a short introduction to myself - … · a short introduction to myself. r.m.g. ferrari: introducing...

08/09/2017, MSc Intro week, R. Ferrari

Riccardo M.G. Ferrari, PhD [email protected]

A SHORT INTRODUCTION TO MYSELF

mailto:[email protected]?subject=

R.M.G. Ferrari: introducing myself08/09/2017, MSc Intro week, R. Ferrari

My resume in one slide (and a Gantt chart)

TIMELINE2

PhD

R&D

PostDocMSc in Electronic

EngineeringAssist. Professor in

Fault Tolerant Control2004 2005 2008 2015 2016 2017

Trieste, Italy(“Bora” wind topped 183 km/h in 2012)

Delft, Netherlands(Max wind speed only 130 km/h)

Buttrio, Italy(my industrial period, in steelmaking)


It is called DANIELI

> founded in 1914

> 9200 employees worldwide

> 2583 M€ sales in 2010

> 150 M€ R&D in 2010

> 124 turn-key plants since 1964

> Built the fastest rolling mill to date: 126.6 m/s

3

THE COMPANY I WORKED FOR


It is called DANIELI

THE COMPANY I WORKED FOR

> founded in 1914

> 10,000 employees worldwide

> built more than 120 turn-key plants


Danielicompanies

Worldwideoffices

4

Headquarters


The Danieli group

DANIELI AT A GLANCE

> founded in 1914




5


The Danieli group

DANIELI AT A GLANCE

> founded in 1914




IInnttrroodduuccttiioonnDanieli Automation since its establishmentin 1969 has committed itself to specialinstrumentation for the metals industry.Through the years the range of productsdeveloped grown as much as the expertise,the reliability and the good reputation ofthe Instrumentation Division, becoming apoint of reference for the entire DanieliGroup and the market itself.Ferriere Nord minimill is part of the PittiniGroup, a leading European manufacturerof steels for the modern building industry,established in the 1960s. In 2007 the finalstage of the wire rod mill upgrade wascompleted, the plant doubled its originalcapacity, producing today 5÷20mmdiameter wire rod, with a capacity of over1 Mtpy. The aim, among the others, was tofurther enhance plant efficiency andproduct quality. Part of the modernizationand upgrade process was the installation ofDanieli Automation’s HiSECTIONsystem. It is not surprising that, when twocompanies leading the relevant market,merge their experience and skills, theresults are so excellent.

Ferriere Nord Plant and HiSECTION SystemFerriere Nord minimill is based on doublestrand rolling process to wire rod lines. The mill is featured by:> Four-passes, one strand, high-speed pre-roughing mill.> Four-passes, two strands, roughing millfed in alternate mode.> Four-passes, two strands, intermediatemill.> Six-passes, two strands, pre-finishingmill.> Two Ten-passes FFB finishing blocks

and high speed laying heads.Since double strand mill sections are madeof horizontal stands with torsion, one ofthe most important operating conditions isthe consistency of FFB finishing blocksfeeder. Key points to obtain stable rollingand consistent product quality are: > Proper rolls peripheral speed.> Correct pass design and roll gaps toavoid overfill.> Correct alignment of rolls and guidingequipment.> Consistent quality of pass condition andguiding equipment operation.> Rolling equipment life endurance.Ensuring equal stock balance andconsistency for both pre-finishing mill andFFBs feeders involves therefore properupstream mill sections settings for guidesalignment, roll gaps and motor speeds.Tuning of such parameter still to date ismainly determined by seniority andexperience of mill workers or based on trialand error procedures, anyhow most of thetimes depending on “black magic” ofindividuals. Any deficiency on the abovementioned settings might generate out of

tolerance finished products or, in the worstcase, cobbles and roller guidesbreakdowns. It results therefore veryimportant to continuously monitor thecross-section of the product, in particularthe feeder of FFB’s, in order to quicklydetect and recover misrolling conditionsacting on: stands gap, tilting, drive speedor rolling guides.It is in this scenario that the installation ofthe HiSECTION system produces thebest results and offers to the rollingprocess significant and valuableimprovements. The HiSECTION is a modern system forthe on-line measurement of cross sectionof hot rolled bars. A magnetic contact-lesssensor forms the core of the system; sturdyand compact, it is designed to bemaintenance and wear free. The workingprinciple of the sensor is based ondetection of the eddy currents, generatedon the surface of the rolled stock by avariable electromagnetic field. TheHiSECTION system can be exploited withthe following main applications:> Weight/meter and section measuring

Section control to improve availability in wire rod mills

Since better products quality and reduced production costs are an inevitable priority in long products rolling, DanieliAutomation and Ferriere Nord joined their forces to develop an innovative solution. The huge cooperation between the twowell known companies led to an impressive outcome to improve quality, yield and availability in wire rod rolling.

Roughing

Intermediate

Phase 2

Pre-finishing Finishing

Finishing

Phase 1

Mill layout with the HiSECTION sensors installation

ST_ferr-nord article:Layout 1 13/03/2009 9.28 Pagina 1

6

This machines churns out bars for rein- forced concrete at more than 450 km/h


Danieli Automation provides measuring and automation solutions

ACTUALLY I WORKED AT DANIELI AUTOMATION

> powerful plants needs eyes (sensors) and brains (controllers)

> they do front-running R&D on measuring and automation solutions for the steel industry

> requires understanding of physical principles, extensive computer modelling, and laboratory/field testing

> military-like requirements on hardware

7


First as a Researcher, then as Executive Manager in R&D


> MSc in Electronic Engineering at Univ. of Trieste (2004)

> PhD in Information Engineering at Univ. of Trieste (2009)

> Working at Danieli Automation from 2008 to 2015

> PostDoc at TUDelft since 2015

> Assist. Professor since 2017

8


Here are some of the activities I was involved in at DA lab


> Finite Element Modelling of electromagnetic and acoustic sensors

> Optical instruments and machine vision

> Research projects with public funding

> Process monitoring and control

Lasers are dangerous ...

9


I designed a machine vision embedded system

INDUSTRIAL EXPERIENCE

> It measures length of continuous casting products

> Motion is computed by comparing successive images

> The mathematical tool used is called Pattern Matching (actually Gray Scale Normalized Cross Correlation)

10


I developed a multi physics model of a chemical reactor

INDUSTRIAL EXPERIENCE

> This is a chemical reactor for Direct Reduction of Iron ore

> The model is multiphysics (two phases flow, heat transfer, chemical reaction)

11

[Fe15] R.M.G. Ferrari, F. Boem, T. Parisini “An Algebraic Approach to Modeling Distributed Multiphysics Problems: the case of a DRI Reactor”, MMM15, Aug. 2015.

!"#$%&"'

("#)'**%+,*

-.!

/01,2*3%+,*

P1

P2

P3

P4

L3

L2

L1

S1

S2

S3

S4

S5

S6

V1

V2

V3

V4

V5

P1

L1

P2

P3

P4

P5

L2

L3

L4

S1

S2

S3

S4

S5

V1

V2

V3

V4

Introduction Conclusions2004 2005 2008 2015 2016 2017 2018 2020


Making Distributed Cyber Physical Systems (CPS) safe

THE QUESTION DRIVING MY RESEARCH12

Networked Critical Infrastructures

Smart Cities

Large Industrial Plants

Tomorrow’s fleets ofcooperative self driving cars*

* A sector projected to be worth 71 Eur billions in 2030, according to ERTRAC (Tech. Rep., 2015)





What if they may be made

unusable, or even dangerous

by failures orcyber-attacks against

a few, or even a singleof their components ?





Their description comprise a large number of interconnected variables

which are distributed in space

Monitoring them in a centralized way is not

feasible

due to scalability reasons(computation and communication

constraints)




THE ANSWER I AM PROPOSING15

Divide et impera: the system is decomposed into subsystems

such that their size and number of interconnections

meet existing computationand communication constraints

and can be monitoredby a network of Local Diagnosers



A Distributed Fault and Attack Detection and Isolation Architecture

THE ANSWER I AM PROPOSING16

Addressing the issues of:

scalability, robustness

adaptivity, performance

networked communication


Distributed fault and attack detection for cooperative mobile robots

SURE: SAFE UNMANNED ROBOTIC ENSEMBLES17

> How can self-driving cars detect problems in the self and non-self vehicle?

Grant no. 707546, funded under H2020, Marie Curie-S. Actions (IF) 2015


IntroductionR.M.G. FerrariFrom Correct to Safe Cyber Physical Systems

Industrial example Safety Conclusions

Malicious attacks on Cyber-Physical cars are far from being sci-fi

THE PROBLEM

> In 2015 researchers reported remotely breaking in a Jeep Cherokee through its internet-enabled infotainment system

> they remotely activated wipers, radio, fans, etc.

> they remotely disabled brakes and engine

18

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway

http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway


IntroductionR.M.G. FerrariFrom Correct to Safe Cyber Physical Systems

Industrial example Safety Conclusions

For building Safe (networks of) CPSs

A SOLUTION

> A part from cooperative self-driving cars, such problem will target virtually every ensemble of robots that can autonomously move in a coordinate way

> swarms of autonomous flying machines, fleets of service robots, …

> A solution consists in designing in the ensemble an adaptive and distributed diagnosis architecture in order to promptly detect (and correct)

> failures

> malicious cyber-attacks

> It should be able to detect anomalies in both an individual robot (the “self”), or in a neighbour (the “non-self”)

19

IFAC 2017, Toulouse, July 9-14th 2017

R.M.G. Ferrari, A. TeixeiraSensor Watermarking against Replay Attacks

Overview Problem Formulation Detect and Identify Simulation Conclusions

NETWORK

Networked CPS systems can be attacked at many levels

CYBER ATTACK DETECTION

20

SENSORS ACTUATORS

CONTROLLER

(FAKE) DEVICE

Sybil DDOS

…

Rerouting Data replay Data injection

Rerouting Data replay

Data injectionRerouting

Data replay Data injection

Data injection Data replay …



attacks are active and

knowledgeable

NETWORK

“the U.S. grid faces imminent danger from cyber attacks”, from U.S. Energy Dept. Quadrennial Energy Review, Jan. 2017




RECORD

GENERAL STRUCTURE OF A REPLAY ATTACK

21

SENDER RECIPIENTattacks are active and knowledgeable

Attacker

Record




REPLAY

GENERAL STRUCTURE OF A REPLAY ATTACK

22

SENDER RECIPIENTattacks are active and knowledgeable

Attacker

Replay




Security camera spoofing

REPLAY ATTACKS ARE QUITE POPULAR

23

[Az07] A. Azam and A. Pastor, “Owning Big Brother (Or how to crack into Axis IP cameras),” Technical Report, Procheckup, 2007.

x

A replay attack is a form of network attack in which a valid data transmission

is maliciously repeated or delayed




Getting unauthorized access to an IT resource


24




Getting unauthorized access to your car


25




SCADA and Industrial Control Systems are possible targets

REPLAY ATTACKS TO CONTROL SYSTEMS

26

[St15] K. Stouffer, V. Pillitteri, S. Lightman, M. Abrams, A. Hahn. "Guide to industrial control systems (ICS) security." NIST special publication 800.82r2 (2015)

PLANT CONTROLLERattacks are active and knowledgeable

Attacker

Replay

During an attack the plant is running in open loop => risk of

divergent behaviour

The attack is equivalent to multiplying the plant output

by zero and injecting an exogenous signal




Sensor readings are routed through a network

WE CONSIDER A NETWORKED CONTROL SYS.

27




Sensor readings are routed through a network

WE CONSIDER A NETWORKED CONTROL SYS.

28

PLANT

ControllerNETWORKu

yp

yp




Sensor output received on controller side may have been attacked

ROUTING ATTACK DETECTION

29

PLANT

ControllerNETWORKCyberReplay Attack

u

yp

yp




Sensor watermarking can allow attack detection

CYBER ATTACK DETECTION

30

PLANT Watermark generator

Controller

Replay Detectorand Identificator

NETWORK

ypw

ypw yr

CyberReplay Attack

u

yp

Watermark remover

ypq

Residual

A replay attack opens the loop!

The watermark parameters change

over time

A replay attack acts as an

exogenous signal

The nominal current watermark is removed here

The use of old watermarks is detected here




We propose multiplicative watermarking

WATERMARKING

31

[Ba01] P. Bassia, I. Pitas, and N. Nikolaidis, “Robust audio watermarking in the time domain,” IEEE Transactions on Multimedia, vol. 3, no. 2, pp. 232–241, Jun 2001.

In image watermarking, it is popular to add another static image (either visible or

“invisible”)

In audio (or other 1D signals) it is popular to use additive or multiplicative/nonlinear watermarks, that are either based on another signal or the signal itself (e.g. filtering, selective phase delay, LSB bit flip, etc)


On fault and cyber attack detection

THESIS POSSIBILITIES32

Experimental multi-vehicle testbed for fault

and attack detection

InternshipAssignment:

Data-drivenFaultDiagnosisandFailurePrediction

GeneraldescriptionCommercialprintingsystemsareexpectedtohavehighreliability.Asoneofthecrucialpartofaprinter,theinkjetprintheadshouldhaveeffectivediagnosticstool.Promptdiagnosisoffaultscanallowtheprintingsystemtotakenecessaryactiontoreduceimpactofnozzlefailuresontheprintquality.Furthermore,predictionofnozzlefailurecanhelptotackleriskmuchbetter.ProblemdescriptionAcousticsensorisusedtomeasurebehaviorofaninkchannel.Thissensordataisprocessedbythefaultdiagnosissystemtodetectnozzlefailureandtheroot-causeofthenozzlefailure.Themeasurednozzlestatusisimmediatelyusedinthenextprintingswathtohidethefailingnozzles.

Itislikelythatfewnozzlesarehavinghigherchanceoffailingcomparedtotherestofthenozzles.Thestatisticsofnozzlestatusoverfinitetimeintervalcanhelptocomputelike-hoodofanozzlefailingintheupcomingprinting.Thisnozzlefailurepredictionbasedonthehistoryisveryvitaltooptimallyadapttheprintingprocessandtoachievebestprintquality.

Theoccurrenceoftheeventsandeachspecificfailuremechanismwillbeaffectedbymanyexternalandinternalcauses,whichamongall,printheadmaintenanceactionsareofinterest.Therefore,makinga(oranother)smallhistorydatabaseaboutthechangesinthesystemafteramaintenanceactioncouldhelptoanalyzethebehaviorofthesystemandidentifyingthetimevaryingeffectofmaintenanceonrecoveringthefaultyevents.

ActivitiesTheresearchgoalsoftheinternshiparefollows:

l Analysisofsystemfailurebehaviour:short-termandlong-term.l Data-drivenalgorithmtopredictfailuremechanism.l Systemoptimizationtoimproveperformance.l Demonstratedesignbyimplementationonactualprinter.

Contact

l Dr.RiccardoFerrari([email protected])

Industrial thesisWatermarking

a short introduction to myself - … · a short introduction to myself. r.m.g. ferrari: introducing...

Documents