How Gas Turbines Like the GE MS5002E Are Controlled in OT Systems
Understanding PLC control, turbine physics, and OT security monitoring gaps in industrial gas turbines.
Industrial gas turbines such as the GE MS5002E are not IT systems. They are controlled physical processes governed by industrial automation systems.
These systems combine thermodynamics, mechanical engineering, and industrial control logic. The turbine itself operates based on physical combustion and rotational dynamics, while control decisions are managed by OT systems such as PLCs and HMIs.
Gas turbine process overview
In a typical industrial gas turbine:
Air is compressed by the compressor stage. Fuel gas is injected into multiple combustion chambers, where it mixes with compressed air and burns under controlled conditions. The resulting high-temperature gas expands rapidly and drives turbine blades.
This mechanical energy is transferred through two rotating shafts: - one shaft drives the compressor - the second shaft drives the external load
Typical operating speeds can reach approximately 5,700 RPM and 7,400 RPM depending on system configuration.
The turbine is often divided into two functional sections: - High Pressure Turbine (HPT), which supports compressor operation - Low Pressure Turbine (LPT), which drives external load output
PLC-based control system
Gas turbines are not manually controlled. They are managed by Programmable Logic Controllers (PLCs) executing control loops in very short cycles, often every 10 milliseconds.
The PLC continuously: - reads sensor data such as temperature, pressure, and rotational speed - adjusts fuel valves and airflow systems - regulates guide vanes and combustion parameters
Human Machine Interfaces (HMIs) provide operators with a simplified view of system status, often showing the system as "normal" even during complex internal state changes.
OT security and monitoring layer
In modern OT environments such as gas turbine control systems, the PLC defines operational behavior, not the turbine itself. The control system determines what is considered safe, normal, or abnormal.
In Labshock Gasflow Terminal, this type of industrial process is simulated to study OT security behavior in realistic conditions.
The focus is not on attacking the turbine directly, but on evaluating the surrounding OT infrastructure: - PLC logic - HMI interaction - monitoring and logging systems
This allows simulation of operational scenarios where commands are issued, system states change, and control logic reacts dynamically.
Key OT security challenge
A major issue in industrial environments is the gap between control systems and monitoring systems.
While the process continues to operate normally, OT Security Information and Event Management (OT SIEM) systems may show limited visibility: - lack of clear alerts during state changes - insufficient detection of command sequences - limited understanding of operator actions
Security gap in industrial control systems
The core issue is not system failure, but lack of verification: - control systems execute commands correctly - monitoring systems fail to fully interpret system behavior
This creates a visibility gap between operations and security monitoring.
OT security requirement
Modern OT security must validate the control layer itself, including: - who sends control commands - who changes system states - how these changes are logged and interpreted
OT security must evolve from passive observation to active validation of industrial control behavior.
Security in OT environments must be testable, not only documented.
Summary
Industrial gas turbines like the GE MS5002E demonstrate why OT systems require a combined understanding of physical processes and control logic.
Security cannot focus only on network data. It must include validation of control behavior, system state changes, and operational decision flows.
This is the direction of modern OT cybersecurity and OT SIEM design.