Search NASA⌕ Search

SEARCH · Search NASA

Results for “logic programming”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2019

Automated Reconstruction of Control Logic for Programmable Logic Controller Forensics

This paper presents Similo, an automated scalable framework for control logic forensics in industrial control systems. Similo is designed to investigate denial of engineering operations (DEO) attacks, recently demonstrated to hide malicious control logic in a programmable logic controller (PLC) at field sites from an engineering software (at control center). The network traffic (if captured) contains substantial evidence to investigate DEO attacks including manipulation of control logic. Laddis, a state-of-the-art forensic approach for DEO attacks, is a binary-logic decompiler for the Allen-Bradley’s RSLogix engineering software and MicroLogix 1400 PLC. It is developed with extensive manual reverse engineering effort of the underlying proprietary network protocol and the binary control logic. Unfortunately, Laddis is not scalable and requires similar efforts to extend on other engineering software/PLCs. The proposed solution, Similo, is based on the observation that engineering software of different vendors are equipped with decompilers. Similo is a virtual-PLC framework that integrates the decompilers with their respective (previously-captured) ICS network traffic of control logic. It recovers the binary logic into a high-level source code (of the programming languages defined by IEC 61131-3 standard) automatically. Similo can work with both proprietary/open protocols without requiring protocol specifications and the binary formats of control logic. Thus, it is scalable to different ICS vendors. We evaluate Similo on three PLCs of two ICS vendors, i.e. MicroLogix 1400, MicroLogix 1100, and Modicon M221. These PLCs support proprietary protocols and the control logics written in two programming languages: Ladder Logic and Instruction List. The evaluation results show that Similo can accurately reconstruct a control logic from an ICS network traffic and can be used to investigate the DEO attacks effectively.

Ali qasim, Syed↗
DOE OSTI2021

A-SST Initial Specification

The U.S. Army Research Office (ARO), in partnership with IARPA, are investigating innovative, efficient, and scalable computer architectures that are capable of executing next-generation large scale data-analytic applications. These applications are increasingly sparse, unstructured, non-local, and heterogeneous. Under the Advanced Graphic Intelligence Logical computing Environment (AGILE) program, Performer teams will be asked to design computer architectures to meet the future needs of the DoD and the Intelligence Community (IC). This design effort will require flexible, scalable, and detailed simulation to assess the performance, efficiency, and validity of their designs. To support AGILE, Sandia National Labs will be providing the AGILE-enhanced Structural Simulation Toolkit (A-SST). This toolkit is a computer architecture simulation framework designed to support fast, parallel, and multi-scale simulation of novel architectures. This document describes the A-SST framework, some of its library of simulation models, and how it may be used by AGILE Performers.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Detecting control system misbehavior by fingerprinting programmable logic controller functionality

In recent years, attacks such as the Stuxnet malware have demonstrated that cyberattacks against control systems cause extensive damage. These attacks can result in physical damage to the networked systems under their control. In this paper, we discuss our approach for detecting such attacks by distinguishing between programs running on a programmable logic controller (PLC) without having to monitor communications. Using power signatures generated by an attached, high-frequency power measurement device, we can identify what a PLC is doing and when an attack may have altered what the PLC should be doing. To accomplish this, we generated labeled data for testing our methods and applied feature engineering techniques and machine learning models. The results of this research demonstrate that Random Forests and Convolutional Neural Networks classify programs with up to 98% accuracy for major program differences and 84% accuracy for minor differences. Our results can be used for both online and offline applications.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Integrate Latimer Controls' Solution into RTAC (CRADA Final Report, CRD-23-24672)

Latimer Controls, Inc. was awarded two vouchers under the Department of Energy's American-Made Solar Prize Round 6 to conduct collaborative research at a national laboratory. The National Renewable Energy Laboratory (NREL) was selected as a partner to assist Latimer Controls in the performance evaluation of its photovoltaic (PV) control software. This collaboration focuses on developing a hardware-in-the-loop (HIL) testbed at NREL, which will be used to test and validate the Latimer PV control technology in a realistic yet de-risked environment. Both Latimer and NREL teams will work together to analyze the collected test data, derive insights, and disseminate the scientific findings. Recent studies underscore the potential of solar energy as a zero-marginal-cost and zero-emission flexibility resource within the bulk power system, particularly when integrated with advanced control systems. To enhance the performance of such systems, Latimer Controls has developed leading-edge technologies, including machine learning (ML) algorithms and hierarchical inverter set-point allocation methods. These innovations are designed to estimate the operational headroom of large PV plants for grid integration and control. However, comprehensive validation under real-world conditions remains necessary. To address this gap, the concurrent CRADA project proposes the real-world application and validation of the Latimer Control solution within a HIL environment. Initially, the Latimer algorithm was developed and tested within MATLAB Simulink, a platform suitable for research-level simulations and iterative development. However, transitioning this technology to a real solar site as an industry-ready solution necessitates implementation in a format compatible with widely used solar power plant controllers. In this additional CRADA work, the MATLAB Simulink-based logic will be translated into Structured Text, a programming language compliant with IEC 61131 standards, which is commonly used for custom logic implementations in industry-leading programmable logic controllers (PLCs), such as the Schweitzer SEL real-time automation controller (RTAC). This transition will facilitate the deployment of the Latimer Control solution in real-world solar power plants, thereby advancing the technology towards commercialization.

14 SOLAR ENERGY↗
DOE OSTI2018

SEMI-ACTIVE CONTROL FOR TWO-BODY OCEAN WAVE ENERGY CONVERTER BY USING HYBRID MODEL PREDICTIVE CONTROL

Model predictive control (MPC) has been considered as one important feed-forward optimal control strategy for ocean wave energy converter (WEC) targeted on power maximization. The capability of MPC to handle system constraints (ex. stroke, velocity, actuator limitations), and the availability to provide optimal solution for linear system provide potential for the implementation of such algorithm in the WEC control. However, currently, only active MPC control has been introduced for single and two-body WECs. Such control strategy may introduce negative power during the optimization process, since the power take-off (PTO) damping has no constraint. In this paper, we proposed a hybrid MPC strategy in limiting both the PTO damping force and PTO damping to avoid negative power generation during cost function minimization (negative power minimization) for the two-body WEC. The problem is formulated into a quadratic programming (QP) problem targeted at power maximization. However, the standard QP problem formulation cannot be directly applied to the semi-active control problem due to the PTO damping constraints. Therefore, the problem is reformulated as a Mixed-integer Quadratic Programming (MIQP) problem, which contains logical switch to select constraint matrices based on the sign of the relative velocity between the buoy and submerged body. The optimal solution is compared with those of the active MPC control strategy and the passive model with the same irregular wave input.

16 TIDAL AND WAVE POWER↗
DOE OSTI2020

Biclique: an R package for maximal biclique enumeration in bipartite graphs

Bipartite graphs are widely used to model relationships between pairs of heterogeneous data types. Maximal bicliques are foundational structures in such graphs, and their enumeration is an important task in systems biology, epidemiology and many other problem domains. Thus, there is a need for an efficient, general purpose, publicly available tool to enumerate maximal bicliques in bipartite graphs. The statistical programming language R is a logical choice for such a tool, but until now no R package has existed for this purpose. Our objective is to provide such a package, so that the research community can more easily perform this computationally demanding task. Biclique is an R package that takes as input a bipartite graph and produces a listing of all maximal bicliques in this graph. Input and output formats are straightforward, with examples provided both in this paper and in the package documentation. Biclique employs a state-of-the-art algorithm previously developed for basic research in functional genomics.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Opcode counting for performance measurement

Methods, systems and computer program products are disclosed for measuring a performance of a program running on a processing unit of a processing system. In one embodiment, the method comprises informing a logic unit of each instruction in the program that is executed by the processing unit, assigning a weight to each instruction, assigning the instructions to a plurality of groups, and analyzing the plurality of groups to measure one or more metrics. In one embodiment, each instruction includes an operating code portion, and the assigning includes assigning the instructions to the groups based on the operating code portions of the instructions. In an embodiment, each type of instruction is assigned to a respective one of the plurality of groups. These groups may be combined into a plurality of sets of the groups.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

StructuredFuzzer: Fuzzing Structured Text-Based Control Logic Applications

Rigorous testing methods are essential for ensuring the security and reliability of industrial controller software. Fuzzing, a technique that automatically discovers software bugs, has also proven effective in finding software vulnerabilities. Unsurprisingly, fuzzing has been applied to a wide range of platforms, including programmable logic controllers (PLCs). However, current approaches, such as coverage-guided evolutionary fuzzing implemented in the popular fuzzer American Fuzzy Lop Plus Plus (AFL++), are often inadequate for finding logical errors and bugs in PLC control logic applications. They primarily target generic programming languages like C/C++, Java, and Python, and do not consider the unique characteristics and behaviors of PLCs, which are often programmed using specialized programming languages like Structured Text (ST). Furthermore, these fuzzers are ill suited to deal with complex input structures encapsulated in ST, as they are not specifically designed to generate appropriate input sequences. This renders the application of traditional fuzzing techniques less efficient on these platforms. To address this issue, this paper presents a fuzzing framework designed explicitly for PLC software to discover logic bugs in applications written in ST specified by the IEC 61131-3 standard. The proposed framework incorporates a custom-tailored PLC runtime and a fuzzer designed for the purpose. We demonstrate its effectiveness by fuzzing a collection of ST programs that were crafted for evaluation purposes. We compare the performance against a popular fuzzer, namely, AFL++. The proposed fuzzing framework demonstrated its capabilities in our experiments, successfully detecting logic bugs in the tested PLC control logic applications written in ST. On average, it was at least 83 times faster than AFL++, and in certain cases, for example, it was more than 23,000 times faster.

47 OTHER INSTRUMENTATION↗
DOE OSTI2018

An (R, S)-norm fuzzy information measure with its applications in multiple-attribute decision-making

In this paper, we introduce a quantity measure which is called (R, S)-norm entropy and discuss some of its major properties with Shannon’s and other entropies in the literature. Based on this (R, S)-norm entropy, we have proposed a new (R, S)-norm fuzzy information measure and discussed its validity and properties. Further, we have given its comparison with other fuzzy information measures to prove its effectiveness. Attribute weights play an important role in multiple-attribute decision-making problems. In the present communication, two methods of determining the attribute weights are introduced. First is the case when the information regarding attribute weights is incompletely known or completely unknown and second is when we have partial information about attribute weights. For the first case, the extension of ordinary entropy weight method is used to calculate attribute weights and minimum entropy principle method based on solving a linear programming model is used in the second case. Finally, two methods are explained through numerical examples.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2025

SULI Deliverables Using: Python-B1500 [Slides]

A new electrical setup for testing ECRAM devices is described in this presentation. This presentation details the background of ECRAM devices, how the B1500 is used to program ECRAM devices, and the python GUI that was created for controlling the B1500. ECRAM devices are a form of non-volatile memory. The stored data is the resistance between two of the terminals on the device. Using only the B1500, the ECRAM devices can be programmed and the state read out. This creates a simple, logical testing setup. The overall setup was successful, ECRAM devices could easily be programmed and measured. However, there is still room for improvement. Specifically, in the creation of an automated “Program” feature and a “Data Collection” feature. These features will require additional advances in the understanding of ECRAM devices but will greatly automate and improve the current data collection and application of ECRAM devices.

42 ENGINEERING↗
DOE OSTI2021

Attacking the IEC-61131 Logic Engine in Programmable Logic Controllers in Industrial Control Systems

In industrial control systems (ICS), programmable logic controllers (PLCs) directly monitor and control a physical process such as nuclear power plants, gas pipelines, and water treatment. They are equipped with a control logic written in IEC-61131 languages (e.g., ladder logic and structured text) that defines how a PLC should control a physical process. A PLC's control logic is a usual target of a cyberattack to sabotage a physical process. For instance, Stuxnet targets a control logic of a Siemens S7-300 PLC to damage a nuclear facility's centrifuges. The existing attacks in the literature generally focus only on injecting malicious control logic into a PLC. This paper presents a new dimension of control logic attacks that target the control logic engine (responsible for running a control logic) of a PLC. It demonstrates that a cyberattack can disable the control logic engine successfully by exploiting inherent PLC features such as program mode and starting/stopping engine. We develop two novel case studies on control logic engine attacks by employing the MITRE ATT\&CK knowledge base on the real-world PLCs used in industry settings, i.e., 1) Schweitzer Engineering Laboratory (SEL)'s Real-Time Automation Controller (SEL-3505 RTAC) equipped with security features such as encrypted traffic and device-level access control, and 2) traditional PLCs, i.e., Schneider Electric's Modicon M221, Allen-Bradley's MicroLogix 1400 and 1100 that do not have security features. The case studies present the internals of the logic engine attacks and facilitate the ICS research community and industry to understand the attack vectors on the control logic engine. We evaluate the effectiveness of the control engine attacks on a power substation, a 4-floor elevator, and a conveyor belt to demonstrate their real-world impact of halting a physical process.

Ali qasim, Syed↗
DOE OSTI2019

Redox transistors for neuromorphic computing

Efficiency bottlenecks inherent to conventional computing in executing neural algorithms have spurred the development of novel devices capable of “in-memory” computing. Commonly known as “memristors,” a variety of device concepts including conducting bridge, vacancy filament, phase change, and other types have been proposed as promising elements in artificial neural networks for executing inference and learning algorithms. In this article, we review the recent advances in memristor technology for neuromorphic computing and discuss strategies for addressing the most significant performance challenges, including nonlinearity, high read/write currents, and endurance. As an alternative to two-terminal memristors, we introduce the three-terminal electrochemical memory based on the redox transistor (RT), which uses a gate to tune the redox state of the channel. Decoupling the “read” and “write” operations using a third terminal and storage of information as a charge-compensated redox reaction in the bulk of the transistor enables high-density information storage. These properties enable low-energy operation without compromising analog performance and nonvolatility. Finally, we discuss the RT operating mechanisms using organic and inorganic materials, approaches for array integration, and prospects for achieving the device density and switching speeds necessary to make electrochemical memory competitive with established digital technology.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

Digitizing Today’s Buildings in the Real World: Lessons from Field Demonstrations

Digital twins, created by generating a virtual replica of a building, enable safe evaluation of operational scenarios and applications like fault detection and diagnosis and advanced controls. However, a prerequisite is the creation of a machine-readable digital representation of a building, currently hindered by fragmented information scattered across mechanical drawings, point lists, and natural language sequences. As a result, digital twin development remains labor-intensive, error-prone, and difficult to validate. To address these challenges, two efforts from ASHRAE aim to support the digitalization of buildings. ASHRAE s223 establishes a semantic model of buildings, representing system components, configuration, and data sources. ASHRAE s231 defines a vendor-neutral programming language for expressing their control logic. As the industry evaluates implementing them in their products, understanding the challenges that vendors and implementers may face is crucial. In this paper, we present findings and lessons learned from field demonstrations in five buildings that implemented control applications using ASHRAE s223 and s231. The demonstrations highlight how semantic modeling and formalized control descriptions can significantly reduce software development time, manual point mapping, and hard-coding. Beyond time efficiency, they enable reliable automation by minimizing human interpretation and providing a means for consistency across projects. We describe the processes and best practices for model creation and model usage, from translating heterogeneous building documentation into semantic representations to implementing control logic in real-world systems. Finally, we discuss the challenges that persist, including integration with legacy software environments, gaps in interoperability, and the level of expertise still required to effectively leverage semantic models.

Prakash, Anand Krishnan↗
DOE OSTI2022

Model Predictive Control of Discrete-Continuous Energy Systems via Generalized Disjunctive Programming

Generalized Disjunctive Programming (GDP) provides an alternative framework to model optimization problems with both discrete and continuous variables. The key idea behind GDP involves the use of logical disjunctions to represent discrete decisions in the continuous space, and logical propositions to denote algebraic constraints in the discrete space. Compared to traditional mixed-integer programming (MIP), the inherent logic structure in GDP yields tighter relaxations that are exploited by global branch and bound algorithms to improve solution quality. In this paper, we present a general GDP model for optimal control of hybrid systems that exhibit both discrete and continuous dynamics. Specifically, we use GDP to formulate a model predictive control (MPC) model for piecewise-affine systems with implicit switching logic. As an example, the GDP-based MPC approach is used as a supervisory control to improve energy efficiency in residential buildings with binary on/off, relay-based thermostats. A simulation study is used to demonstrate the validity of the proposed approach, and the improved solution quality compared to existing MIPbased control approaches.

Bhattacharya, Arnab↗
DOE OSTI2024

Shorter function summaries for finite state machine-based high consequence systems using logic synthesis and tautologies (Final Report LDRD 24-1302)

Computer programs are often viewed as collections of functions – each function has parameters (inputs) and computes a return value, and each has potential side effects that modify program state (outputs). In this research, a Sandia symbolic execution tool designed to support “human-in-the-loop” analysis was modified to automatically create “function summaries,” and a new tool, “diaboolical,” was created to support enhancing readability of the summary using a novel approach to bit-vector simplification that leverages logic synthesis and tautologies. For this effort, students at Auburn University created several finite state machines (FSMs) to serve as exemplars for high-consequence systems. Function summaries for each of the machines were obtained, and then portions of the summaries were simplified using both diaboolical and the simplification procedure of a popular SMT solver. A comparison of the results shows that diaboolical can often produce smaller function summaries, with expression length improvements over the unsimplified function summaries ranging from 0% to 90% for diaboolical and 0% to 65% for the SMT solver, though diaboolical had a significantly greater cost in time. Diaboolical was evaluated against a collection of “arbitrary” C-code as well as FSM exemplars, and for both datasets it achieved an approximately 10% improvement in expression length compared to simplifications that could be obtained using existing techniques. Function summaries can assist assurance efforts that evaluate existing systems and their executable code. A smaller function summary is likely easier for humans to understand and could thus increase the ability and efficacy of assurance practices centered around the analysis of executable artifacts.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

Blueprint for DOE Quantum Supercomputing: Ensuring U.S. Leadership in the Quantum Decade

Quantum computing stands at the threshold of a transformative decade, where the field will evolve from small-scale demonstrations toward practical scientific computing at scale. This Blueprint identifies fault-tolerant quantum computers (FTQCs) as a viable, scalable, and broadly applicable path to achieving “quantum scientific utility,” defined as solving scientifically valuable problems beyond the reach of conventional, classical computers. This capability is expected to show scientific demonstrations in the late 2020s and to mature in the early-to-mid 2030s. This Blueprint outlines a strategy to prepare the U.S. Department of Energy (DOE) for FTQCs and their integration into the U.S. national scientific computing infrastructure. Its purpose is to identify the steps, milestones, and research directions necessary for DOE to enable initial deployment of FTQCs in 2028 as a scientific tool for the nation and mature this capability into the 2030s. DOE has a long history of supporting quantum information science and technology, contributing significantly to research advancements, training a quantum-ready workforce, and providing access to early small-scale quantum hardware. Given recent demonstrations of logical operations on error-corrected logical qubits and the advancement of commercial hardware roadmaps, DOE should begin preparations for large-scale, fault-tolerant quantum computing deployment for DOE science missions. This Blueprint proposes that DOE focus on (1) deploying first-generation scientifically relevant quantum computers with at least 100 logical qubits and performing at least 10,000 to 100,000 hard logical operations in scientifically relevant calculations; (2) developing essential FTQC programming competencies, system software, and facility readiness; and (3) investing in cutting edge focused R&D that fosters breakthroughs in scientific applications, algorithms, and logical architectures needed to accelerate the advent of scientific utility. This effort will position DOE to transition to larger systems: production-scale quantum computers that comprise 1,000 to 10,000 logical qubits, perform 1 to 10 billion hard logical operations, and execute scientifically useful computations at scale. Achieving these goals will require DOE facilities to evolve with urgency to support scientific campaigns that integrate quantum and classical computing resources into efficient workflows, novel software and firmware environments for compiling and routing quantum programs on FTQC machines, and suitable infrastructure for quantum hardware. It will also require further development and optimization of scientific applications from the fields of materials science, quantum chemistry, and high-energy and nuclear physics. The Blueprint calls for transformative R&D and collective action to accelerate the advent of scientific quantum utility and bring it within reach by 2028.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Detecting Payload Attacks on Programmable Logic Controllers (PLCs)

Programmable logic controllers (PLCs) play critical roles in industrial control systems (ICS). Providing hardware peripherals and firmware support for control programs (i.e., a PLC’s “payload”) written in languages such as ladder logic, PLCs directly receive sensor readings and control ICS physical processes. An attacker with access to PLC development software (e.g., by compromising an engineering workstation) can modify the payload program and cause severe physical damages to the ICS. To protect critical ICS infrastructure, we propose to model runtime behaviors of legitimate PLC payload program and use runtime behavior monitoring in PLC firmware to detect payload attacks. By monitoring the I/O access patterns, network access patterns, as well as payload program timing characteristics, our proposed firmware-level detection mechanism can detect abnormal runtime behaviors of malicious PLC payload. Using our proof-of-concept implementation, we evaluate the memory and execution time overhead of implementing our proposed method and find that it is feasible to incorporate our method into existing PLC firmware. In addition, our evaluation results show that a wide variety of payload attacks can be effectively detected by our proposed approach. The proposed firmware-level payload attack detection scheme complements existing bumpin- the-wire solutions (e.g., external temporal-logic-based model checkers) in that it can detect payload attacks that violate realtime requirements of ICS operations and does not require any additional apparatus.

42 ENGINEERING↗