## 5 Topology and Overload Detection
### Overload Detection Results
The capture highlights the data exchange between source node 202.30.106.245 and multiple destination addresses, including IP: 68.180.217.31 and the broadcast domain IP: 202.30.106.255, across multiple protocols such as NBNS (NetBIOS Name Service) and TCP. This analysis provides critical insights into the behavior of the system under real-time conditions. The lower pane of Figure 9 shows detailed protocol dissection for Frame 55, indicating the use of the transmission control protocol (TCP) over port 1235 (e.g., source) and port mmcc (e.g., destination). The TCP segment contains control flags (ACK) with sequence and acknowledgment numbers, reflecting a completed or in-progress transmission handshake. Notably, the packet is marked with checksum errors (as highlighted in the red-colored line), which could signify degraded link quality, buffer overflow, or packet corruption--conditions that are especially important to detect in control system environments. The captured traffic also includes NBNS name queries, which serve to  
Figure 9: Screenshot of TDLP simulation results. resolve hostnames within the local network and validate broadcast-level communication among sub-stations. This set of data, collected using the TDLP protocol and visualized via SSTM, confirms that system nodes are actively transmitting identifiable traffic and can be individually tracked for utilization metrics. Thus, the figure supports the broader aim of this study by demonstrating how packet-level inspection assists in overload detection, traffic profiling, and real-time monitoring of distributed DCS nodes. The conventional logic algorithm demonstrated limited diagnostic capability in identifying the root cause of system overload, as the segment control function code merely represented cumulative CPU utilization without isolating contributions from individual functional components (as shown in Figure 2). To address this limitation, we propose a novel overload detection logic algorithm leveraging the non-functional processor (NFP) segment, which enables fine-grained visibility into the internal load distribution of the DCS. The development of the proposed overload detection logic proceeds through the following structured methodology:  
1. The Token Bus protocol is employed as the underlying communication mechanism to enhance both the determinism and stability of internal DCS communications, which is critical for maintaining synchronization and reliability in real-time control environments. 2. DCS architectures utilize a variety of function codes, each performing discrete control operations. When instantiated, each function code is dynamically assigned a unique block number. For example, if a particular function code is invoked ten times, it is assigned block numbers sequentially from 1 to 10. 3. These assigned block numbers are systematically partitioned into eight logical groups based on their expected execution times. This classification facilitates balanced load analysis and enables the mapping of grouped block executions to discrete processing pathways. 4. Each group is subsequently interfaced with a dedicated NFP segment, allowing for real-time monitoring and isolation of computational loads associated with each group. 5. Finally, the outputs of the NFP segments are aggregated via three summation logic units to compute total utilization across grouped segments, enabling the detection of overload conditions with higher specificity and temporal accuracy (as shown in Figure 9). Figure 10 illustrates the architecture of the proposed overload detection logic algorithm using a segmented monitoring structure based on block sequence numbers within a DCS. The diagram demonstrates how execution blocks--each associated with a specific range of sequence numbers--are monitored individually and aggregated for system-level resource analysis. Each box on the left represents a segment processor responsible for collecting CPU and memory utilization data from a specific range of function code sequence numbers.