Safety monitoring method and apparatus for an industrial control system

A non-transitory machine-readable medium, on which program code sections of a computer program are stored, the program code sections being executable by a processor of a controller to, when the program code sections are executed by the processor,

• obtain first data, wherein the first data is data generated during a process of operating an industrial control system;
• perform first statistics on the first data, wherein the first statistics include a time statistic performed on at least one first characteristic of the first data, a time statistic result of at least one first characteristic being usable by a user to identify an abnormal behavior in the industrial control system;
• provide a result of the first statistics for the user, wherein providing the result of the first statistics includes displaying the result to the user, the processor is specifically configured to display the result of the first statistics to the user on a touchscreen, and obtain an operation performed by the user on the result of the first statistics when an abnormal behavior in the industrial control system is suspected, and wherein the operation is used for selecting the data range for further analysis, wherein obtaining the operation performed by the user on the result of the first statistics, the processor is specifically configured to obtain a touch operation performed, on the touchscreen, by the user on the displayed result of the first statistics;
• the processor is further configured to:
• determine, based on the operation, a target time period related to the first statistics and second data satisfying a preset condition in the first data;
• obtain a result of second statistics in the target time period, wherein the second statistics include a time statistic performed on at least one second characteristic of the second data and a time statistic result of the at least one second characteristic being usable by the user to analyze the abnormal behavior in the industrial control system;
• and
• perform a safety analysis on the industrial control system based on the result of the second statistics in the target time period, wherein the at least one second characteristic is for an in-depth analysis of identified abnormal behavior and is different from the at least one first characteristic.

A safety monitoring apparatus for an industrial control system, comprising:

• at least one memory, configured to store machine-readable code;
• and
• at least one processor, configured to invoke the machine-readable code, to perform safety monitoring including:
• obtaining first data, the first data being data generated during a process of operating the industrial control system,
• performing first statistics on the first data, the first statistics including time statistics compiled on at least one first characteristic of the first data, time statistic results of at least one first characteristic being usable by a user to identify an abnormal behavior in the industrial control system,
• providing a result of the first statistics to the user, wherein providing a result of the first statistics includes displaying the result to the user via a touchscreen,
• obtaining an operation performed by the user on the result of the first statistics, wherein obtaining the operation performed by the user on the result of the first statistics includes obtaining a touch operation performed on the touchscreen by the user on the displayed result of the first statistics, wherein the operation is performed by the user when an abnormal behavior in the industrial control system is suspected, and wherein the operation is used for selecting a data range for further analysis,
• determining, based on the operation, a target time period related to the first statistics and second data satisfying a preset condition in the first data,
• obtaining a result of second statistics over the target time period, the second statistics including time statistics compiled on at least one second characteristic of the second data, and a time statistic result of the at least one second characteristic is used by the user to analyze the abnormal behavior in the industrial control system, and
• performing a safety analysis on the industrial control system based on the result of the second statistics in the target time period, wherein the at least one second characteristic is for an in-depth analysis of identified abnormal behavior and is different from the at least on first characteristic.