Detecting Insecure Code Patterns in Industrial Robot Programs

Static analyzers have become increasingly popular both as developer tools and as subjects of empirical studies. Whereas static analysis tools exist for disparate programming languages, the bulk of the empirical research has focused on the popular Java programming language. In this paper, we investigate to what extent some known results about using static analyzers for Java change when considering C#-another popular object-oriented language. To this end, we combine two replications of previous Java studies. First, we study which static analysis tools are most widely used among C# developers, and which warnings are more commonly reported by these tools on open-source C# projects. Second, we develop and empirically evaluate EagleRepair: a technique to automatically fix code in response to static analysis warnings; this is a replication of our previous work for Java [20]. Our replication indicates, among other things, that 1) static code analysis is fairly popular among C# developers too; 2) Re-Sharper is the most widely used static analyzer for C#; 3) several static analysis rules are commonly violated in both Java and C# projects; 4) automatically generating fixes to static code analysis warnings with good precision is feasible in C#. The EagleRepair tool developed for this research is available as open source.

Eliminating vulnerabilities from low-level code is vital for securing software. Static analysis is a promising approach for discovering vulnerabilities since it can provide developers early feedback on the code they write. But, it presents multiple challenges not the least of which is understanding what makes a bug exploitable and conveying this information to the developer. In this paper, we present the design and implementation of a practical vulnerability assessment framework, called [InlineEquation not available: see fulltext.]. Melange performs data and control flow analysis to diagnose potential security bugs, and outputs well-formatted bug reports that help developers understand and fix security bugs. Based on the intuition that real-world vulnerabilities manifest themselves across multiple parts of a program, Melange performs both local and global analyses in stages. To scale upi?źto large programs, global analysis is demand-driven. Our prototype detects multiple vulnerability classes in C and C++ code including type confusion, and garbage memory reads. We have evaluated Melange extensively. Our case studies show that Melange scales upi?źto large codebases such as Chromium, is easy-to-use, and most importantly, capable of discovering vulnerabilities in real-world code. Our findings indicate that static analysis is a viable reinforcement to the software testing tooli?źset.

In this paper, we describe a static analysis approach to detect potential runtime errors for a programming language that is used to program industrial robots. The language we deal in this paper is RAPID, a high level programming language for programming ABB industrial robots. The presence of real-time interrupts, exception handlers and complex data-types makes it a difficult language for general purpose static analyzers. The properties of interest include some generic programming errors as well as some domain-specific properties that the robot system must comply with. Generic programming errors include properties like integer overflow, array access out of bounds and division by zero. An example of a domain-specific property is defining boundary limits for robotic arm movement. We have developed a tool to detect these errors successfully in the presence of real-time interrupts.

An industrial robot is an automatic multi-purpose manipulator, programmable in three or more axes. A program written in a high-level programming language controls these robots, many of these programs involve multiple tasks controlling different robots. Data races are a common problem in concurrent and multi-threaded programming and they are of big concern for the multi-task industrial robotics programmers too. We present a static analysis method for detecting data races in multi-task programs for industrial robots. We propose a technique based on a relation that models when two or more statements from a task occur in between two or more statements in another task. Our static analysis is preceded by a manual, dynamic analysis step for ensuring consistency among tasks for one of the constructs which involves a task waiting for a particular duration. We define a set of not-occurs in-between rules to detect whether two statements in different tasks may race with each other. We have developed a prototype implementation of our tool for the Rapid programming language that is used to program industrial robots of ABB. Rapid has all the features of a typical programming language for industrial robots and hence our race detection framework will generalize to any programming language for industrial robots.

Although the 4V properties of big data have been widely discussed, most of them still describe the appearance of big data. Technical characteristics are necessary. Based on the above background, the purpose of this article is to study the big data classification model and algorithm based on blockchain. This article addresses the problem of mutual trust in data classification caused by the lack of a transparent, open, and equal interaction environment in the current centralized big data classification model. This article analyzes the advantages of blockchain-based big data classification in depth and establishes a blockchain-based big data classification model. Through the data connection model of the combination of blockchain and distributed file system, key information in all classification interactions is stored on the chain in an immutable and traceable manner. This article implements a big data classification prototype system based on Ethereum, IPFS, Laravel and other technologies. The experimental results show that the stand-alone running time is 4343ms longer than the three-node parallel running time, and the blockchain-based execution time is 17615ms longer than the serial running time. Based on the blockchain, this article introduces the interstellar file system IPFS and Zigzag coding, capabilities-based access control methods, and publish-subscribe models, and proposes a reliable data connection mechanism based on BIZi network, a blockchain-based data capability access control mechanism, and a zone-based Blockchain data service customization mechanism.

Secure Programming Guidelines help to prevent developers from introducing vulnerabilities. But being just static text to be consulted now and then, the Guidelines are difficult to integrate in the implementation phase of software development, especially when developers are under pressure of delivering software for a deadline. In this paper, we present an IDE integration of security testing and static code analysis to detect vulnerabilities and known insecure coding patterns according to Secure Programming Guidelines. While security testing tools and static analyzers exist for security professionals, similar tools to be used by software engineers who are normally non security experts are missing. This automated tool support is non-intrusive during implementation by being fully integrated in the IDE developers use, efficient to not slow down the overall implementation effort, and extensible to consider different vulnerabilities. We implement this IDE integration as an extension to SAP HANA Web-based Development Workbench. While not proposing new security testing nor static code analysis techniques, we integrate multiple security analysis to make them usable for developers during implementation, as they are relevant threats to SAP HANA applications and thus concerned in the Secure Programming Guidelines.

Surface manufacturing is a process of adding material to or removing material from the surfaces of a part, where industrial robots are usually used. Robot programming for these applications is still time consuming and costly. Typical teaching methods are not cost effective and efficient. There are many offline programming methods developed to reduce the robot programming effort. However, these methods suffer many practical issues, such as cable/hose tangling, robot configuration, collision and reachability. To solve these problems, this paper discusses a new method to generate robot programs based on existing ones in the database, which contains not only the robot paths, but also the programmers' knowledge and process parameters. Since industrial robots have been used in production for decades, there are many robot programs for different parts generated by the robot programmers. Some of these parts are quite similar, such as car bodies. Therefore, these robot programs can be transformed to generate new ones with some adjustments based on the geometry of new parts. In this paper, a robot path generation method is developed based on the existing robot paths in the database. Experiments were performed to validate the developed methodology. The results are very promising in reducing the programming efforts in surface manufacturing.

In order to respond to the trend of the times and follow the pace of advanced science and technology, the application of robots is no longer the exclusive of one person. Industrial robots are widely used in the field of manufacturing industry. At the same time, colleges and universities are also carrying out related teaching of industrial robots. According to the training plan of Applied Undergraduate talents, a series of explorations have been carried out in teaching content, teaching methods and practical links based on this course. It not only improves the teaching effect, but also stimulates students’ interest in learning. At the same time, it cultivates innovative thinking and greatly improves students’ comprehensive quality. This paper is based on HD1XKB Industrial Robot Training Platform by using basic module or student self-modeling module. This kind of robot training system can complete the basic skill training task of industrial robot programming teaching course. This training system makes the students’ skill training time longer, the safety of skill training higher, and also exercises the students’ three-dimensional drawing. And so on comprehensive application ability.

Nowadays, industrial robots are still commonly programmed using essentially off-line tools, such as is the case of structured languages or simulated environments. This is a very time-consuming process, which necessarily requires the presence of an experienced programmer with technical knowledge of the set-up to be used, as well as a concept and a complete definition of the details associated with the operations. Moreover, considering some industrial applications such as coating, painting, and polishing, which commonly require the presence of highly skilled shop floor operators, the translation of this human craftsmanship into robot language using the available programming tools is still a very difficult task. In this regard, this paper presents a programming by demonstration solution, that allows a skilled shop floor operator to directly teach the industrial robot. The proposed system is based on the 6D Mimic innovative solution, endowed with an IMU sensor as to enable the system to tolerate temporary occlusions of the 6D Marker. Results show that, in the event of an occlusion, a reliable and highly accurate pose estimation is achieved using the IMU data. Furthermore, the selected IMU was a low-cost model, to not severely increase the 6D Mimic cost, despite lowering the quality of the readings. Even in these conditions, the developed algorithm was able to produce high-quality estimations during short time occlusions.

A Graphical User Interface for Industrial Robot Programming in Non-Repetitive Tasks

We present ClonEvol, a visual analysis tool that assists in obtaining insight into the state and the evolution of a C/C++/Java source code base on project, file and scope level. ClonEvol combines information obtained from the software versioning system and contents of files that change between versions; The tool operates as tool-chain of Subversion (SVN), Doxygen (applied as static analyzer) and Simian as code duplication detector. The consolidated information is presented to the user in an interactive visual manner. The focus of the presented tool lies on scalability (in time and space) concerning data acquisition, data processing and visualization, and ease of use. The visualization is approached by using a (mirrored) radial tree to show the file and scope structures, complemented with hierarchically bundled edges that show clone relations. We demonstrate the use of ClonEvol on a real world code base.

This paper presents a novel tablet based end-user interface for industrial robot programming (called Hammer). This application makes easier to program tasks for industrial robots like polishing, milling or grinding. It is based on the Scratch programming language, but specifically design and created for Android OS. It is a visual programming concept that allows non-skilled programmer operators to create programs. The application also allows to monitor the tasks while it is being executed by overlapping real time information through augmented reality. The application includes a teach pendant screen that can be customized according to the operator needs at every moment.

임베디드 기기는 시퀀스 제어 기능과 수치연산 기능을 활용하여 제어 프로그램에 따라 산업현장의 기기 등 다양한 자동화 시스템에 활용된다. 현재 임베디드 기기는 기업의 산업현장, 원전, 대중교통 같은 국가기반시설에서 제어 시스템으로 활용되고 있다. 따라서 임베디드 기기를 대상으로 하는 공격은 큰 경제적 손실과 사회적 손실을 야기할 수 있다. 임베디드 기기를 대상으로 하는 공격은 대부분 데이터, 코드 변조로서 제어 프로그램을 대상으로 이루어진다. 산업 자동화 임베디드 기기의 제어 프로 그램은 일반적인 프로그래밍 언어와 달리 회로 구조를 표현하기 위하여 설계되었고, 대부분의 산업 자동화 제어 프로그램은 그래픽 기반 언어인 LAD로 설계되어있어 정적분석이 용이하지 않다. 이러한 특징으로 인하여 산업 자동화 제어 프로그램에 대한 취약점 분석 및 보안 관련 연구는 정형 검증, 실시간 모니터링 수준에 그친다. 또한 사전에 취약점을 탐지하고 공격에 대한 대비가 가능한 산업 자동화 제어 프로그램 정적분석 연구는 매우 저조한 실정이다. 따라서 본 연구에서는 산업 자동화 임베디드 프로그램에 대한 정적분석 효율성 증대를 위하여 회로 구조를 표현하기 위해 설계된 산업 자동화 제어 프로그램을 논리식으로 표현하기 위한 방법을 제시한다. 또한 다양한 제조사의 산업 자동화 제어 프로그램을 통합적으로 분석하기 위하여 LLVM IR을 활용한 중간어 변환 기술을 제안한다. LLVM IR을 활용함으로서 동적 분석에 대한 통합분석이 가능하다. 본연구에서는 해당 방법에 대한 검증을 위하여 S 社의 제어 프로그램을 대상으로 하여 논리식 형태의 중간어로 변환하는 프로그 램의 시제품을 개발하였다.Utilizing sequence control and numerical computing, embedded devices are used in a variety of automated systems, including those at industrial sites, in accordance with their control program. Since embedded devices are used as a control system in corporate industrial complexes, nuclear power plants and public transport infrastructure nowadays, deliberate attacks on them can cause significant economic and social damages. Most attacks aimed at embedded devices are data-coded, code-modulated, and control-programmed. The control programs for industry-automated embedded devices are designed to represent circuit structures, unlike common programming languages, and most industrial automation control programs are designed with a graphical language, LAD, which is difficult to process static analysis. Because of these characteristics, the vulnerability analysis and security related studies for industry automation control programs have only progressed up to the formal verification, real-time monitoring levels. Furthermore, the static analysis of industrial automation control programs, which can detect vulnerabilities in advance and prepare for attacks, stays poorly researched. Therefore, this study suggests a method to present a discussion on an industry automation control program designed to represent the circuit structure to increase the efficiency of static analysis of embedded industrial automation programs. It also proposes a medium term translation technology exploiting LLVM IR to comprehensively analyze the industrial automation control programs of various manufacturers. By using LLVM IR, it is possible to perform integrated analysis on dynamic analysis. In this study, a prototype program that converts to a logical expression type of medium language was developed with regards to the S company s control program in order to verify our method.

The paper focuses on the SFT concept for a combined rail and road service including the main elements for construction and installation. The areas of current cooperation between Saipem, the University of Naples Federico II and the Politecnico di Milano, all involved since many years in the development of the SFT concept and technology, are presented together with the joint work plan for a potential future phase of project engineering. The joined activity is framed in established Cooperation Agreements between Saipem and the above Universities, for consolidating some technical and execution features characterizing Saipem’s SFT Concept, which is based on competences and capabilities developed for the Offshore O&G Industry and made available to this civil infrastructure. Finally, the way the SFT constitutes an unparalleled opportunity to exploit the Industry capabilities and experience in the fields of structural engineering, steel industry, naval constructions, yard fabrication, manufacturing, and robotics industry is discussed.

In today’s era of Generative AI, the Large Language Model (LLMs)applications are largely used to generate functioning source code. These applications simply does not require any programming skill except a prompt. However, the LLM generated codes are prone to safety and efficiency concerns. A common safety concerns in popular programming languages source code like Java, C++ and C are SQL injection, pointer dereferencing, improper input validation, etc. There are several academic studies and industry approaches to enable a strong and safe AI code generation such as prompt inversion, formal verification, and many more. In this paper, we analyze both the industry and academic approach to reduce and fix the threats over AI generated code and discussed key findings. The platform like Veracode that uses static analysis, dynamic testing and the platform CrowdStrike working to develop self-learning, multi-agent AI systems that employ Red Teaming capabilities. The academic benchmark like CodeLMSec that proposed black-box vulnerability probing framework, FormAI-v2 applies a large-scale formal verification for C language vulnerabilities, and the CodeSecEval benchmark that is based on prompt inversion to evaluate secure code generation and repair. Our studies on the mentioned benchmark highlights that the currently LLM generated source code persists vulnerabilities due to lack of benchmark dataset. The unsafe code fixes are approached in one direction only, either based on static analysis or dynamic analysis.