tower.
Radar Data and Function Bus (BR24 and Simnet protocols): Transmits radar echo spoke data and enables advanced radar control, including aircraft tracking and radar range adjustment.

Tower’s Runway Light Control HMI

The Runway Light Control HMI offers a visual, modular interface to manage aircraft lighting during takeoff, landing, and taxiing operations. The user interface is shown below:

It features three key control panels:

West Approach (Runway 12) Panel: Controls the Approach Lighting System(ALS) for aircraft landing on Runway 12.
East Approach (Runway 23) Panel: Controls Approach Lighting System(ALS) for aircraft approaching from the opposite direction, Runway 23.
Main Runway & Taxiway Panel: Displays current runway state and lighting status. It allows operators to guide landed aircraft toward terminals and direct takeoff-ready aircraft to their correct runway entry points. It also includes adjustable brightness control for runway and taxiway lights.

Airport Surveillance Radar Control and Monitor HMI

The Radar Control and Monitor HMI serves as the visual and functional interface for radar subsystem management and aircraft situational awareness. The user interface is shown below:

Key features include:

Radar Echo Visualization: Displays radar echo spoke images while highlighting tracked aircraft positions in real time.
Radar Operational Control: Offers toggle controls for radar standby mode, transmission activation, and range adjustments.
Aircraft Height Monitoring: Charts and compares aircraft height detected by radar against the height reported via VHF communication, supporting anomaly detection and redundancy validation.

Summary

In conclusion, the Mini OT Aviation CAT-II Runway Lights Management Simulation System delivers a critical capability for aviation cybersecurity preparedness. By accurately replicating the interdependencies between runway lighting, radar, and communication SCADA systems within a layered OT architecture, this cyber twin platform enables realistic modeling of cascading failure scenarios stemming from cyberattacks. Its game-like 2D visualization, PLC emulation, and tower HMI interfaces provide an accessible yet technically rigorous environment for training infrastructure defenders, testing vulnerabilities, and demonstrating cyber threat impacts.