No description available.

Background. Automation in production has become a necessity for producing companies to keep up with the demand created by their customers. One way to automate a process is to use a piece of hardware called a programmable logic controller (PLC). A PLC is a small computer capable of being programmed to process a set of inputs, from e.g. sensors, and create outputs, to e.g. actuators, from that. This eliminates the risk of human errors while at the same time speeding up the production rate of the now near identical products. To improve the automation process on the shop floor and the production process in general a special software system is used. This system is known as the manufacturing execution system (MES), and it is connected to the PLCs and other devices on the shop floor. The MES have different functionalities and one of these is that it can manage instructions. Theses instructions can be aimed to both employees and devices such as the PLCs. Would the MES suffer from an error, e.g. in the instructions sent to the shop floor, the company could suffer from a negative impact both economical and in reputation. Since the PLC is a computer and it is connected to the MES it might be possible to attack the system using the PLC as leverage. Objectives. Examine if it is possible to attack the MES using a PLC as the attack origin. Methods. A literature study was performed to see what types of attacks and vulnerabilities that has been disclosed related to PLCs between 2010 and 2018. Secondly a practical experiment was done, trying to perform attacks targeting the MES. Results. The results are that there are many different types of attacks and vulnerabilities that has been found related to PLCs and the attacks done in the practical experiment failed to induce negative effects in the MES used. Conclusions. The conclusion of the thesis is that two identified PLC attack techniques seems likely to be used to attack the MES layer. The methodology that was used to attack the MES layer in the practical experiment failed to affect the MES in a negative way. However, it was possible to affect the log file of the MES in one of the test cases. So, it does not rule out that other MES types are not vulnerable or that the two PLC attacks identified will not work to affect the MES. / Bakgrund. Automatisering inom produktion har blivit nödvändigt för att företag ska kunna tillgodose den efterfrågan som deras kunder skapar. Ett sätt att automatisera denna process är genom att använde en typ av hårdvara som på engelska kallas för programmable logic controller (PLC). En PLC är en liten dator som man kan programmera så att den bearbetar signaler in, från t.ex. sensorer, och skapar signaler ut, till t.ex. motorer, från det. Detta eliminerar då risken för mänskliga fel samtidigt som det snabbar upp produktionen av de nu nästan identiska produkterna. För att förbättra automatiseringsprocessen på golvet i fabrikerna och även tillverkningsprocessen generellt så används ett speciellt mjukvarusystem. Detta system kallas på engelska execution manufacturing system (MES), och detta system är kopplat till PLCerna och annan utrustning på produktionsgolvet. MESen har olika funktionaliteter och en utav dessa är hantering av instruktioner. Dessa instruktioner kan vara riktade både till anställda samt utrustning så som PLCer. Skulle det inträffa ett fel i MESen, t.ex. i instruktionerna som skickas till produktionsgolvet, så skulle företaget kunna få lida av negativa konsekvenser både ekonomiskt och för företagets rykte. I och med att en PLC är en dator och den är kopplad till MES så kan det finnas möjligheter att utföra attacker mot MESen genom att använda en PLC som utgångspunkt. Syfte. Undersöka om det är möjligt att utföra en attack på en MES med utgångspunkt från en PLC. Metod. En litteraturstudie genomfördes för att ta reda på vilka typer av attacker samt sårbarheter relaterade till PLCer som publicerats mellan 2010 och 2018. Ett praktiskt experiment utfördes också, där attackförsök gjordes på ett MES. Resultat. Resultatet är att det finns många olika attacktyper samt sårbarheter som upptäckts relaterade till PLCer och att de attacker som utfördes i det praktiska experimentet inte lyckades skapa några negativa effekter i det MES som användes. Slutsatser. Slutsatsen för examensarbetet är att två olika typer av de hittade PLC-attackerna verkar vara kapabla till att användas för att attackera MES-lagret. Metoden som användes i det praktiska försöket lyckades inte påverka MES-lagret negativt. Men det gick att påverka MESens logfil i ett av testfallen, så det går inte att fastslå att andra MES-typer inte är sårbara mot detta eller att de två identifierade PLC-attackerna inte kommer kunna påverka MES-lagret negativt.

The shopping trolley have been frequently used in our daily life. However, the hygiene condition of cart makes people worry a lot, especially the handle brothers. Nowadays, several methods have been proposed to clean the shopping carts but considered uneconomic and inflexible. In this study, we aim to design an integrated cart washing system based on a trailer applied to medium or small supermarket. This system should be more efficient, economic, easily to operate, safer and les water consummation. The integrated cart washing system has three basic functions of washing, disinfection and drying. The system is controlled by PLC program, all steps in the cleaning process are fully automatic insider the trailer and each component are adjustable according to various shopping carts. The system only requires one person to operate and it costs 30 seconds to wash a single cart, able to wash up to 120 cart/hour. Disinfection and drying steps provide high washing quality. Moreover, water-recycling design can save part of wasted water. The modelling and assembly was designed in Autodesk Inventor 2016, the hardware design circuit-writing diagram was performed in AutoCAD, the software design of Programmable logic controller (PLC) was made in STEP 7-Micro/Win. Theoretical calculation and simulation prove the safety and possibility of our system. We concluded that this system might have commercial interests in the market.

Cette thèse traite de l'identification des systèmes à événements discrets (SED) automatisés dans un contexte industriel. En particulier, le travail aborde les systèmes formés par un processus et un automate programmable (AP) fonctionnant en boucle fermée - l'identification a pour but d’obtenir un modèle approximatif exprimé en réseaux de Petri interprétés (RPI) à partir du comportement externe observé sous la forme d'une seule séquence de vecteurs d’entrée-sortie de l’AP. Tout d'abord, une analyse des méthodes d'identification est présentée, ainsi qu’une étude comparative des méthodes récentes pour l'identification des SED. Puis le problème abordé est décrit - des importantes caractéristiques technologiques dans les systèmes automatisés par l’AP sont détaillées. Ces caractéristiques doivent être prises en compte dans la résolution du problème, mais elles ne peuvent pas être traitées par les méthodes existantes d’identification. La contribution principale de cette thèse est la création de deux méthodes d’identification complémentaires. La première méthode permet de construire systématiquement un modèle RPI à partir d'une seule séquence entrée-sortie représentant le comportement observable du SED. Les modèles RPI décrivent en détail l’évolution des entrées et sorties pendant le fonctionnement du système. La seconde méthode considère des SED grands et complexes - elle est basée sur une approche statistique qui permettre la construction des modèles en RPI compactes et expressives. Elle est composée de deux étapes - la première calcule à partir de la séquence entrée-sortie, la partie réactive du modèle, constituée de places observables et de transitions. La deuxième étape fait la construction de la partie non-observable, en rajoutant des places pour permettre la reproduction de la séquence entrée-sortie. Les méthodes proposées, basées sur des algorithmes de complexité polynomiale, ont été implémentées en outils logiciels, lesquels ont été testés avec des séquences d’entrée-sortie obtenues à partir des systèmes réels en fonctionnement. Les outils sont décrits et leur application est illustrée à travers deux cas d’étude. / This thesis deals with the identification of automated discrete event systems (DES) operating in an industrial context. In particular the work focuses on the systems composed by a plant and a programmable logic controller (PLC) operating in a closed loop- the identification consists in obtaining an approximate model expressed in interpreted Petri nets (IPN) from the observed behaviour given under the form of a single sequence of input-output vectors of the PLC. First, an overview of previous works on identification of DES is presented as well as a comparative study of the main recent approaches on the matter. Then the addressed problem is stated- important technological characteristics of automated systems and PLC are detailed. Such characteristics must be considered in solving the identification problem, but they cannot be handled by previous identification techniques. The main contribution in this thesis is the creation of two complementary identification methods. The first method allows constructing systematically an IPN model from a single input-output sequence representing the observable behaviour of the DES. The obtained IPN models describe in detail the evolution of inputs and outputs during the system operation. The second method has been conceived for addressing large and complex industrial DES- it is based on a statistical approach yielding compact and expressive IPN models. It consists of two stages- the first one obtains, from the input-output sequence, the reactive part of the model composed by observable places and transitions. The second stage builds the non observable part of the model including places that ensure the reproduction of the observed input-output sequence. The proposed methods, based on polynomial-time algorithms, have been implemented in software tools, which have been tested with input-output sequences obtained from real systems in operation. The tools are described and their application is illustrated through two case studies.

In this thesis work we present CLIK, a new, automated, remote attack on the control logic of a programmable logic controller (PLC) in industrial control systems. The CLIK attack modifies the control logic running in a remote target PLC automatically to disrupt a physical process. We implement the CLIK attack on a real PLC. The attack is initiated by subverting the security measures that protect the control logic in a PLC. We found a critical (zero-day) vulnerability, which allows the attacker to overwrite password hash in the PLC during the authentication process. Next, CLIK retrieves and decompiles the original logic and injects a malicious logic into it and then, transfers the infected logic back to the PLC. To hide the infection, we propose a virtual PLC that engages the software the virtual PLC intercepts the request and then, responds with the original (uninfected) control logic to the software.

This thesis deals with enhancing the performance of Fuzzy Logic (FL) based PI controllers for High Voltage Direct Current Transmission Systems (HVDC) by optimizing the key parameters i.e. membership functions (MFs) and fuzzy rule base in the controllers design. In the first part of the thesis, an adaptive Fuzzy PI controller is designed and the effect of various MF shapes, widths and distribution on the performance of a FL controlled HVDC system under different system conditions is studied with the aim of selecting a MF which minimizes the total control error. Simulated results show that the shape, width and distribution of a MF influences the performance of the FL controller and concludes that nonlinear MFs (i.e. Gaussian) offer a more better choice than linear (i.e. Triangular) MFs as the former provides a smoother transition at the switching points and thus propose a better controller. In the second part of the thesis, a Neuro-Fuzzy (NF) controller to update the fuzzy rule base with changing system conditions is proposed, which in turn adjusts the PI gains of a conventional PI controller. Results from simulations illustrate the potential of the proposed control scheme as the NF controller successfully adapts to different system conditions and is able to minimize the total current error. / UOIT

In the field of the industrial automatic control, both MCU (Micro Control Unit) and PLC (Programmable Logic Controller) are widely being used in DCS (Distributed Control System). Since MCU can provide complex process scheduling, accurate timing control and PLC has the advantages of easy programming and maintaining. However, the control programs of the MCU are hard to design and maintain. Identically, the poor signal processing ability, high cost and the restrictive functions are the major defects of PLC. In order to solve the drawbacks described above in MCU and PLC, we provide a PLC-like interface for users to access the devices and set the registers of MCU. Likewise, designers can develop the control program via Event-table-driven modules. On the other hand, our main goal of DCS is to quickly construct the distributed N level network topology based on Modbus protocol, which is efficient and reliable. Therefore, we bring up a data collection method and Slave-to-Slave strategy so as to distribute the master loading, reduce the package transmission times and improve the real-time latency. In conclusion, our research results not only congregate the benefits of MCU and PLC but provide an environment to quickly construct and conveniently monitor DCS, which meets the time-to-market demands.

A fuzzy logic controller (FLC) for the dissolved oxygen (DO) concentration of a wastewater bioreactor is presented. The FLC is developed and tested based on simulations using first order plus dead time models obtained from experiments with an actual wastewater bioreactor. The FLC uses feedback of the error in DO concentration and rate of change of the DO concentration and manipulates the stem position of the flow control valves (FCVs) supplying air to the bioreactor. The proposed FLC is tested for robustness across several process models, two of which include proposed worst-case process conditions. The performance of the proposed hand tuned FLC is compared to that of a similarly tuned proportional-integral-derivative controller. The FLC is implemented as a lookup table for speed and ease of deployment. The disturbances present in the experimental step testing data are characterized and used as the basis for disturbing the control loop during controller performance testing. A low-pass filter is then included to subsequently smooth the feedback signal. The nonlinear relationship between the FCV stem position and output flow is modelled and included in the controller performance testing. A genetic algorithm (GA) is developed that manipulates the membership functions of the FLC to yield an optimal controller for the ensemble of process models. The ability of the GA to converge on an optimal FLC is verified through repeated trials. The performance of the GA optimized FLC is observed under realistic process conditions and is benchmarked against a manually optimized PID controller.

This thesis deals with the identification of automated discrete event systems (DES) operating in an industrial context. In particular the work focuses on the systems composed by a plant and a programmable logic controller (PLC) operating in a closed loop- the identification consists in obtaining an approximate model expressed in interpreted Petri nets (IPN) from the observed behaviour given under the form of a single sequence of input-output vectors of the PLC. First, an overview of previous works on identification of DES is presented as well as a comparative study of the main recent approaches on the matter. Then the addressed problem is stated- important technological characteristics of automated systems and PLC are detailed. Such characteristics must be considered in solving the identification problem, but they cannot be handled by previous identification techniques. The main contribution in this thesis is the creation of two complementary identification methods. The first method allows constructing systematically an IPN model from a single input-output sequence representing the observable behaviour of the DES. The obtained IPN models describe in detail the evolution of inputs and outputs during the system operation. The second method has been conceived for addressing large and complex industrial DES- it is based on a statistical approach yielding compact and expressive IPN models. It consists of two stages- the first one obtains, from the input-output sequence, the reactive part of the model composed by observable places and transitions. The second stage builds the non observable part of the model including places that ensure the reproduction of the observed input-output sequence. The proposed methods, based on polynomial-time algorithms, have been implemented in software tools, which have been tested with input-output sequences obtained from real systems in operation. The tools are described and their application is illustrated through two case studies.

Η παρούσα διπλωματική εργασία περιλαμβάνει την πλήρη αυτοματοποίηση του τρόπου παραγωγής και διανομής των ηλεκτρικών παροχών στο Εργαστήριο Ηλεκτρομηχανικής Μετατροπής Ενέργειας του Τμήματος Ηλεκτρολόγων Μηχανικών και Τεχνολογίας Υπολογιστών. Το πρώτο μέρος της παρούσας διπλωματικής εργασίας αφορά την περιγραφή του συστήματος παροχών του ΕΗΜΕ. Γίνεται περιγραφή του υπάρχοντος εξόπλισμου και εξετάξεται η δυνατότητά του να λειτουργήσει με PLC. Στην συνέχεια γίνεται περιγραφή της διαδικασίας προγραμματισμού του PLC και ο τρόπος που δομείται το εποπτικό περιβάλλον SCADA. Τέλος γίνεται ιδιαίτερη αναφορά σε κάποιες δυνατότητες που παρέχει το νέο πλήρως αυτοματοποιημένο σύστημα, όπως η δυνατότητα αυτόματου παραλληλισμού σύγχρονης μηχανής με το δίκτυο της ΔΕΗ και η διόρθωση τού συντελεστή ισχύος της εγκατάστασης. / The present diplomatic work includes the complete automation of way of production and distribution of Power supply in the Laboratory of electromechanis Transformation of Energy at the Department of Electricians of Engineers and Technology of Computers.