Critical Control Systems Research Articles

A Case Study in Power Substation Network Dynamics

The modern world is becoming increasingly dependent on computing and communication technology to function, but unfortunately its application and impact on areas such as critical infrastructure and industrial control system (ICS) networks remains to be thoroughly studied. Significant research has been conducted to address the myriad security concerns in these areas, but they are virtually all based on artificial testbeds or simulations designed on assumptions about their behavior either from knowledge of traditional IT networking or from basic principles of ICS operation. In this work, we provide the most detailed characterization of an example ICS to date in order to determine if these common assumptions hold true. A live power distribution substation is observed over the course of two and a half years to measure its behavior and evolution over time. Then, a horizontal study is conducted that compared this behavior with three other substations from the same company. Although most predictions were found to be correct, some unexpected behavior was observed that highlights the fundamental differences between ICS and IT networks including round trip times dominated by processing speed as opposed to network delay, several well known TCP features being largely irrelevant, and surprisingly large jitter from devices running real-time operating systems. The impact of these observations is discussed in terms of generality to other embedded networks, network security applications, and the suitability of the TCP protocol for this environment.

Cyber-Physical Security and Privacy [Guest editors' introduction

The modernization of our critical infrastructures and control systems over the past decade -- with new embedded system technologies and new Internet-compatible networking capabilities -- has provided a large number of advantages. These modernized physical infrastructures have better operation efficiency, save energy, and improve reliability. However, before these technologies are fully developed, we must address foundational security requirements to guarantee that this modernization fulfills its potential and isn't subject to a variety of attacks. This special issue contains four articles exploring the new security mechanisms that must be designed to guarantee operational safety as well as security in complex cyber-physical systems.

The Metacaspase (Mca1p) Restricts O-glycosylation During Farnesol-induced Apoptosis in Candida albicans

Protein glycolysation is an essential posttranslational modification in eukaryotic cells. In pathogenic yeasts, it is involved in a large number of biological processes, such as protein folding quality control, cell viability and host/pathogen relationships. A link between protein glycosylation and apoptosis was established by the analysis of the phenotypes of oligosaccharyltransferase mutants in budding yeast. However, little is known about the contribution of glycosylation modifications to the adaptive response to apoptosis inducers. The cysteine protease metacaspase Mca1p plays a key role in the apoptotic response in Candida albicans triggered by the quorum sensing molecule farnesol. We subjected wild-type and mca1-deletion strains to farnesol stress and then studied the early phase of apoptosis release in quantitative glycoproteomics and glycomics experiments on cell-free extracts essentially devoid of cell walls. We identified and characterized 62 new glycosylated peptides with their glycan composition: 17 N-glycosylated, 45 O-glycosylated, and 81 additional sites of N-glycosylation. They were found to be involved in the control of protein folding, cell wall integrity and cell cycle regulation. We showed a general increase in the O-glycosylation of proteins in the mca1 deletion strain after farnesol challenge. We identified 44 new putative protein substrates of the metacaspase in the glycoprotein fraction enriched on concanavalin A. Most of these substrates are involved in protein folding or protein resolubilization and in mitochondrial functions. We show here that key Mca1p substrates, such as Cdc48p or Ssb1p, involved in degrading misfolded glycoproteins and in the protein quality control system, are themselves differentially glycosylated. We found putative substrates, such as Bgl2p (validated by immunoblot), Srb1p or Ugp1p, that are involved in the biogenesis of glycans. Our findings highlight a new role of the metacaspase in amplifying cell death processes by affecting several critical protein quality control systems through the alteration of the protein glycosylation machinery.Data are available via ProteomeXchange with identifier PXD003677.

Delay-aware and reliability-aware contention-free MF–TDMA protocol for automated RFID monitoring in industrial IoT

Abstract This paper presents a multi-frequency time division multiple access (MF–TDMA) protocol for Radio Frequency IDentification (RFID) monitoring system in industrial Internet of Things (IoT). Unlike critical industrial control system which requires 1–2 ms response in communication, the monitoring system in industries normally demands a guaranteed delay in hundred-millisecond level. Under the context of IoT, massive items are monitored, the requirements of the monitoring system thus further include reliable communication, low-power low-cost flexible hardware structure, scalable system infrastructure, and quality of service (QoS) on demand. To fulfill these, we employ a flexible hardware infrastructure which uses a centralized coordinator and a set of readers to support multiple frequency channels or technologies to maximize the system capacity. The proposed MF–TDMA protocol provides a scheduled communication both in time and frequency with an optional automatic repeat request (ARQ), independent/uniform synchronization and control mechanism, and an optimization of time slot allocation to increase the transmission reliability while decreasing the latency to a guaranteed bound. The performance evaluation indicates that based on the proposed MF–TDMA protocol, the system can promise more than 95% of the tags to enjoy than 50 ms waiting time. And a delay bound of 100 ms is achieved when a 16-byte packet is transmitted at 256 kbps. Moreover, 100% packet transmission ratio can always be obtained thanks to the schedule and optimization mechanism.

Underground Bacteria Generates H2S and Trips Control Panels

Summary Instrument equipment shelters (IESs) are important control buildings within operating plants, housing the critical instrumentation and control system (ICS) panels that are essential for plant operations. At one such IES building in one of the plants operated by Abu Dhabi Gas Industries Limited (GASCO), frequent tripping of ICS panels was encountered, without pre-alarm indication, leading to plant upsets and posing risk to the safe operations of the plant. Occasionally, the odor of hydrogen sulfide (H2S) was observed. This paper addresses the measures undertaken to identify the source of generation and diffusion of corrosive agents into the IES and remedial measures to eliminate this chronic problem. A detailed study was carried out that included soil- and water-sample collection and specialized laboratory testing, collection and testing of electronic cards, discussion with control-system vendors, and desktop evaluation of data. Analysis of electronic cards identified corrosion of electronic components within the panels as the primary reason for the tripping of panels. Corrosion of electronic components was concluded to be caused mainly by diffusion of H2S into the building, also as confirmed by control-system vendors. Ingress of corrosive agents through air inlets/doors was eliminated as a cause because of the absence of any signs of corrosion in heating, ventilation, and air-conditioning (HVAC) air intakes and because of maintenance of positive air pressure within the building. Extensive investigation and testing of soil indicated the presence of a high concentration of sulfate-reducing bacteria (SRB) in the vicinity of the building. A high groundwater table containing sulfates provided nutrition to the SRB. The bacteria reduced the sulfates present in the groundwater to H2S. The H2S, thus generated, diffused into the building through cable entry sleeves, reaching the area beneath the false flooring on which panels were mounted, and subsequently entering the panels. The presence of conducive temperature and humidity facilitated the reaction of H2S with electronic cards, thereby causing corrosion and tripping of panels. The key remedial measures that were recommended—namely, dewatering the surrounding area and lowering groundwater levels to starve the bacteria, thus rendering it dormant and preventing H2S generation, and sealing of cable entry sleeves to prevent any external gas ingress into the building—were implemented, resulting in resolution of the issue and maintaining the safety and integrity of plant operations. Tripping of ICS panels because of H2S generation by bacteria present in soil is a rare phenomenon, not commonly encountered in oil and gas plants. In areas where the groundwater table is high, the construction of buildings needs to be planned carefully. Geotechnical investigation shall include testing for the presence of organic content, sulfates, and SRB in soil and groundwater, in addition to conventional tests.

Cyber Defense as a part of Hazard Mitigation: Comparing High Hazard Potential Dam Safety Programs in the United States and Sweden

Abstract Cyber security tends to only address the technical aspects of the information systems. The lack of considerations for environmental long-range implications of failed cyber security planning and measures, especially in the protection of critical infrastructure and industrial control systems, have created ecological risks that are to a high degree unaddressed. This study compares dam safety arrangements in the United States and Sweden. Dam safety in the United States is highly regulated in many states, but inconsistent over the nation. In Sweden dam safety is managed by self-regulation. The study investigates the weaknesses and strengths in these regulatory and institutional arrangements from a cyber security perspective. If ecological and environmental concerns were a part of the risk evaluation and risk mitigation processes for cyber security, the hazard could be limited. Successful environmentally-linked cyber defense mitigates the risk for significant damage to domestic freshwater, aquatic and adjacent terrestrial ecosystems, and protects ecosystem function.

Modelling and simulation of distributed time critical communication and control systems in vehicles or vehicle networks

Abstract: This paper is dedicated to the methodical analysis of distributed communication and control systems, such like systems inside modern vehicles or systems of networked vehicles. For runtime and time-behavior analyses, the basic models of a communication access and a cycle crossing between program components are discussed. For these sub-problems, exemplary simulation results are shown and validated. Regarding both problems together, a mathematic approach is introduced, which describes the structure of a subsuming process, relevant for time analysis in distributed systems. The simulation of this complete process allows the derivation of realistic statements on the tolerable limits in time critical control systems.

Diversity for security: case assessment for FPGA-based safety-critical systems

Industrial safety critical instrumentation and control systems (I&Cs) are facing more with information (in general and cyber, in particular) security threats and attacks. The application of programmable logic, first of all, field programmable gate arrays (FPGA) in critical systems causes specific safety deficits. Security assessment techniques for such systems are based on heuristic knowledges and the expert judgment. Main challenge is how to take into account features of FPGA technology for safety critical I&Cs including systems in which are applied diversity approach to minimize risks of common cause failure. Such systems are called multi-version (MV) systems. The goal of the paper is in description of the technique and tool for case-based security assessment of MV FPGA-based I&Cs.

A pattern-based method for refining and formalizing informal specifications in critical control systems

Abstract Processing specifications is an issue of crucial importance when developing critical complex systems. In particular, establishing rigorous specifications broadly impacts the subsequent engineering phases. This paper discusses a refinement technique for processing informal specifications expressed in a literal shape, with the aim to generate formal specifications appropriate to automatic processing. The developed technique carries out an iterative process which relies on a set of basic refinement patterns that we have established, and ends up with a formalization step which actually generates logical CTL* formulas. Furthermore, the method implements traceability facilities, which allow for a tidy backtracking of the whole process. The concepts introduced to set up the various mechanisms are discussed and a case study featuring an embedded railway control system is used to illustrate our technique.

ICONE23-1742 MULTI-FAULT INJECTION TESTING : CASES FOR FPGA-BASED NPP I&C SYSTEMS

The fault injection/insertion testing (FIT) is one of the key techniques applied for independent verification and validation (IVV) of software and FPGA-based safety critical NPP instrumentation and control systems (I&Cs). The technique is based on design fault injection into the software code including VHDL code, physical faults into programmable CPU-based or FPGA chips and modules. The requirements for FIT as a verification technique are described by the standard NUREG/CR-7151 which in addition to the injection of single faults recommends employing a multifault injection technique (MFIT). Requirements of the NUREG/CR-7151 are analyzed and normative profile related to FIT and MFIT are discussed considering FPGA features. The application of MFIT, on the one part, increases the verification time and complicates procedure and tools supporting testing, and, contrariwise, significantly improves the quality of the system and trustworthiness of safety and dependability assessment. This paper offers the approach to development of MFIT for FPGA-based NPP I&Cs taking into account features of such systems. Injection of faults is performed into VHDL code, chip and FPGA-based module. Injection may be fulfilled by use of a few procedures such as (1) single fault by fault injection with (a) and without (b) elimination of injected faults, (2) injection of multi-faults. Besides, two levels of I&Cs are considered in point of view MFIT: first one is FPGA module level, second one is system level. Industrial case of single and multi-fault injection techniques application is described for the FPGA-based platform RadICS. The proposed approach (FIT and MFIT) can be applied to different technologies of NPP I&Cs development.

FlightGear as a Tool for Real Time Fault-injection, Detection and Self-repair

The development of fault-detection and self-healing methods at both a hardware and software level in modern aircraft is an attractive prospect. However it is expensive to design and test these techniques using real aircraft. This paper appraises the viability of using FlightGear, an open- source Flight Simulator, as a test-bed for these approaches. The paper characterises the realism of various aspects of a model of the Airbus A380. Interfaces are established to abstract critical control system routines from FlightGear. These functions are replicated in both software and hardware environments. The control data can then be subjected to fault-injection and the control modules modified to enable fault-detection and self-healing. By applying cluster analysis techniques to training sets of data, a fault-detection, diagnosis and self-healing model is designed to address these injected faults. FlightGear is found to provide highly realistic simulation of aircraft systems and instrumentation. Hardware-in-the-loop testing shows promise as an area for future work. The proposed fault-detection model is found to provide 96% accuracy.

Intrusion Detection in Cyber-Physical Systems: Techniques and Challenges

Cyber-physical systems (CPSs) integrate the computation with physical processes. Embedded computers and networks monitor and control the physical processes, usually with feedback loops where physical processes affect computations and vice versa. CPS was identified as one of the eight research priority areas in the August 2007 report of the President's Council of Advisors on Science and Technology, as CPS will be the core component of many critical infrastructures and industrial control systems in the near future. However, a variety of random failures and cyber attacks exist in CPS, which greatly restrict their growth. Fortunately, an intrusion detection mechanism could take effect for protecting CPS. When a misbehavior is found by the intrusion detector, the appropriate action can be taken immediately so that any harm to the system will be minimized. As CPSs are yet to be defined universally, the application of the instruction detection mechanism remain open presently. As a result, the effort will be made to discuss how to appropriately apply the intrusion detection mechanism to CPS in this paper. By examining the unique properties of CPS, it intends to define the specific requirements first. Then, the design outline of the intrusion detection mechanism in CPS is introduced in terms of the layers of system and specific detection techniques. Finally, some significant research problems are identified for enlightening the subsequent studies.

Design and Verification of VHDL Code for FPGA Based Slave VME Interface Logic

Versa Module Europa (VME) bus is used in various applications in order to ensure safety and security. VME64x based Real Time Computer (RTC) system with various types of Input / Output (I/O) hardware modules is being designed and developed for use in various safety critical and safety related Instrumentation & Control (I&C) systems. Analog Output Card (AOC) is one of the I/O hardware modules as part of VME64x RTC development. The AOC uses Field-Programmable Gate Array (FPGA) as VME bus system controller. This paper discusses the design and development of a VME64x bus controller so as to meet the required specifications correctly.

Identification and application of security measures for petrochemical industrial control systems

Identification and application of security measures for petrochemical industrial control systems

Critical Control System Protection in the 21st Century

Critical control systems manage many of today's critical infrastructures, whose continuous operation, maintenance, and protection are high national priorities for governments around the world. The authors present the fundamental architectural components of these systems, identify vulnerabilities and potential threats, and describe protection solutions that can be deployed to mitigate attacks.

Stabilization of a Class of Two-Dimensional Critical Control Systems

This paper uses the Lyapunov method to study the control system of a class of two-dimensional critical, and acquires the sufficient condition for absolute stability of the two-dimensional critical nonlinear control system.

Formal Methods for the Analysis of Critical Control Systems Models: Combining Non-Linear and Linear Analyses

Critical control systems are often built as a combination of a control core with safety mechanisms allowing to recover from failures. For example a PID controller used with triplicated inputs and voting. Typically these systems would be designed at the model level in a synchronous language like Lustre or Simulink, and their code automatically generated from these models. We present a new analysis framework combining the analysis of open-loop stable controllers with safety constructs (redundancy, voters, ...). We introduce the basic analysis approaches: abstract interpretation synthesizing quadratic invariants and backward analysis based on quantifier elimination and convex hull computation synthesizing linear invariants. Then we apply it on a simple but representative example that no other available state-of-the-art technique is able to analyze. This contribution is another step towards early use of formal methods for critical embedded software such as the ones of the aerospace industry.

Tin whisker analysis of an automotive engine control unit

Since the 1970s, automobile manufacturers have used electronics for safety–critical automobile control systems such as acceleration, braking, and steering. These electronic systems introduced functionalities in automobiles that were not feasible in a purely mechanical framework, such as anti-lock braking systems and electronic stability control. However, failures of these electronic systems can lead to fatalities, financial losses, legal ramifications, and reputational liabilities for manufacturers. Therefore, automotive electronics must be designed to have minimum failures during use.In this paper, materials used in an automotive engine control unit (ECU) from a 2008 Toyota Tundra truck were analyzed. It was found that pure tin with a nickel underlayer was used as the connector finish in the unit, and analysis revealed tin whiskers on the connector surface. The use of pure tin finishes in electronics can produce conductive tin whiskers capable of creating unintended electrical failures such as short circuits. To assess tin whisker growth and the use of nickel as an underlayer material, the engine control unit was subjected to a standard temperature–humidity cycling test. The connectors showed tin whisker growth after testing, raising additional reliability and safety concerns. Recommendations for the automotive industry and National Highway Traffic Safety Administration are offered.

A fuzzy real-time temporal logic

High-level descriptions of real-time systems often use fuzzy notions of time that are left open to domain specific interpretations. In order to verify that a given implementation conforms to such loosely defined specifications, the typical approach is to verify the implementation to be correct within well defined limits of time tolerance. This approach determines whether the real-time requirements are met, but does not reflect how well it is met.Our goal in this paper is to prescribe the development of timed specifications using fuzzy notions of time, and to present a methodology for computing the quality of satisfaction of the specification on a given implementation using domain specific fuzzy membership functions. With this objective, we combine the notions of real-time interval temporal logic (like Metric Interval Temporal Logic) and fuzzy logic to derive FRTL, a fuzzy real-time temporal logic. The novelty of the proposed logic is in introducing the notion of fuzzy time intervals into the core fabric of conventional metric temporal logic. We present a method for evaluating the fuzzy truth of FRTL properties on finite traces. We discuss the motivation of computing the fuzzy truth towards evaluating the quality of control in time critical embedded control system applications. We also show that two important related problems from the domain of mixed-signal design verification, are subsumed by the proposed framework of analysis.

Designing An Optimal Pid Controller For Control The Plans Height, Based On Control Of Autopilot By Using Evolutionary Algorithms

The dangers of poor pilot performance as well as time and place conditions, and such as low altitude and climate, damage critical aircraft control system. Mentioned factors, caused damage in control of sensitive military and research aircraft. So researchers had to find a solution for this problem. Therefore, the use of Unmanned Aircraft Vehicle or (UAV) in sensitive and important Operation is required. Furthermore, designing the controller system is one of the main discussed Dynamic issues in Flying Objects. Here, has been attempted to determine the optimal coefficients of PID1 controller in Autopilot based on Optimization Algorithm such as Evolutionary Algorithms in order to regulate and desired control on height of an Unmanned Aircraft Vehicle (UAV). The proposed Cost Function simultaneously optimized the system performance specifications. Optimization done by using Evolutionary Algorithms such as \(GA^2\), \(PSO^3\) and Social Policy Optimization Algorithm or \(ICA^4\). Finally, the system response based on Evolutionary Algorithms compared with the advantages of Classic method Optimization based on Constraints design, then you can easily decide on the superiority and being optimized of the proposed system.