[en] The production and exploitation of industrial control systems differ substantially from traditional information systems; this is in part due to constraints on the availability and change life-cycle of production systems, as well as their reliance on proprietary protocols and software packages with little support for open development standards. Agile software development methodology characterizes any development method that emphasizes incremental deliveries, working software and fast response to change. The application of agile software development methods therefore represents a challenge which requires the adoption of existing change and build management tools and approaches that can help bridging the gap and reap the benefits of managed development when dealing with industrial control systems. This paper will consider how agile development tools such as Apache Maven for build management, Hudson for continuous integration or Sonatype Nexus for the operation of 'definite media libraries' were leveraged to manage the development life-cycle of the CERN UAB (UNICOS Application Builder) framework, as well as other crucial building blocks of the CERN accelerator infrastructure, such as the CERN Common Middle-ware or the FESA project. (authors)

[en] CERN (European Organization for Nuclear Research),like any organization, needs to achieve the conflicting objectives of connecting its operational network to Internet while at the same time keeping its industrial control systems secure from external and internal cyber attacks. Devices robustness represents a key link in the defense-in-depth concept as some attacks will inevitably penetrate security boundaries and thus require further protection measures. CERN - in collaboration with Siemens - has designed and implemented a dedicated working environment, the Test-bench for Robustness of Industrial Equipment. Such tests attempt to detect possible anomalies by exploiting corrupt communication channels and manipulating the normal behavior of the communication protocols, in the same way as a cyber attacker would proceed. Our approach consists of analyzing protocol implementations by injecting malformed PDUs (Protocol Data Unit) to corrupt the normal behaviour of the system. As a PDU typically has many fields, the number of possible syntactically faulty PDUs grows exponentially with the number of fields. In this document, we proposed a strategy to explore this huge test domain using a hybrid approach of fuzzing and syntax techniques, specifically developed to evaluate industrial device communication robustness. So far, not all the tests can be integrated into automatic tools, human analysis and management is necessary to discover and investigate specific possible failures

[en] Virtualization technology and cloud computing have brought a paradigm shift in the way we utilize, deploy and manage computer resources. They allow fast deployment of multiple operating system as containers on physical machines which can be either discarded after use or check-pointed for later re-deployment. At European Organization for Nuclear Research (CERN), we have been using virtualization technology to quickly setup virtual machines for our developers with pre-configured software to enable them to quickly test/deploy a new version of a software patch for a given application. This paper reports both on the techniques that have been used to setup a private cloud on a commodity hardware and also presents the optimization techniques we used to remove deployment specific performance bottlenecks. (authors)

[en] CERN employs a large number of Programmable Logic Controllers (PLCs) to implement industrial processes. These PLCs provide critical functions and must be placed under permanent monitoring. However, owing to their proprietary architecture, it is difficult to both monitor the status of these automates using vendor-provided software packages and integrate the resulting data with the CERN accelerator infrastructure, which itself relies on CERN-specific protocols and configuration facilities. This paper exposes the architecture of a stand-alone ^PLC diagnostics monitoring Linux daemon, which provides live diagnostics information through standard means and protocols, namely file logging, CERN protocols, and Java Management Extensions. Such information is currently consumed by the EN-ICE MOON supervision software used by the EN-ICE Standby Service to monitor the status of critical industrial applications used in the LHC and the CERN DIAMoN monitoring console used by the LHC operators. Both applications are used daily to monitor and diagnose critical PLC hardware running all over CERN. (author)

[en] The CERN accelerator control system, mainly written in Java and C/C++, consists nowadays of 50 projects and 150 active developers. The controls group has decided to unify the development process and standards (e.g. project layout) using Apache Maven and Sonatype Nexus. Maven is de-facto a build tool for Java, it deals with versioning and dependency management, whereas Nexus is a repository manager. C/C++ developers were struggling to keep their dependencies on other CERN projects, as no versioning was applied, the libraries have to be compiled and available for several platforms and architectures, and finally there was no dependency management mechanism. This results in very complex Make-files which were difficult to maintain. Even if Maven is primarily designed for Java, a plug-in (Maven NAR) adapts the build process for native programming languages for different operating systems and platforms. However C/C++ developers were not keen to abandon their current Make-files. Hence our approach was to combine the best of the 2 worlds: NAR/Nexus and Make-files. Maven NAR manages the dependencies, the versioning and creates a file with the linker and compiler options to include the dependencies. The Make-files carry the build process to generate the binaries. Finally the resulting artifacts (binaries, header files, metadata) are versioned and stored in a central Nexus repository. Early experiments were conducted in the scope of the control group's Testbed. Some existing projects have been successfully converted to this solution and some starting projects use this implementation. (authors)

[en] With the widespread adoption of asynchronous web communication, thanks to WebSockets and WebRTC, it has now become possible to distribute industrial controls data (such as coming from devices or SCADA software) in a scalable and event-based manner to a large number of web clients in the form of rich, interactive visualizations. There is yet, however, no simple, secure and performant way to query large amounts of aggregated historical data. This paper presents an implementation of such an architecture, which is able to make massive quantities of pre-indexed historical data stored in ElasticSearch available to a large number of web-based consumers through asynchronous web protocols. It also presents a simple, Opensocial-based dashboard architecture that allows users to configure and organize rich data visualizations (based on Highcharts Javascript libraries) and create navigation flows in a responsive, mobile-friendly user interface. Such techniques are used at CERN to display interactive reports about the status of the LHC infrastructure (e.g., Vacuum and Cryogenics installations) and give access to fine-grained historical data (such as stored in the LHC Logging database) in a matter of seconds. (author)

[en] The CERN Unified Industrial Control Systems framework (UNICOS) is a software generation methodology and a collection of development tools that standardizes the design of industrial control applications. A Software Factory, named the UNICOS Application Builder (UAB), was introduced to ease extensibility and maintenance of the framework, introducing a stable meta-model, a set of platform-independent models and platform-specific configurations against which code generation plug-ins and configuration generation plug-ins can be written. Such plug-ins currently target PLC programming environments (Schneider and SIEMENS PLCs) as well as SIEMENS WinCC Open Architecture SCADA (previously known as ETM PVSS) but are being expanded to cover more and more aspects of process control systems. We present what constitutes the UNICOS meta-model and the models in use, how these models can be used to capture knowledge about industrial control systems and how this knowledge can be used to generate both code and configuration for a variety of target usages. (authors)