# US 12,111,649 B2 · Security-relevant diagnostic messages > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,649 B2 - Document ID: US12111649B2 - Status: Granted - Kind: B2 - Application number: 17/439,849 - Filed: 2020-03-16 - Published: 2022-06-16 - Granted: 2024-10-08 - Earliest claimed: 2019-03-19 - Assignees: Siemens Aktiengesellschaft - Applicants: Siemens Aktiengesellschaft - Inventors: Benjamin Lutz; Anna Palmin - Web page: https://patentgrep.com/patent/US12111649B2 ## CPC - G05B 19/0423: {Input/output} - G05B 23/0254: {based on a quantitative model, e.g. mathematical relationships between inputs and outputs; functions: observer, Kalman filter, residual calculation, Neural Networks} - G05B 23/0272: {Presentation of monitored results, e.g. selection of status reports to be displayed; Filtering information to the user} - H04L 41/0604: using filtering, e.g. reduction of information by using priority, element types, position or time - H04L 41/069: using logs of notifications; Post-processing of notifications - H04L 41/16: using machine learning or artificial intelligence - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for handling security alarms by a control system of a technical installation includes a) receiving diagnostic messages that have been generated by technical objects (7) of a technical installation; b) analyzing the diagnostic messages such that diagnostic messages relevant to the security of an operation of the technical installation are identified by means of comparative data records, where a machine learning network is used to analyze the diagnostic messages to assess the security relevance of the diagnostic messages, where the network is previously trained using special inputs from operators of the technical installation that have assessed past diagnostic messages with regard to their security relevance; c) if necessary, adapting the previously identified diagnostic messages to requirements of a computer-implemented security module of the technical installation and d) transmitting the previously identified and optionally adapted diagnostic messages to the computer-implemented security module of the technical installation. ## Claims ### Claim 1 A method, comprising: a) receiving diagnostic messages generated by technical objects of a technical installation comprising a manufacturing or process installation; b) analyzing the diagnostic messages such that diagnostic messages which are relevant to security of an operation of the technical installation are identified via comparative data records and classifying individual diagnostic messages based on rules stored in a database, a machine learning network being utilized to assess the security relevance of the diagnostic messages and analyze the diagnostic messages to assess the security relevance of the diagnostic messages, said machine learning network being pre-trained utilizing inputs from operators of the technical installation, and said operators having assessed past diagnostic messages with regard to their security relevance; c) adapting the previously identified diagnostic messages to requirements of a computer-implemented security module of the technical installation, when necessary; and d) transmitting the previously identified and optionally adapted diagnostic messages to the computer-implemented security module of the technical installation. ### Claim 2 (depends on 1) The method as claimed in claim 1, wherein the diagnostic messages transmitted to the computer-implemented security module are graphically presented to an operator of the technical installation. ### Claim 3 (depends on 1) The method as claimed in claim 1, wherein at least one of (i) a message class and (ii) a message type of the diagnostic message is taken into account during automated assessment of the security relevance of a diagnostic message. ### Claim 4 (depends on 1) The method as claimed in claim 1, wherein the diagnostic messages previously identified as relevant are adapted to a standard data format before the diagnostic messages are transmitted to the computer-implemented security module of the technical installation. ### Claim 5 (depends on 4) The method as claimed in claim 4, wherein the standard data format comprises a Common Event Format. ### Claim 6 (depends on 1) The method as claimed in claim 1, wherein the machine learning network comprises a neural network. ### Claim 7 A control system for a technical installation, comprising: an operator station server implemented in hardware and including a database; a computer-implemented analyzer; a computer-implemented adapter; and a computer-implemented security module, the analyzer and the adapter being implemented on the operator station server; wherein the computer-implemented analyzer receives diagnostic messages generated by technical objects of a technical installation and analyzes the diagnostic messages such that diagnostic messages relevant for security of an operation of the technical installation are identified and classified based on rules stored in the database; wherein the computer-implemented analyzer utilizes a machine learning network to analyze the diagnostic messages to assess the security relevance of the diagnostic messages, said machine learning network being pre-trained utilizing inputs from operators of the technical installation, and said operators having assessed past diagnostic messages with respect to their security relevance; wherein the computer-implemented analyzer forwards the diagnostic messages previously identified as relevant to the computer-implemented adapter; wherein the computer-implemented adapter, when necessary, adapts the diagnostic messages previously identified as relevant by the computer-implemented analyzer to requirements of the computer-implemented security module; and wherein the computer-implemented analyzer forwards the diagnostic messages previously received from the computer-implemented analyzer to the computer-implemented security module. ### Claim 8 (depends on 7) The control system as claimed in claim 7, further comprising: an operator station client configured to receive diagnostic messages from the operator station server and to present said received diagnostic messages to an operator of the technical installation. ### Claim 9 (depends on 7) The control system as claimed in claim 7, wherein the technical installation comprises a manufacturing or process installation. ### Claim 10 (depends on 7) The control system as claimed in claim 7, where the machine learning network comprises a neural network.