MandGardOASIS

OASIS — command authority for PLCs and controllers

Only authorised commands reach the machine.

OASIS is software placed between the supervision system and the controllers already in place. It checks every write command and only forwards those that are authorised and within the limits set by the operator. Neither the controllers nor the supervision software are modified.

Watch the live demonstration, 2 min 30Request a pilot

Nature
Software, no proprietary hardware
Scope
Write commands to PLCs and controllers (Modbus TCP)
Position
Outside the safety chain: replaces no safety function
Existing Supervision HMI / SCADA
MandGard OASIS checks every write command
  • ✓compliant: forwarded
  • ×out of bounds or unauthorised: refused and recorded
Existing PLC, controller program unchanged
Example: a cold room bounded by the operator's limits. A −20 °C setpoint is forwarded; a +50 °C setpoint is refused, whatever its origin.
01 — Context

Recent attacks go through the legitimate interface.

Recent industrial attacks do not bypass protocols: they take control of the supervision system and send commands that are valid for the equipment but harmful to the installation. In October 2026, the French national CERT reported numerous compromises of refrigeration installations controllable from the Internet (alert CERTFR-2026-ALE-012).

  1. 01

    The firewall does not know who issues the command.

    It filters addresses and protocols. A command from the legitimate supervision comes from the right machine: it can neither identify the operator nor require a second person's approval.

  2. 02

    Manufacturer ranges do not protect the installation.

    On several common refrigeration controllers, accepted ranges go up to +50 °C for a setpoint or a defrost-end temperature. What is valid for the device can destroy the stock.

  3. 03

    Detection comes after execution.

    A passive probe raises an alert once the command has run. OASIS refuses the command before it reaches the equipment.

02 — Guarantees

Four guarantees, proven on real equipment.

We describe what the software guarantees, not how it is built. Technical detail is shared under a non-disclosure agreement.

01

Operating envelope

Every setpoint must stay within the limits set by the operator and change only in authorised steps. A forged, altered or replayed command is refused.

02

Two-person rule

Critical commands require the approval of two distinct operators. An attacker who controls the supervision cannot supply the second.

03

Tamper-evident log

Every command, forwarded or refused, is recorded with its author's identity when verified. Any alteration of the log is detectable. It provides evidence for NIS2 audits and insurers.

04

Post-quantum cryptography

Commands sent to OASIS are encrypted with post-quantum cryptography based on NIST standards, designed to withstand quantum computers.

03 — Fields of application

Wherever a supervision system writes to equipment.

Sector Equipment Example of a refused command
Cold chain EquipmentMachine-room PLCs, compressor panels, cold-room controllers Example of a refused commandSetpoint pushed to +50 °C; forced defrost outside procedure
Water and infrastructure EquipmentPumping and treatment PLCs, pump drives, valve actuators Example of a refused commandValve opened from 20 % to 100 % in a single command; pump setpoint out of range
Energy EquipmentPlant controllers, inverters, generation and storage PLCs Example of a refused commandUnauthorised curtailment to 0 %; power factor out of range
Industry and pharma EquipmentLine PLCs, cleanroom air handling, server-room cooling Example of a refused commandAbrupt change of a pressure, temperature or speed setpoint

Compatibility: Modbus TCP. During pilot scoping, each device's compatibility is checked and every other access to the controller is listed: OASIS protects the path through which the supervision writes.

04 — Evidence

What we claim has been measured.

Real equipment
Tests against a commercial Siemens LOGO! logic module, physical relay included: an authorised command drives it, a refused command leaves it still.
8 h
of endurance against the real controller: 5,652 cycles, no refused command reached the equipment.
4
real power cuts under load: after each restart, the log verifies intact.
7,800+
evidence items archived.

The core decision rules are formally verified. The full evidence file is available under a non-disclosure agreement.

Siemens and LOGO! are trademarks of Siemens AG; they are named to describe the test equipment and imply no partnership.

05 — Demonstration

Live demonstration on a real Siemens LOGO! controller — 2 min 30.

Recorded on 5 November 2026 against a commercial Siemens LOGO! logic module, unmodified, physical relay included. Cold-room scenario: −20.0 °C setpoint, operating limits from −25.0 to −15.0 °C, defrost subject to two approvals. Every value shown is read directly from the controller.

Silent video, captions burned in.

  1. 01Without MandGard, an unsigned +50.0 °C write reaches the controller.×Applied
  2. 02MandGard becomes the only path in: an operator restores −20.0 °C with a signed command.✓Executed
  3. 03The same unsigned write, now sent to MandGard. Nothing reaches the controller.×Blocked
  4. 04A hijacked supervision signs +50.0 °C with a valid operator key: outside the envelope.×Blocked
  5. 05A command signed with a key unknown to the site.×Blocked
  6. 06A read-only account asks for −18.0 °C, a value inside the envelope.×Blocked
  7. 07Normal work: the operator adjusts the setpoint to −21.5 °C.✓Executed
  8. 08The −20.0 °C command of step 2 is sent a second time.×Blocked
  9. 09Defrost requested with one approval out of the two required.×Blocked
  10. 10Defrost approved by operators A and B, two separate keys: the relay closes.✓Executed
  11. 11The decision log is copied and checked by an independent verifier.✓Intact
  12. 12On a copy, one refusal is rewritten as "executed": a single byte. The original stays intact.✓Detected

Result: 3 legitimate commands executed, 6 attacks blocked before the controller, no unauthorised change. The controller was not modified.

The log of this demonstration holds 12 records: 3 executions, 5 refusals, 3 device confirmations and one start record. The raw write of step 3 is rejected before any decision and therefore does not appear in it.

Siemens and LOGO! are trademarks of Siemens AG; they are named to describe the test equipment and imply no partnership.

06 — Pilot

A 30-day pilot, on a test bench or a chosen line.

The software sits between the supervision and the controller, without modifying the program of either.

  1. Week 1Scoping. Equipment in scope, operating limits, inventory of every access to the controller.
  2. Week 2Installation. Short intervention, planned in a maintenance window.
  3. Weeks 3 – 4Demonstration. Legitimate commands forwarded, out-of-bounds commands refused, log verified with your teams.
  4. Day 30Report. Success criteria agreed at the start and measured. The operator decides what follows: annual licence or termination.

Reversible

Removing the software restores the original link; nothing is changed in the controllers.

Outside the safety chain

Emergency stops and safety functions remain the machine's own. OASIS adds a layer and replaces nothing.

Confidentiality

Architecture, evidence file and in-depth demonstration are shared once a non-disclosure agreement is signed.

07 — Contact

For a demonstration or a pilot.

[email protected]