A City Where Bad PLC Code Made Cars Crash

While working at CrySyS¹, the cybersecurity research group at my first university, I got the fun job of simulating a small city. The lab was preparing a hacking challenge targeting PLCs that controlled traffic lights, so a successful attack would cause mayhem on the roads.

I built it in Unity². C# scripts controlled the drivers, the driving model looked realistic while remaining predictable, and a REST API exposed the traffic lights for remote control. The drivers obeyed the lights unconditionally, tunnel vision and all. That was the point: faulty control logic led to disaster on screen.

The art was on me too, so I ended up watching a bunch of Blender Guru³ tutorials and modelling everything in a low-poly style. Far too much of that time went into trying to get the animations right; they weren’t great, but they looked passable from a distance.

The venue was large, with screens dotted around it, which added one final challenge: netcode. The whole simulation ran on the server, while each screen acted as a thin client that extrapolated from the latest state it had received.