An Industrial Control System (ICS) is used to monitor and control industrial processes and critical infrastructure, and is therefore crucial to modern society. This makes them attractive targets for malicious cyber-attacks, which have become more advanced and abundant in recent history. To properly defend ICSs from these cyber-attacks, appropriate cyber-defensive mechanisms should be continuously designed and updated, cyber-attack detection mechanisms included. These mechanisms should undergo sufficient testing before being implemented in actual ICSs to minimise unforeseen consequences. Existing literature indicates that Dynamic Multiplicative Watermarking (DMWM) is a promising form of cyber-attack detection, which could improve overall detection performance. Thus far, this technique has not yet been applied to Automatic Generation Control (AGC) (a prominent form of Load Frequency Control (LFC) in power grids) to detect data integrity attacks (specifically scaling and replay attacks). Ergo, this research aims at testing the performance of DMWM against data integrity attacks on AGC. To perform attack detection, a Luenberger observer it utilised. This observer generates a residual, which is compared to a robustly designed threshold. For the purpose of adequate testing, the HILDA (Hardware-In-the-Loop Detection of Attacks) testbed is designed and constructed. By using this testbed, more realistic scenarios can be simulated than with regular desktop simulations. After verifying the correct construction of the testbed, the DMWM performance is examined both on a desktop simulation environment using MATLAB & Simulink, and on the HILDA testbed. It is shown that the addition of DMWM increases the detection performance in the context of both scaling and replay attacks. For replay attacks, this performance increases notably, while for scaling attacks the improvement is more modest. It is shown that, overall, the attacks are detected more quickly when simulated on the HILDA testbed compared to simulations performed on the MATLAB & Simulink environment. On the other hand, the overall detection ratio was better when simulated on the MATLAB & Simulink environment. This discrepancy in detection performance demonstrates the added value of the HILDA testbed.

Road intersections have a large impact on road accidents and travel delay. Applying infrastructure, such as stop signs and traffic lights, are supposed to prevent collisions on the intersection. However, such methods contribute to the travel delay, while accidents still occur due to human errors. Considering the rise of automation within vehicles, the automation of intersections becomes possible. Vehicles exchange information with each other (distributed techniques) or with a central unit (centralized techniques) to determine the velocity profile needed to efficiently cross the intersection without causing any collisions. This information exchange is established through the creation of spontaneous wireless networks between vehicles and infrastructure, also known as a Vehicular Ad-Hoc Network (VANET). However, the addition of wireless communication to autonomous vehicles presents a dangerous vulnerability to cyber attacks. In the literature, many studies investigate what types of cyber attacks are most likely to occur on the VANET. From these studies, it is chosen to test the cyber attack called "false data injection" on Virtual Platooning based Intersection Control. It is shown in simulations that an alteration in the broadcasted messages for a duration of $1.3$ seconds already leads to a collision on the intersection. In order to prevent such events from happening, a Sliding Mode Observer (SMO) is designed to monitor the received data from the surrounding vehicles. Treating the false injected data as an unknown input to the system, the SMO is designed to reconstruct the anomalous data. The accuracy of the unknown input reconstruction using an SMO depends on how well the model describes the dynamics of the vehicles. Thus the SMO is designed for both a linear as well as a non-linear vehicle model. To analyze the performance of the SMO, the observer is applied to both simulations and experiments. Under the assumption that the vehicles can measure the relative velocity to each other, both the simulations and the experiments show promising results.

Currently, encryption is part of daily life, from commercial to industrial applications. Secure, long-distance communication is vital to the safe and reliable operation of industrial feedback control. Utilising public networks as a medium is often cost-effective at the risk of a security breach. Current industrial feedback control systems generally utilise end-to-end encryption to communicate control signals and gains securely. Data has to be decrypted for processing. Homomorphic encryption allows for manipulation of encrypted data. This eliminates the need for decryption to update controller states and calculating control effort. Partially Homomorphic Encryption supports either multiplication or addition of encrypted values, whereas Fully Homomorphic Encryption allows for both. Besides being flexible, Fully Homomorphic Encryption schemes are thought to be quantum safe. Unfortunately, Fully Homomorphic Encryption schemes are computationally expensive limiting practical applications. This thesis presents an enhanced version of the of the popular Fully Homomorphic Encryption scheme by Gentry. The encryption scheme is enhanced through the introduction of three alterations. New notation is introduced that streamlines its description. The main functions that compose the encryption scheme are all replaced with analytical equivalents. The so called reduced cipher is introduced. Rewriting the encryption scheme using the improved notation, analytical functions and reduced cipher leads to a more computationally and memory efficient implementation. The alterations make the encryption more suitable for implementation on Field Programmable Gate Arrays which decreases compute time. Such an implementation is presented and used to demonstrate the efficacy of the enhanced encryption scheme.

Due to the increase in traffic, road congestion has gone up. Vehicle platooning is a possible way to increase the capacity of a given road, by decreasing the distance between the vehicles in the platoon. At the moment, the control of vehicle platoons is commonly done using PDD controllers. The advantage of this is that it requires little computational resources. With improvements in computing technology in recent years, the possibility of using a more computationally costly method has opened up. MPC is such a method, with a couple of important advantages for vehicle platooning. Firstly it is (finite-time) optimal so should lead to smaller deviations from the desired trajectory, thereby decreasing the minimum safe distance between the vehicles. Secondly, it is inherently able to include constraints on the behaviour of the platoon. This is important because it allows for explicitly enforcing the minimum safe distance between the vehicles, thereby preventing collisions. While many studies have looked into the possibility of using MPC for vehicle platooning before. None of them have made the direct comparison with the current standard e.i. PDD control in a practical setup. This is important as it will give a good indication of both the possible advantages and pitfalls MPC could have in real platoons. To investigate this both a PDD and MPC controller are implemented on a platoon of RC-vehicles and their performance is compared. To compare the performance five metrics are used on four scenarios. The metrics used are coherence, combined local error, velocity error, energy expenditure and minimum headway. The scenarios are a step up, step down, ramp up and a ramp down. From the simulation results, it is clear that in an idealised case the MPC outperforms the PDD controller. However, when looking at the lab results this difference is less pronounced. In the lab setting, it is also clear that both controllers struggle to reliably deal with the added uncertainties caused by measurement noise and inconsistent behaviour of the vehicles. In future research more emphasis should be placed on the robustness of the controllers used, to mitigate these problems.

Industrial control systems (ICSs) are used widely throughout the world for the control of large, complex industrial plants and consist of the entire setups of control system including sensors, PLCs (Programmable Logic Controllers), actuators and communication devices. The communication between these ICS devices is performed using industrial communication protocols such as Modbus, EtherCAT, etc. With the advancements in the use of the internet, ICS are being enabled to share real-time information over the internet worldwide. While these features make the ICS more accessible for remote supervisory control, they also make them vulnerable to cyber-attacks. This makes it the need of the hour to investigate risks and impacts of cyber attacks on ICS. Generating, injecting and testing cyber attacks on real world ICS, controlling critical infrastructure will involve several financial risks and safety issues. This gives rise to the necessity of an ICS testbed, with the ability to inject and test cyber attacks, in a safe and secure environment. A testbed provides a cheaper alternative for testing impacts of cyber attacks and also offers more flexibility to simulate multiple industrial scenarios. Together, these aspects form the core reasons behind the requirement of an ICS testbed. As the real world ICSs are often costly and specialized for industrial usage, there are not many research laboratories around the world with the availability of a testbed to study cyber attacks. Therefore, this Master of science thesis, through its primary research question, investigates if a cyber-attack testbed can be built in the NERD lab at the Delft University of Technology, which is able to replicate a real-world ICS network to identify and test vulnerabilities of ICSs working on Modbus protocol to cyber-attacks? To answer this question, this report studies the vulnerabilities in ICS working with Modbus protocol. A novel design for an ICS testbed for generating and testing cyber attacks at NERD Lab in TU Delft is presented during this thesis. The proposed testbed utilizes real world ICS components such as PLC and HMI, combined with a plant simulator, which is used for simulating an industrial process. The testbed utilizes a Linux based attack PC to generate and inject various cyber attacks. A virtualization platform connects the attack PC to the ICS network, giving the flexibility of injecting attacks on the testbed, without the attacker being physically present on the plant site. With the use of real world ICS, the testbed therefore allows to replicate a typical ICS scenario in the real world industry. Further, a simulated version of the actual testbed, with open source softwares, mimicking the ICS systems has been developed in this report. This simulated version provides a cheaper and flexible platform to perform initial testing on the working of the testbed and checks the feasibility of the actual testbed. The testbed simulates a plant, controller, and HMI in Matlab/Simulink on different physical PCs, which communicate with the Modbus protocol. An attack PC with a virtualization environment has been used to launch cyber attacks on the simulated testbed, same as that to be used in the proposed testbed at Delft University of Technology. Two main types of cyber attacks namely, Man-In-The-Middle (MITM) and Denial-of-Service (DoS) attack have been successfully implemented on this simulated testbed. To conclude this thesis, advanced versions of these attacks have also been developed and their impacts have been analysed.

Unmanned vehicles are a vital topic in today’s science and technology field. The safety problem of unmanned vehicles has been paid more attention from researchers. People are continually developing new control technologies, making the auxiliary driving or control of vehicles more accurate and reliable. Before designing a reliable controller, researchers need to obtain an accurate model of the vehicle system. However, the vehicle is a complex system, and various vehicle parameters are difficult to obtain by direct sensor measurement. In addition, there are deviations between the actual vehicle and the simulation model. At this time, it is necessary to make system identification to obtain reliable vehicle parameters and models. In this paper, vehicle simulation is carried out based on the CarSim C-Class model under the environment of CarSim vehicle simulation software. The model includes tire, suspension, steering, driver, and other subsystems. This platform can simulate a vehicle closed to the real one. The vehicle model can be controlled through Simulink and output the real-time data of various variables of the vehicle system. Then, the data required for identification and validation can be obtained through the joint simulation of CarSim and Simulink. By comparing different vehicle and tire models, different identification data sets and different algorithms, this paper summarizes the advantages and disadvantages of different choices and their applicability. First, the comparison between the bicycle model and the four wheels vehicle model is implemented. The Interior-point algorithm was used to identify the two models under different control data sets. The results of parameter validation and vehicle validation are analyzed. Then, under the same control data set, the four wheels model is selected for the comparative experiment between different algorithms. The first comparison with the Interior-point algorithm is the Unscented Kalman Filter (UKF) and its improved method Particle Swarm Optimization-Unscented Kalman Filter (PSO-UKF). The Magic Formula tire model was then identified by Genetic Algorithm (GA) algorithm, which compares with the Dugoff tire model. Each model and algorithm has its suitable scenarios. Also different data sets lead to various result. The analysis and application suggestions of different algorithms, data sets and models will be given in the end.

Sensors are used all around us in various industries, for instance: agricultural, medical,aerospace and automotive. It is important for these industries to have reliable sensor data because the functionality of technologies depends on it. In this work, the industry of inter-est is automotive, specifically in the field of Cooperative Adaptive Cruise Control (CACC). The control of vehicles depends on measurement data from radars, which are carried by each vehicle in a platoon. If these measurements are faulty, it could affect CACC and cause a crash. This work models the Radio Control (RC) vehicle, implements CACC and aims to identify such faults in the radar measurement data before they could impact the behavior of the platoon. The results are obtained in simulation, comprising the mathematical model of the vehicles, the implemented CACC controller and a virtual radar exposed to 4 different faults, with which the chosen method for fault detection is evaluated. The results of the CACC operating in ideal conditions and with faulty measurement data are depicted. The work ends with analysing the results and concluding, whether the chosen method is capable of identifying the faulty measurement data.

As autonomous driving is a popular and ever growing field of research, real world experiments provide a required manner of testing. In this thesis a driving research platform is developed, with a focus on platooning using visual messaging. These visual messages are conveyed using LED matrices. This thesis proposes two methods of LED matrix detection using YOLOv2, one using a sliding window, and one using the entire image. Furthermore two ways of distance estimation are proposed, one using the centers of the estimation bounding boxes and one using the used camera proprietary toolbox depth map. Results from an online experiment show best results from the depth map based depth estimation. The LED matrix detection using a sliding window gave generally dependable results in different environments, at the cost of being computationally demanding. The detection using the entire image provided less consistent results, but was significantly less computationally demanding. In a second offline experiment using a preannotated validation dataset as groundtruth all LED matrices were detected for all detectors. The SqueezeNet based YOLOv2 detector using a sliding window had the best results between tested detectors, with the highest intersection over union between detection and groundtruth.

This thesis report is focused on the design of a guidance and control system that is able to minimize the deviation from the desired impact point for a firing range of 1 kilometer, given a 30mm spinning gun-launched projectile with a novel actuator design. This actuator is fixed on the projectile and offers a single force that can only be switched on or off. In order to test the effectiveness of the guidance, navigation and control (GNC) system, an accurate model for both the projectile and the proposed actuator are constructed. These models will serve as a substitute for testing with working prototypes. The model for the projectile dynamics is constructed based on existing nonlinear 6-DOF rigid-body models that are widely-used and validated. A new, simplified second order model that approximates the dynamics of the actuator, based on available measurements, is constructed. The overall structure of the GNC loop is defined, with the guidance method of choice being the pre-calculation of a reference trajectory towards the intended target. This method serves to alleviate under-actuation and computation time problems. One of the most important contributions of the thesis is made with the description of a method for transforming the input from a single binary input signal towards two continuous virtual input forces. This method uses a discretization of the rolling motion of the projectile, such that an optimization can be done which results in a transformation from the binary on/off signal to two virtual force inputs. These two virtual force represent the steering forces in the directions perpendicular to the forwards motion that would have the same effect as the binary on/off signal if directly applied on the projectile. The restructuring of the input allows for the use of PD-controllers to track the pre-defined trajectory. Using a grid-search method, the controller gains are found that best satisfy the design goal of minimizing the dispersion, which is defined by the sum of the mean error and the standard deviation of the impact points. Analysis of the integrated solution shows that the proposed solution with the input transformation and the PD-controller is able to significantly reduce the projectile dispersion from standard deviations of about 50 cm to just a few cm. The exact performance depends on the frequency of the actuator and the spin rate of the projectile. The best performance is reached with high spin rates and actuator frequencies high enough to match these spin rates.