Background. Automation in production has become a necessity for producing companies to keep up with the demand created by their customers. One way to automate a process is to use a piece of hardware called a programmable logic controller (PLC). A PLC is a small computer capable of being programmed to process a set of inputs, from e.g. sensors, and create outputs, to e.g. actuators, from that. This eliminates the risk of human errors while at the same time speeding up the production rate of the now near identical products. To improve the automation process on the shop floor and the production process in general a special software system is used. This system is known as the manufacturing execution system (MES), and it is connected to the PLCs and other devices on the shop floor. The MES have different functionalities and one of these is that it can manage instructions. Theses instructions can be aimed to both employees and devices such as the PLCs. Would the MES suffer from an error, e.g. in the instructions sent to the shop floor, the company could suffer from a negative impact both economical and in reputation. Since the PLC is a computer and it is connected to the MES it might be possible to attack the system using the PLC as leverage. Objectives. Examine if it is possible to attack the MES using a PLC as the attack origin. Methods. A literature study was performed to see what types of attacks and vulnerabilities that has been disclosed related to PLCs between 2010 and 2018. Secondly a practical experiment was done, trying to perform attacks targeting the MES. Results. The results are that there are many different types of attacks and vulnerabilities that has been found related to PLCs and the attacks done in the practical experiment failed to induce negative effects in the MES used. Conclusions. The conclusion of the thesis is that two identified PLC attack techniques seems likely to be used to attack the MES layer. The methodology that was used to attack the MES layer in the practical experiment failed to affect the MES in a negative way. However, it was possible to affect the log file of the MES in one of the test cases. So, it does not rule out that other MES types are not vulnerable or that the two PLC attacks identified will not work to affect the MES. / Bakgrund. Automatisering inom produktion har blivit nödvändigt för att företag ska kunna tillgodose den efterfrågan som deras kunder skapar. Ett sätt att automatisera denna process är genom att använde en typ av hårdvara som på engelska kallas för programmable logic controller (PLC). En PLC är en liten dator som man kan programmera så att den bearbetar signaler in, från t.ex. sensorer, och skapar signaler ut, till t.ex. motorer, från det. Detta eliminerar då risken för mänskliga fel samtidigt som det snabbar upp produktionen av de nu nästan identiska produkterna. För att förbättra automatiseringsprocessen på golvet i fabrikerna och även tillverkningsprocessen generellt så används ett speciellt mjukvarusystem. Detta system kallas på engelska execution manufacturing system (MES), och detta system är kopplat till PLCerna och annan utrustning på produktionsgolvet. MESen har olika funktionaliteter och en utav dessa är hantering av instruktioner. Dessa instruktioner kan vara riktade både till anställda samt utrustning så som PLCer. Skulle det inträffa ett fel i MESen, t.ex. i instruktionerna som skickas till produktionsgolvet, så skulle företaget kunna få lida av negativa konsekvenser både ekonomiskt och för företagets rykte. I och med att en PLC är en dator och den är kopplad till MES så kan det finnas möjligheter att utföra attacker mot MESen genom att använda en PLC som utgångspunkt. Syfte. Undersöka om det är möjligt att utföra en attack på en MES med utgångspunkt från en PLC. Metod. En litteraturstudie genomfördes för att ta reda på vilka typer av attacker samt sårbarheter relaterade till PLCer som publicerats mellan 2010 och 2018. Ett praktiskt experiment utfördes också, där attackförsök gjordes på ett MES. Resultat. Resultatet är att det finns många olika attacktyper samt sårbarheter som upptäckts relaterade till PLCer och att de attacker som utfördes i det praktiska experimentet inte lyckades skapa några negativa effekter i det MES som användes. Slutsatser. Slutsatsen för examensarbetet är att två olika typer av de hittade PLC-attackerna verkar vara kapabla till att användas för att attackera MES-lagret. Metoden som användes i det praktiska försöket lyckades inte påverka MES-lagret negativt. Men det gick att påverka MESens logfil i ett av testfallen, så det går inte att fastslå att andra MES-typer inte är sårbara mot detta eller att de två identifierade PLC-attackerna inte kommer kunna påverka MES-lagret negativt.

Denna rapport omfattar ett 15 poängs (22,5 högskolepoäng) examensarbete vid Karlstads universitet. Arbetet har utförts på plats hos BAE Systems Bofors i Karlskoga. Företaget ville kunna styra en radiostyrd leksaksstridsvagn med en laserpekare. En kamera ansluten till en digital signalprocessor (DSP) skulle kunna detektera var en laserpunkt befinner sig och styra stridsvagnen mot den. Ett styrgränssnitt mellan DSP:n och leksaksstridsvagnen konstruerades och byggdes med hjälp av en programmerbar logisk krets. Leksaksstridsvagnens interna signalsystem analyserades. En manchesterkodad signal i form av ett 32-bitars seriellt kodord hittades, vilket ursprungligen kom från radiostyrningen. Ett styrgränssnitt konstruerades kring en CPLD (Complex Programmable Logic Device) vilken programmerades med VHDL (Very high speed integrated Hardware Description Language) som återskapar den Manchesterkodade styrsignalen. Gränssnittet ansluter till DSP:n som kontrollerar stridsvagnens styrning och övriga funktioner till fullo. Kommunikationen mellan styrgränssnittet och DSP:n sker via ett parallellgränssnitt som är 16-bitar brett. 13 bitar är datasignaler och övriga tre är ”styrbitar” som konfigurerar gränssnittet. En applikation integrerades i projektet för att demonstrera styrgränssnittets funktion. DSP:n tolkar var en laserpunkt befinner sig inom ett kameraområde och skickar motsvarande styrsignaler till leksaksstridsvagnen. / This report consists of a 15 points (22.5 ECTS) Exam Degree project at Karlstad University. The work was done on location at BAE Systems Bofors AB in Karlskoga. The company wanted to control a radio controlled toy tank from a digital signal processor (DSP). A camera connected to the DSP locates the laser point and steers the toy tank towards it. An interface using a programmable logic device was constructed that connects the DSP to the toy tank. The internal signals in the toy tank was analyzed and a Manchester coded signal in form of a 32-bit serial code word was detected. The code word originated from the radio controller. The control interface was built around a CPLD (Complex Programmable Logic Device) which was programmed in VHDL (Very high speed integrated Hardware Description Language). The control interface recreates the signal controlling the toy tank. The interface connects the toy tank to the DSP which controls the toy tank and it’s functions to the full extent. Communication between the interface and the DSP is done via a 16 bit parallel connection. 13 of the bits are data bits and the remaining 3 are control bits that are used to set up the interface. An application was integrated in the project where the DSP is detecting a laser point. Corresponding signals to the laser points position where sent to the control interface to demonstrate the function of the interface.

The shopping trolley have been frequently used in our daily life. However, the hygiene condition of cart makes people worry a lot, especially the handle brothers. Nowadays, several methods have been proposed to clean the shopping carts but considered uneconomic and inflexible. In this study, we aim to design an integrated cart washing system based on a trailer applied to medium or small supermarket. This system should be more efficient, economic, easily to operate, safer and les water consummation. The integrated cart washing system has three basic functions of washing, disinfection and drying. The system is controlled by PLC program, all steps in the cleaning process are fully automatic insider the trailer and each component are adjustable according to various shopping carts. The system only requires one person to operate and it costs 30 seconds to wash a single cart, able to wash up to 120 cart/hour. Disinfection and drying steps provide high washing quality. Moreover, water-recycling design can save part of wasted water. The modelling and assembly was designed in Autodesk Inventor 2016, the hardware design circuit-writing diagram was performed in AutoCAD, the software design of Programmable logic controller (PLC) was made in STEP 7-Micro/Win. Theoretical calculation and simulation prove the safety and possibility of our system. We concluded that this system might have commercial interests in the market.

Cette thèse traite de l'identification des systèmes à événements discrets (SED) automatisés dans un contexte industriel. En particulier, le travail aborde les systèmes formés par un processus et un automate programmable (AP) fonctionnant en boucle fermée - l'identification a pour but d’obtenir un modèle approximatif exprimé en réseaux de Petri interprétés (RPI) à partir du comportement externe observé sous la forme d'une seule séquence de vecteurs d’entrée-sortie de l’AP. Tout d'abord, une analyse des méthodes d'identification est présentée, ainsi qu’une étude comparative des méthodes récentes pour l'identification des SED. Puis le problème abordé est décrit - des importantes caractéristiques technologiques dans les systèmes automatisés par l’AP sont détaillées. Ces caractéristiques doivent être prises en compte dans la résolution du problème, mais elles ne peuvent pas être traitées par les méthodes existantes d’identification. La contribution principale de cette thèse est la création de deux méthodes d’identification complémentaires. La première méthode permet de construire systématiquement un modèle RPI à partir d'une seule séquence entrée-sortie représentant le comportement observable du SED. Les modèles RPI décrivent en détail l’évolution des entrées et sorties pendant le fonctionnement du système. La seconde méthode considère des SED grands et complexes - elle est basée sur une approche statistique qui permettre la construction des modèles en RPI compactes et expressives. Elle est composée de deux étapes - la première calcule à partir de la séquence entrée-sortie, la partie réactive du modèle, constituée de places observables et de transitions. La deuxième étape fait la construction de la partie non-observable, en rajoutant des places pour permettre la reproduction de la séquence entrée-sortie. Les méthodes proposées, basées sur des algorithmes de complexité polynomiale, ont été implémentées en outils logiciels, lesquels ont été testés avec des séquences d’entrée-sortie obtenues à partir des systèmes réels en fonctionnement. Les outils sont décrits et leur application est illustrée à travers deux cas d’étude. / This thesis deals with the identification of automated discrete event systems (DES) operating in an industrial context. In particular the work focuses on the systems composed by a plant and a programmable logic controller (PLC) operating in a closed loop- the identification consists in obtaining an approximate model expressed in interpreted Petri nets (IPN) from the observed behaviour given under the form of a single sequence of input-output vectors of the PLC. First, an overview of previous works on identification of DES is presented as well as a comparative study of the main recent approaches on the matter. Then the addressed problem is stated- important technological characteristics of automated systems and PLC are detailed. Such characteristics must be considered in solving the identification problem, but they cannot be handled by previous identification techniques. The main contribution in this thesis is the creation of two complementary identification methods. The first method allows constructing systematically an IPN model from a single input-output sequence representing the observable behaviour of the DES. The obtained IPN models describe in detail the evolution of inputs and outputs during the system operation. The second method has been conceived for addressing large and complex industrial DES- it is based on a statistical approach yielding compact and expressive IPN models. It consists of two stages- the first one obtains, from the input-output sequence, the reactive part of the model composed by observable places and transitions. The second stage builds the non observable part of the model including places that ensure the reproduction of the observed input-output sequence. The proposed methods, based on polynomial-time algorithms, have been implemented in software tools, which have been tested with input-output sequences obtained from real systems in operation. The tools are described and their application is illustrated through two case studies.

Um sistema que realiza a detecção de movimento procura, numa seqüência de imagens, sinais que confirmem a existência de movimentação no ambiente monitorado. Uma vez realizada a detecção do movimento, pode-se realizar o rastreamento (tracking) do objeto na cena em questão. A detecção e o rastreamento de objetos, em tempo real, são técnicas que estão despertando grande interesse por parte de pesquisadores e empresas pois, estas técnicas, podem ser utilizadas em diversas áreas que se estendem desde a engenharia e computação até áreas como a geologia e medicina. Sendo assim, seguindo-se a idéia básica de detecção e rastreamento, encontram-se diversas aplicações para estas técnicas como: sistemas de vigilância, análise de movimentos humanos, sistemas de detecção e rastreamento de pedestres ou veículos, dentre outras. Neste trabalho é mostrado um sistema que foi desenvolvido para armazenamento de imagens em tons de cinza de uma seqüência de vídeo e um posterior processamento dessas imagens para detecção de características que indiquem movimento. O processamento se resume em integrar o sinal de vídeo, que está armazenado nas memórias, nas direções horizontal e vertical gerando os histogramas de intensidade horizontal e vertical. Comparando os histogramas de quadros diferentes da seqüência de vídeo será possível detectar a presença de movimento e a região da imagem onde este ocorreu. Devido à necessidade de um processamento rápido das imagens e no interesse de produzir um sistema dedicado com hardware reduzido, utilizou-se de dispositivos de lógica programável complexa (CPLDs). / A system that performs movement detection in a sequence of images looks for signs that confirm the occurrence of the movement in the controlled environment. Once the movement of the object is detected it is possible to perform the tracking of the object. Real time object detection and tracking techniques are of great interests to researchers and industries because these techniques can be used in several areas going from engineering and computing to geology and medicine. There is a wide field of applications of detection and tracking techniques, such as: surveillance systems, human movement analysis, pedestrians or vehicle detection. This work presents an implementation able to store a gray level image from a video sequence and from these images detect in real time a object movement in the scene. The detection will be performed integrating an image from the video sequence in the horizontal and vertical directions in order to obtain the intensities histograms in these directions. Comparing the histograms with those of a different frame of the video sequence it will be possible to detect the presence of movement and locate where in the image the movement occurs. Due to real time digital image processing requirements and in order to produce a reduce dedicated hardware, complex programmable logic devices (CPLDs) were used.

A morfologia matemática é o estudo da forma utilizando as ferramentas da teoria de conjuntos e representa uma área extremamente importante em análise de imagens. Suas operações básicas são a dilatação e a erosão, e através destas é possível realizar outras operações mais complexas. A morfologia matemática fornece ferramentas poderosas para a realização de análise de imagens em baixo nível e tem encontrado aplicações em diversas áreas, tais como: visão robótica, inspeção visual, medicina, análise de textura, entre outras. Muitas destas aplicações requerem processamento em tempo real, e para sua execução de forma eficiente freqüentemente é utilizado hardware dedicado. A análise de imagens em baixo nível geralmente envolve computações repetidas sobre estruturas grandes de dados. Assim, o paralelismo parece ser um atributo necessário de um sistema de hardware capaz de executar eficientemente estas tarefas. As ferramentas da morfologia matemática são bem adequadas à implementação em arquiteturas pipeline. A necessidade de sistemas capazes de realizar o processamento de imagens digitais em tempo real, com o menor custo e tempo de desenvolvimento, tem sido suprida pela tecnologia de dispositivos de lógica programável complexa. Assim, neste trabalho foi projetada e implementada uma arquitetura pipeline dedicada para dilatação e erosão de imagens binárias em tempo real utilizando dispositivos lógicos programáveis de alta capacidade. Esta arquitetura é capaz de processar imagens binárias de 512 x 512 pixels. Os estágios desta arquitetura são flexíveis, permitindo a reprogramação da forma e do tamanho dos elementos estruturantes utilizados nas operações morfológicas. A arquitetura desenvolvida apresentou um desempenho satisfatório, demonstrando ser uma alternativa viável e eficiente. / Mathematical morphology is a very important image analysis area that uses set theory tools to study shapes. The basic operations in mathematical morphology are dilation and erosion, these can be used for more complex operations. Mathematical morphology has powerful tools for low level image processing and has been used in a wide range of applications such as robotic vision, visual inspection, medicine and texture analysis. Low level image processing requires repetitive processing over large data structures, dedicated parallel computing hardware is often used. Complex field programmable logic devices (CPLDs) have increasingly been used for the fast development of real time image processing systems. In this work we present a pipeline architecture for real time erosion and dilation operations, the architecture was developed using high density programmable logic devices. The developed architecture can process 512 x 512 pixels binary images, and has flexible stages that can be reprogrammed according to the shape and size of the structuring elements used in the morphological operations. Tests performed using the architecture demonstrated its good performance and that it is a good and efficient alternative for dedicated morphological image processing operations.

by Lo Wing-yee. / Thesis (M.Phil.)--Chinese University of Hong Kong, 1994. / Includes bibliographical references (leaves vii-ix). / ABSTRACT --- p.i / LIST OF TABLES --- p.iv / LIST OF FIGURES --- p.v / Chapter 1. --- INTRODUCTION --- p.1 / Chapter 1.1 --- Traditional Design Prototyping --- p.1 / Chapter 1.2 --- In-Circuit Rapid Prototyping System --- p.2 / Chapter 1.3 --- A Summary of Prototyping Systems Available --- p.5 / Chapter 1.4 --- Universal Prototyping Board (UPB) --- p.6 / Chapter 2. --- HARDWARE DESIGNS --- p.9 / Chapter 2.1 --- Bus Interconnection --- p.9 / Chapter 2.1.1 --- Fixed buses --- p.9 / Chapter 2.1.2 --- Programmable buses --- p.12 / Chapter 2.2 --- Architectural Features --- p.15 / Chapter 2.2.1 --- Field programmable gate array --- p.15 / Chapter 2.2.2 --- Microprocessor --- p.15 / Chapter 2.2.3 --- Memory --- p.16 / Chapter 2.2.4 --- Buffers --- p.18 / Chapter 3. --- SOFTWARE TOOLS --- p.20 / Chapter 3.1 --- Critical Path Analysis --- p.20 / Chapter 3.1.1 --- Algorithm of critical path analysis --- p.21 / Chapter 3.1.2 --- Computation time --- p.21 / Chapter 3.2 --- Circuit Partitioning --- p.23 / Chapter 3.2.1 --- Partitioning algorithm --- p.24 / Chapter 3.2.2 --- Effects of partitioning --- p.36 / Chapter 3.2.3 --- Partitioning parameters --- p.38 / Chapter 3.2.4 --- Pseudo-code of partitioner --- p.39 / Chapter 3.3 --- IO Assignments --- p.40 / Chapter 3.3.1 --- Connect 4 FPGAs --- p.40 / Chapter 3.3.2 --- Connect 3 FPGAs --- p.42 / Chapter 3.3.3 --- Connect 2 FPGAs --- p.44 / Chapter 3.3.4 --- System IO (Connect 1 FPGA) --- p.47 / Chapter 3.4 --- Other Tools --- p.48 / Chapter 4. --- STRUCTURE ANALYSIS --- p.49 / Chapter 5. --- RESULTS --- p.52 / Chapter 6. --- FUTURE DIRECTION --- p.73 / Chapter 6.1 --- Other Possible Configurations --- p.73 / Chapter 6.2 --- Programmable Interconnection --- p.73 / Chapter 6.3 --- Expandability of UPB --- p.74 / Chapter 7. --- CONCLUSION --- p.75 / BIBLIOGRAPHY --- p.vii / APPENDICES --- p.x

O uso de pequenos satélites tem aumentado substancialmente nos últimos anos devido ao custo reduzido de desenvolvimento e lançamento, assim como pela flexibilidade oferecida pela utilização de componentes comerciais. Este trabalho propõe o projeto e a implementação de uma plataforma para teste, controle e qualificação de circuitos integrados (Integrated Circuits, CIs) comerciais e customizados para uso em aplicações espaciais. Esta plataforma flexível pode ser ajustada a uma gama de dispositivos e interfaces, e reduz os esforços de integração desses componentes e, portanto, acelera o desenvolvimento de todo o projeto. O sistema proposto é sintetizado em um tecnologia de Arranjo de Portas Programáveis em Campo (Field Programmable Gate Array) baseado em memória Flash, que, apesar de não ser classificado para uso aeroespacial, testes demonstram a viabilidade de seu uso. Este sistema adaptável permite o controle de novas cargas-úteis e softcores para o teste e validação antes da sua aplicação em voo. A comunicação com dispositivos é feita através de protocolos préimplementados. Os resultados de testes funcionais in loco sugerem a possibilidade de aplicação desta plataforma para uso em Cubesats. A primeira aplicação desta plataforma foi no teste do controle da placa de carga-útil do NanoSatC-BR1, o primeiro nanossatélite científico brasileiro, lançado em órbita em 2014. / The number of small satellites has substantially increased in the last years due to reduced development and launching costs, as well as due to the flexibility brought by the usage of commercial off the shelf components. This work purposes the design and implementation of a platform for test, control and qualification of commercial and customized integrated circuits for space applications. This flexible platform can be adjusted to control a wide range of devices and interfaces, and is intended to reduce the integration difficulties, resulting in the speed up of some of the project stages. The platform is synthesized in a Flash-based Field Programmable Gate Array technology. The target device is not qualified for aerospace projects. Nevertheless, previous radiation tests demonstrated its hardness for space missions. The system is adaptable and makes it possible to control, test and validate new payloads and softcores before flight. The communication between devices is done through pre-implemented protocols. Functional tests suggested the possibility to apply the platform in Cubesats projects. The first application of this platform was in the NanoSatC-BR1, the first Brazilian scientific nanosatellite, to test the controller of the payload board.

In this thesis work we present CLIK, a new, automated, remote attack on the control logic of a programmable logic controller (PLC) in industrial control systems. The CLIK attack modifies the control logic running in a remote target PLC automatically to disrupt a physical process. We implement the CLIK attack on a real PLC. The attack is initiated by subverting the security measures that protect the control logic in a PLC. We found a critical (zero-day) vulnerability, which allows the attacker to overwrite password hash in the PLC during the authentication process. Next, CLIK retrieves and decompiles the original logic and injects a malicious logic into it and then, transfers the infected logic back to the PLC. To hide the infection, we propose a virtual PLC that engages the software the virtual PLC intercepts the request and then, responds with the original (uninfected) control logic to the software.

The Programmable Logic Devices, PLO, have caused a major impact in logic design of digital systems in this decade. For instance, a twenty pin PLO device can replace from three hundreds to six hundreds Transistor Transistor Logic gates, which people have designed with since the 60s. Therefore, by using PLD devices, designers can squeeze more features, reduce chip counts, reduce power consumption, and enhance the reliability of the digital systems. This thesis covers the most important aspects of logic design using PLD devices. They are Logic Minimization and State Assignment. In addition, the thesis also covers a seldomly used but very useful design style, Self-Synchronized Circuits. The thesis introduces a new method to minimize Two-Level Boolean Functions using Graph Coloring Algorithms and the result is very encouraging. The raw speed of the coloring algorithms is as fast as the Espresso, the industry standard minimizer from Berkeley, and the solution is equally good. The thesis also introduces a rule-based state assignment method which gives equal or better solutions than STASH (an Intel Automatic CAD tool) by as much as twenty percent. One of the problems with Self-Synchronized circuits is that it takes many extra components to implement the circuit. The thesis shows how it can be designed using PLD devices and also suggests the idea of a Clock Chip to reduce the chip count to make the design style more attractive.