# US 11,029,676 B2 · Safety monitoring method and apparatus for an industrial control system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,029,676 B2
- Document ID: US11029676B2
- Status: Granted
- Kind: B2
- Application number: 16/288,381
- Filed: 2019-02-28
- Published: 2019-09-05
- Granted: 2021-06-08
- Earliest claimed: 2018-03-01
- Assignees: Siemens Aktiengesellschaft
- Applicants: Siemens Aktiengesellschaft
- Inventors: Dai Fei Guo
- Web page: https://patentgrep.com/patent/US11029676B2

## CPC

- G05B 23/0221: {Preprocessing measurements, e.g. data collection rate adjustment; Standardization of measurements; Time series or signal analysis, e.g. frequency analysis or wavelets; Trustworthiness of measurements; Indexes therefor; Measurements using easily measured parameters to estimate parameters difficult to measure; Virtual sensor creation; De-noising; Sensor fusion; Unconventional preprocessing inherently present in specific fault detection methods like PCA-based methods}
- G05B 23/0216: {Human interface functionality, e.g. monitoring system providing help to the user in the selection of tests or in its configuration}
- G06F 3/0488: using a touch-screen or digitiser, e.g. input of commands through traced gestures
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A safety monitoring method and apparatus for an industrial control system include an advantage of quick and accurate detection of an abnormal behavior in the industrial control system. An embodiment of the method includes: providing the first data generated during the process of operating of an industrial control system and performing the first statistics on the first data; providing a result of the first statistics to a user; obtaining an operation performed by the user on the result of the first statistics; determining, based on the operation, a target time period related to the first statistics and the second data satisfying a preset condition in the first data; and obtaining a result of second statistics in the target time period, and based on the result thereof, performing the safety analysis on the industrial control system.

## Claims

### Claim 1

A safety monitoring method for an industrial control system, the method comprising:
obtaining first data, the first data being data generated during a process of operating the industrial control system;
performing first statistics on the first data, the first statistics including time statistics compiled on at least one first characteristic of the first data, time statistic results of at least one first characteristic being usable by a user to identify an abnormal behavior in the industrial control system;
providing a result of the first statistics to the user, wherein providing a result of the first statistics includes displaying the result to the user on a touchscreen;
obtaining an operation performed by the user on the result of the first statistics, wherein obtaining the operation performed by the user on the result of the first statistics includes obtaining a touch operation performed on the touchscreen by the user on the displayed result of the first statistics, wherein the operation is performed by the user when an abnormal behavior in the industrial control system is suspected, and wherein the operation is used for selecting a data range for further analysis;
determining, based on the operation, a target time period related to the first statistics and second data satisfying a preset condition in the first data;
obtaining a result of second statistics over the target time period, the second statistics including time statistics compiled on at least one second characteristic of the second data, and a time statistic result of the at least one second characteristic is used by the user to analyze the abnormal behavior in the industrial control system; and
performing a safety analysis on the industrial control system based on the result of the second statistics in the target time period, wherein the at least one second characteristic is for an in-depth analysis of identified abnormal behavior and is different from the at least one first characteristic.

### Claim 2 (depends on 1)

The method of claim 1, wherein the performing of the safety analysis, based on the result of the second statistics in the target time period, on the industrial control system includes
comparing the result of the second statistics in the target time period with a result of the second statistics in at least one previous time period corresponding to the target time period; and determining, based on a result of the comparing, whether a safety event happens in the industrial control system in the target time period.

### Claim 3 (depends on 2)

The method of claim 2, wherein
the comparing of the result of the second statistics in the target time period with a result of the second statistics in at least one previous time period corresponding to the target time period includes
determining, for each of at least one second characteristic, a deviation level between the result of the second statistics in the target time period and the result of the second statistics in at least one previous time period corresponding to the target time period; and
wherein the determining, based on the result of the comparing, whether a safety event happens in the industrial control system in the target time period, includes
performing a weighted calculation on the deviation level corresponding to at least one second characteristic, to obtain an overall deviation level; and
determining, upon the overall deviation level being relatively greater than a preset overall deviation level threshold, that a safety event happens in the industrial control system in the target time period, or otherwise determining that no safety event happens in the industrial control system in the target time period.

### Claim 4

A non-transitory machine-readable medium, on which program code sections of a computer program are stored, the program code sections being executable by a processor of a controller to, when the program code sections are executed by the processor,
obtain first data, wherein the first data is data generated during a process of operating an industrial control system;
perform first statistics on the first data, wherein the first statistics include a time statistic performed on at least one first characteristic of the first data, a time statistic result of at least one first characteristic being usable by a user to identify an abnormal behavior in the industrial control system;
provide a result of the first statistics for the user, wherein providing the result of the first statistics includes displaying the result to the user, the processor is specifically configured to display the result of the first statistics to the user on a touchscreen, and obtain an operation performed by the user on the result of the first statistics when an abnormal behavior in the industrial control system is suspected, and wherein the operation is used for selecting the data range for further analysis, wherein obtaining the operation performed by the user on the result of the first statistics, the processor is specifically configured to obtain a touch operation performed, on the touchscreen, by the user on the displayed result of the first statistics; the processor is further configured to:
determine, based on the operation, a target time period related to the first statistics and second data satisfying a preset condition in the first data;
obtain a result of second statistics in the target time period, wherein the second statistics include a time statistic performed on at least one second characteristic of the second data and a time statistic result of the at least one second characteristic being usable by the user to analyze the abnormal behavior in the industrial control system; and
perform a safety analysis on the industrial control system based on the result of the second statistics in the target time period, wherein the at least one second characteristic is for an in-depth analysis of identified abnormal behavior and is different from the at least one first characteristic.

### Claim 5 (depends on 4)

The non-transitory machine-readable medium of claim 4, wherein upon performing the safety analysis on the industrial control system based on the result of the second statistics in the target time period, the program codes sections are specifically configured to:
compare the result of the second statistics in the target time period with a result of the second statistics in at least one previous time period corresponding to the target time period; and
determine, based on a comparison result, whether a safety event happens in the industrial control system in the target time period.

### Claim 6 (depends on 5)

The non-transitory machine-readable medium of claim 5, wherein:
upon comparing the result of the second statistics in the target time period with the result of the second statistics in at least one previous time period corresponding to the target time period, the program code sections are specifically configured to:
determine, for each of the at least one second characteristic, a deviation level between the result of the second statistics in the target time period and the result of the second statistics in at least one previous time period corresponding to the target time period; and
upon determining, based on a result of the comparing, whether a safety event happens in the industrial control system in the target time period, the program code sections are specifically configured to:
perform a weighted calculation on the deviation level corresponding to at least one second characteristic, to obtain an overall deviation level; and
determine, upon the overall deviation level being relatively greater than a preset overall deviation level threshold, that a safety event happens in the industrial control system in the target time period, or otherwise, determine that no safety event happens in the industrial control system in the target time period.

### Claim 7

A safety monitoring apparatus for an industrial control system, comprising:
at least one memory, configured to store machine-readable code; and
at least one processor, configured to invoke the machine-readable code, to perform safety monitoring including:
obtaining first data, the first data being data generated during a process of operating the industrial control system,
performing first statistics on the first data, the first statistics including time statistics compiled on at least one first characteristic of the first data, time statistic results of at least one first characteristic being usable by a user to identify an abnormal behavior in the industrial control system,
providing a result of the first statistics to the user, wherein providing a result of the first statistics includes displaying the result to the user via a touchscreen,
obtaining an operation performed by the user on the result of the first statistics, wherein obtaining the operation performed by the user on the result of the first statistics includes obtaining a touch operation performed on the touchscreen by the user on the displayed result of the first statistics, wherein the operation is performed by the user when an abnormal behavior in the industrial control system is suspected, and wherein the operation is used for selecting a data range for further analysis,
determining, based on the operation, a target time period related to the first statistics and second data satisfying a preset condition in the first data,
obtaining a result of second statistics over the target time period, the second statistics including time statistics compiled on at least one second characteristic of the second data, and a time statistic result of the at least one second characteristic is used by the user to analyze the abnormal behavior in the industrial control system, and
performing a safety analysis on the industrial control system based on the result of the second statistics in the target time period, wherein the at least one second characteristic is for an in-depth analysis of identified abnormal behavior and is different from the at least on first characteristic.