Ever-increasing demands for highly-efficient customized manufacturing are driving the development of Industry 4.0. Reconfigurable manufacturing systems based on modular, convertible, and interoperable equipment present a key enabler of the fourth industrial revolution. Besides suitable mechanical design, control of these smart manufacturing resources should facilitate Internet of Things (IoT) integration and reconfigurability. Existing numerical control kernels (NCK)—the major control component for motion control—hinder rapid reconfiguration due to the complexity of their monolithic centralized structure. On the other hand, reconfigurability is naturally promoted by the distributed control paradigm, as proposed by the industrial IoT (IIoT) concept; hence, in this article, we investigate design challenges in distributing the conventional centralized NCK designs used for control of computerized numerical control systems. We introduce an architecture where each axis module is augmented with a networked, IIoT-enabled low-level controller (LLC) that performs local control and exposes a network interface for communication with other LLCs toward executing the desired process. These smart manufacturing resources communicate with an edge-based high-level controller (HLC) that provides the trajectory specification over the network and schedules manufacturing tasks. We investigate real-time and network bandwidth requirements of different mappings of the NCK layers to the LLCs and the HLC, providing design-time tradeoffs for implementing IoT-ready, distributed motion control. We demonstrate feasibility of our approach using industry-grade single-axis robots and low-cost IoT microcontrollers, and show that minimal accuracy impairment is introduced compared to the centralized setup based on ISO 230 and ISO 10791-7 standards.

Internet of Things (IoT) technologies enable development of reconfigurable manufacturing systems—a new generation of modularized industrial equipment suitable for highly customized manufacturing. Sequential control in these systems is largely based on discrete events, whereas their formal execution semantics is specified as control interpreted Petri nets (CIPN). Despite industry-wide use of programming languages based on the CIPN formalism, formal verification of such control applications in the presence of adversarial activity is not supported. Consequently, in this article, we introduce security-aware modeling and verification techniques for CIPN-based sequential control applications. Specifically, we show how CIPN models of networked industrial IoT controllers can be transformed into time Petri net (TPN)-based models and composed with plant and security-aware channel models in order to enable system-level verification of safety properties in the presence of network-based attacks. Additionally, we introduce realistic channel-specific attack models that capture adversarial behavior using nondeterminism. Moreover, we show how verification results can be utilized to introduce security patches and facilitate design of attack detectors that improve system resiliency and enable satisfaction of critical safety properties. Finally, we evaluate our framework on an industrial case study. Note to Practitioners—Our main goal is to provide formal security guarantees for distributed sequential controllers. Specifically, we target smart automation controllers geared toward Industrial IoT applications that are typically programed in C/C++ and are running applications originally designed in, for example, GRAFCET (IEC 60848)/SFC (IEC 61131-3) automation programming languages. Since existing tools for the design of distributed automation do not support system-level verification of relevant safety properties, we show how security-aware transceiver and communication models can be developed and composed with distributed controller models. Then, we show how existing tools for verification of time Petri nets can be used to verify relevant properties including safety and liveness of the distributed automation system in the presence of network-based attacks. To provide an end-to-end analysis as well as security patching, results of our analysis can be used to deploy suitable firmware updates during the stage when executable code for target controllers (e.g., in C/C++) is generated based on GRAFCET/SFC control models. We also show that security guarantees can be improved as the relevant safety/liveness properties can be verified after corresponding security patches are deployed. Finally, we show applicability of our framework on a realistic distributed pneumatic manipulator.

Industrial Internet of Things (IIoT) represents a backbone of modern reconfigurable manufacturing systems (RMS), which enable manufacturing of a high product variety through rapid and easy reconfiguration of manufacturing equipment. In IIoT-enabled RMS, modular equipment is built from smart devices, each performing its own tasks, whereas the global functioning is achieved through their networking and intensive communication. Although device communication contributes to the system reconfigurability, it also opens up new security challenges due to potential vulnerability of communication links. In this article, we present security analysis for a major part of RMS in which manufacturing equipment is sequentially controlled and can be modeled as discrete event systems (DES). Control distribution within DES implies communication of certain events between smart modules. Specifically, in this work, we focus on attacks on communication of these events. In particular, we develop a method for modeling such attacks, including event insertion and removal attacks, in distributed sequential control; the method is based on the supervisory control theory framework. We show how the modeled attacks can be detected and provide a method for identification of communication links that require protection to avoid catastrophic damage of the system. Finally, we illustrate and experimentally validate applicability of our methodology on a real-world industrial case study with reconfigurable manufacturing equipment.

Defense mechanisms against network-level attacks are commonly based on the use of cryptographic techniques, such as lengthy message authentication codes (MAC) that provide data integrity guarantees. However, such mechanisms require significant resources (both computational and network bandwidth), which prevents their continuous use in resource-constrained cyber-physical systems (CPS). Recently, it was shown how physical properties of controlled systems can be exploited to relax these stringent requirements for systems where sensor measurements and actuator commands are transmitted over a potentially compromised network; specifically, that merely intermittent use of data authentication (i.e., at occasional time points during system execution), can still provide strong Quality-of-Control (QoC) guarantees even in the presence of false-data injection attacks, such as Man-in-the-Middle (MitM) attacks. Consequently, in this work, we focus on integrating security into existing resource-constrained CPS, in order to protect against MitM attacks on a system where a set of control tasks communicates over a real-time network with system sensors and actuators. We introduce a design-time methodology that incorporates requirements for QoC in the presence of attacks into end-to-end timing constraints for real-time control transactions, which include data acquisition and authentication, real-time network messages, and control tasks. This allows us to formulate a mixed integer linear programming-based method for direct synthesis of schedulable tasks and message parameters (i.e., deadlines and offsets) that do not violate timing requirements for the already deployed controllers, while adding a sufficient level of protection against network-based attacks; specifically, the synthesis method also provides suitable intermittent authentication policies that ensure the desired QoC levels under attack. To additionally reduce the security-related bandwidth overhead, we propose the use of cumulative message authentication at time instances when the integrity of messages from subsets of sensors should be ensured. Furthermore, we introduce a method for the opportunistic use of the remaining resources to further improve the overall QoC guarantees while ensuring system (i.e., task and message) schedulability. Finally, we demonstrate applicability and scalability of our methodology on synthetic automotive systems as well as a real-world automotive case-study.

Due to misaligned clock sources, distributed control in Cyber-Physical Systems (CPS) requires not only synchronous execution of control algorithms on distributed system components, which we refer to as cyber-synchronization, but also appropriate generation of actuation signals-we refer to this as physical-synchronization. In this paper, we define general requirements for cyber-physical synchronization, as well as show their use on a specific real-world application-distributed motion control for reconfigurable manufacturing systems. We present synchronization challenges in such systems and investigate effects of synchronization errors on the overall system functionality (i.e., machining accuracy). Furthermore, we introduce a low-cost synchronization scheme that can be implemented with of-the-shelf components and validate it on standardized accuracy tests with 2D configurations of industry-grade single-axis robots. We show that our cyber-physical synchronization techniques ensure minimal accuracy impairment of distributed motion control without introducing significant cost/overhead to system design.

Existing design techniques for providing security guarantees against network-based attacks in cyber-physical systems (CPS) are based on continuous use of standard cryptographic tools to ensure data integrity. This creates an apparent conflict with common resource limitations in these systems, given that, for instance, lengthy message authentication codes (MAC) introduce significant overheads. We present a framework to ensure both timing guarantees for real-time network messages and Quality-of-Control (QoC) in the presence of network-based attacks. We exploit physical properties of controlled systems to relax constant integrity enforcement requirements, and show how the problem of feasibility testing of intermittently authenticated real-time messages can be cast as a mixed integer linear programming problem. Besides scheduling a set of real-time messages with predefined authentication rates obtained from QoC requirements, we show how to optimally increase the overall system QoC while ensuring that all real-time messages are schedulable. Finally, we introduce an efficient runtime bandwidth allocation method, based on opportunistic scheduling, in order to improve QoC. We evaluate our framework on a standard benchmark designed for CAN bus, and show how an infeasible message set with strong security guarantees can be scheduled if dynamics of controlled systems are taken into account along with real-time requirements.

In this work, we focus on securing cyber-physical systems (CPS) in the presence of network-based attacks, such asMan-in-the-Middle(MitM) attacks, where a stealthy attacker is able to compromise communication between system sensors and controllers. Standard methods for this type of attacks rely on the use of cryptographic mechanisms, such as Message Authentication Codes (MACs) to ensure data integrity. However, this approach incurs significant computation overhead, limiting its use in resource constrained systems. Consequently, we consider the problem of scheduling multiple control tasks on a shared processor while providing a suitable level of security guarantees. Specifically, by security guarantees we refer to control performance, i.e., Quality-of-Control (QoC), in the presence of attacks. We start by mapping requirements for QoC under attack into constraints for security-aware control tasks that, besides standard control operations, intermittently perform data authentication. This allows for the analysis of the impact that security-related computation overhead has on both schedulability of control tasks and QoC. Building on this analysis, we introduce a mixed-integer linear programming-based technique to obtain a schedulable task set with predefined QoC requirements. Also, to facilitate optimal resource allocation, we provide a method to analyze interplay between available computational resources and the overall QoC under attack, and show how to obtain a schedulable task set that maximizes the overall QoC guarantees. Finally, we prove usability of our approach on a case study with multiple automotive control components.

Modern manufacturing systems require fast and effective adaptation to fluctuating market conditions and product diversification. This high level adaptability can be achieved through the utilization of Reconfigurable Manufacturing Systems (RMS), which should be based on modular equipment that is easily integrated, scalable, convertible in terms of functionality, and self diagnosable. RMS also necessitate the use of a dynamic controller architecture that is distributed, fully modular, and self configurable. In this paper, we present a control system design approach for reconfigurable machine tools through the use of modularized and decentralized CNC control. Specifically, we investigate design challenges for Plug-n-Play automation systems, where new system functionalities, such as adding new axes in existing CNC units, can be introduced without significant reconfiguration efforts and downtime costs. We propose a fully decentralized motion control architecture realized through a network of individual axis control modules. Reconfiguration of motion control systems based on this architecture can be achieved by only presenting the controller on each axis with information about machine configuration and the type of axis. This effectively enables modularity, reconfigurability, and interoperability of the machine control system. Finally, we present an implementation of the decentralized architecture based on the use of a real-time operating system, wireless networking, and low-cost ARM Cortex-M3 MCUs; we illustrate its effectiveness by considering machining of a standard test part defined in ISO 10791-7 using a software-in-the-loop testbed.