Apparatus and method for secure data recording

Abstract

An apparatus and method for secure data logging are disclosed. An exemplary method for secure data transmission from a process control system network includes storing information received by a process controller, including a safety instrumented system controller or a process control system controller, via the process control system network, transmitting the information unidirectionally from the process control system network to a data logger via a data diode, identifying a triggering event on the process control system network, parsing the stored information for event data in response to identifying the triggering event, and transmitting the event data from the data logger to a data extractor.

Description

Technical Field

[0001] The present disclosure relates generally to process control systems and, more particularly, to apparatus and methods for secure data logging. Background Art

[0002] Process control systems are designed to maintain a specific process within desired limits and typically include instrumentation located throughout the plant to collect data for monitoring and troubleshooting purposes. Data collection involves measurements obtained by sensors, including parameters such as pressure, flow rate, temperature, weight, density, velocity, and more. A basic process control system (BPCS) receives input from sensors and process instrumentation, allowing the BPCS to function as the first layer of protection against unsafe conditions. In addition to the BPCS, a safety instrumented system (SIS) is implemented to protect personnel, equipment, and the environment by specifically monitoring safety-related process control system instrumentation to reduce the likelihood or severity of emergencies. Summary of the Invention

[0003] An exemplary method for secure data transmission from a process control system network includes storing information received by a process controller via the process control system network, the process controller comprising a safety instrumented system controller or a process control system controller, the information being transmitted unidirectionally from the process control system network to a data logger via a data diode, identifying a triggering event on the process control system network, parsing the stored information for event data in response to identifying the triggering event, and transmitting the event data from the data logger to a data extractor.

[0004] An exemplary apparatus for secure data transmission from a process control system network includes a data storage for storing information received by a process controller via the process control system network, the process controller including a safety instrumented system controller or a process control system controller, the information being transmitted unidirectionally from the process control system network to a data recorder via a data diode, an event detector for identifying a triggering event on the process control system network, a data parser for parsing the stored information for event data in response to identifying the triggering event, and a connector for transmitting the event data from the data recorder to a data extractor.

[0005] An exemplary non-transitory computer-readable storage medium includes instructions that, when executed, cause a machine to at least store information received by a process controller via a process control system network, the process controller including a safety instrumented system controller or a process control system controller, the information being transmitted unidirectionally from the process control system network to a data recorder via a data diode, identify a triggering event on the process control system network, parse the stored information for event data in response to identifying the triggering event, and transmit the event data from the data recorder to a data extractor. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 is a block diagram of an example process control system that may be configured to utilize the example secure data logger apparatus and methods described herein for the purpose of data extraction via an internal network.

[0007] Figure 2 is a block diagram of an example process control system that may be configured to utilize the example secure data logger apparatus and methods described herein for the purpose of data extraction via an external network.

[0008] Figure 3 is a block diagram illustrating an example data logger for logging data in a process control system network according to the teachings of the present disclosure.

[0009] Figure 4 It means that it can be executed to achieve Figure 3 A flow chart of machine-readable instructions for an exemplary data logger.

[0010] Figure 5 is a schematic diagram of an exemplary processor platform that may be used and / or programmed to perform Figure 4 An exemplary method of, and / or more generally implementing Figure 1 、 Figure 2 as well as Figure 3 An exemplary secure data logger. DETAILED DESCRIPTION

[0011] Process control systems that implement critical processes (e.g., chemical processing plants, power plants, etc.) can present significant safety risks if not properly controlled. A basic process control system (BPCS) provides the first layer of protection by allowing continuous control of the entire process using controllers, logic solvers, and field devices associated with the BPCS. BPCS are commonly implemented using pneumatic control loops, programmable logic controllers, distributed control systems (DCS), discrete control systems, and single-loop controllers. DCSs are used to oversee complex production processes (e.g., large refineries) and include sensors, controllers, and associated computers distributed throughout the plant for the purposes of data acquisition, process control, and storage and graphical display. Additional safety measures can be introduced through automated shutdown sequences combined with operator intervention to shut down the process using a predetermined sequence.

[0012] The Safety Instrumented System (SIS) monitors specialized field devices and other specialized control elements associated with the SIS that are physically and logically separated from the BPCS. The SIS is responsible for safely shutting down the process in response to control conditions that present a significant safety risk. The SIS relies on specialized logic solvers, controllers, safety-certified field devices (e.g., sensors, final control elements, shut-off valves, etc.), data redundancy devices and routines, and safety-certified software code. For example, field sensors (e.g., pneumatic sensors, electrical switches, smart transmitters with on-board diagnostics, etc.) are used to collect information (e.g., temperature, pressure, traffic, etc.) to identify emergency situations. The logic solver provides fail-safe and fault-tolerant operation to determine the actions to be taken based on the collected information, while the final control element (e.g., a pneumatic switching valve operated by a solenoid valve) implements the actions determined by the logic system. For example, the SIS controller can test the safety override of a process control valve by temporarily interrupting the solenoid valve power signal.

[0013] Due to false trip events associated with the SIS, unplanned but safe process shutdowns can occur, resulting in high operating costs. Post-event analysis is used to evaluate process conditions before and after a trip to determine the potential root cause of the event. Data logging capabilities enable the collection of data relevant to pre- and post-trip event analysis. However, this data logging capability must be secure to prevent unauthorized access to the process control system network. Current data acquisition methods include connecting a computer to the control system security network and running a data logging software application on that computer, or remotely connecting to the network to acquire data. Data loggers that allow physical or remote computer connections increase security risks because cyber attack vectors (e.g., malware injection) can be introduced into the SIS (e.g., cyber attack logic solvers or system controllers). Cybersecurity threats can severely impact the availability and integrity of the SIS, and the SIS remains vulnerable to cyber events, as do other industrial control systems, including distributed control systems (DCS). Assuming that SIS controllers protect critical assets (e.g., refineries, power plants, chemical plants, offshore oil rigs, etc.) from potentially catastrophic failures, a successful cyberattack on such systems eliminates the carefully designed safety measures that operators rely on to prevent adverse events. Similarly, an unexpected SIS shutdown caused by a cyberattack could knock production offline, causing operational and financial impacts. Global functional safety standards (e.g., IEC 61511), developed by the International Electrotechnical Commission and addressing system engineering practices for ensuring industrial process safety, require SIS designs to provide resilience to identified safety risks. However, when new cyberattacks are carried out and signatures for identifying such attacks have not yet been developed and deployed to detect abnormal events, commonly used preventative measures (such as antivirus software) may be ineffective.

[0014] The examples disclosed herein eliminate the possibility of data loggers being used to introduce cyber attack vectors into process control systems. In the examples disclosed herein, hardware data diodes can be embedded in data logger devices to eliminate the risk of successful cyber attacks on process control systems via data loggers. In the examples disclosed herein, data loggers can monitor traffic on process control safety networks, but cannot send information to the safety network. In addition, the examples disclosed herein can capture and store metadata, recorded data, and time information required for post-trip event analysis, which can be further used to interpret, search, and report data. For example, recorded data related to pre-trip and post-trip information can be obtained without affecting the safety of the process control system, and actions for saving data logs can be triggered by user-configured selection conditions. As described herein, incorporating hardware data diodes into data loggers does not require any modifications to the SIS architecture to implement data logging. In addition, the data logging activities presented herein can be used to collect and correlate data from various layers of a process control system (e.g., SIS, BPCS) and a distributed control system (DCS). This data is not limited to safety-related event data, but can include any data collection related to a triggering event. Furthermore, the use of hardware data diode-based data loggers is not limited to a single process control system and can be implemented in any industrial control system that requires increased cybersecurity protection. In the examples disclosed herein, data loggers can be used to detect abnormal traffic patterns within a network (e.g., a security network, a regional control network) to trigger an alarm when a significant change in the traffic pattern is detected.

[0015] Figure 1 1 is a block diagram of an exemplary process control system 100 that can be configured to use the exemplary safety data logger apparatus and method described herein for the purpose of data extraction via an internal network. The exemplary process control system 100 includes an exemplary operator station 102. The operator station 102 is communicatively coupled to a process control system controller via a bus or exemplary local area network (LAN) 104, which includes an exemplary basic process control system (BPCS) controller 106 and an exemplary safety instrumented system (SIS) controller 108. In some examples, the LAN 104 is an area control network (ACN) that can be implemented using any desired communication medium and protocol. For example, the LAN 104 can be based on a hardware or wireless Ethernet communication protocol. However, any other suitable wired or wireless communication medium and protocol can be used instead.

[0016] The operator station 102 may be configured to execute operations associated with one or more information technology applications, user interaction applications, and / or communication applications. For example, the operator station 102 may be configured to execute operations associated with process control-related applications and communication applications that enable the station 102 and controller(s) 106 and / or 108 to communicate with other devices or systems using any desired communication medium (e.g., wireless, hardwired, etc.) and protocol (e.g., HTTP, SOAP, etc.).

[0017] The exemplary controller(s) 106 and / or 108 (e.g., BPCS controller 106 and SIS controller 108) can be configured to execute one or more process control routines and / or operate as functions of one or more control loops (which have been generated by a system engineer or other system operator using, for example, operator station 102 or any other workstation, and downloaded to and initialized in the controller(s) 106 and / or 108). The controller(s) 106 and / or 108 can be coupled to a plurality of field devices 110 and 111, respectively, via a digital data bus and input / output (I / O) devices. In some examples, the field devices 110 and 111 can be coupled to the controller(s) 106 and / or 108 via exemplary hardwired link(s) 109. The field devices 110 and 111 can include Fieldbus-compliant valves, actuators, sensors, etc., in which case the field devices 110 and 111 communicate via the digital data bus using a Fieldbus protocol. In some examples, other types of field devices and communication protocols can be used. For example, the field device(s) 110 and 111 may be Profibus, HART, or AS-i compatible devices that communicate via a data bus using Profibus, AS-i, and HART communication protocols.

[0018] Known devices in the process industry have field devices (e.g., sensors, valves, etc.) that are shared by a BPCS and a SIS. For example, sensor data can be shared between a BPCS and a SIS by using a signal distributor and connecting the same sensor to both systems. In other examples, the integrated control and safety system allows a logic solver to share input signal data directly with one or more process controllers. In some examples, the field devices are dedicated to the process controllers (e.g., field device(s) 110 are communicatively coupled to a BPCS controller 106, while field device(s) 111 are communicatively coupled to a SIS controller 108). The BPCS controller 106 and the SIS controller 108 receive signals indicating process measurements obtained by the field devices 110 and 111, respectively, and / or other information related to the field devices 110 and 111, and use this information to execute control routines and generate control signals that are sent to the field devices 110 and 111 via a bus and / or other communication paths to control the operation of the process. Information from the field device(s) 110 and 111 and the controller(s) 106 and 108 may be made available to one or more applications executed by the operator station 102 to enable an operator to perform desired functions with respect to the process, such as viewing the current state of the process, modifying the operation of the process, etc. For example, the SIS controller 108 may read signals from the field device(s) 111 (e.g., field devices that communicate directly with the SIS) and / or the field device(s) 128 (e.g., field devices that communicate with both the BPCS and the SIS) and perform preprogrammed actions to prevent a hazard by providing output(s) to a final control element.

[0019] exist Figure 1, an exemplary SIS 140 includes a SIS controller 108, SIS-specific field device(s) 111, an exemplary data logger 112a, an exemplary local safety network 120, exemplary logic solver(s) 124, and field device(s) 128. An exemplary BPCS 150 includes a BPCS controller 106, BPCS-specific field device(s) 110, an exemplary data logger 131a, an exemplary regional control network 132, exemplary logic solver(s) 136, and field device(s) 128. The local safety network 120 may be a standard Ethernet network dedicated to process safety systems that enables communication between the SIS controller 108 and the logic solver(s) 124. Similarly, the regional control network 132 may be a standard Ethernet network dedicated to process control systems that enables communication between the BPCS controller 106 and the logic solver(s) 136. The logic solver(s) 124 and 136 may include intelligent logic solvers that communicate safety parameters and input data to other logic solvers via the local safety network 120 and / or the regional control network 132, respectively. In some examples, the SIS controller 108 may be connected to the regional control network 132 in addition to the local safety network 120, thereby isolating the SIS-specific logic solver(s) 124 from the process control system. For example, the local safety network 120 may remain dedicated to safety-related purposes, rather than being used for both control and safety, thereby rendering the SIS components unaffected by any failures in the regional control network 132. SIS components may be communicatively coupled via the bus 126 and / or the local safety network 120, and BPCS components may be communicatively coupled via the bus 130 and / or the regional control network 132. The local safety network 120 and the local regional control network 132 may include network switches for controlling the flow of data through the safety network 120 and the regional control network 132.

[0020] The data logger 112a of the SIS 140 is communicatively coupled to the local safety network 120 to capture and store all input information and specific data required to perform the trip analysis. In some examples, if no triggering event is detected in the SIS 140, the information can be continuously stored in a data storage component (e.g., a hard disk) and overwritten after a period of time (e.g., a user-configured period of time). In some examples, the data logger 112a records all data before and after the detection of the triggering event based on user-configurable settings, such as the following in conjunction with Figure 3-4Detailed description is given in the accompanying drawings. Such data may include timestamp information for each collected data point provided by the SIS 140. In some examples, the data capture activities of the data logger 112a may include recording the integrity or status of each data point captured for use during trip event analysis (e.g., quality control data), or any other type of analysis to be performed using the data captured by the data logger 112a (e.g., user-configured data to be captured by the data logger 112a). For example, a comprehensive evaluation of the data may require that the data integrity is not compromised (e.g., the level of accuracy, completeness, and consistency of the data is to be considered during the analysis). Although user configuration of the data logger 112a may be performed (e.g., defining the parameters to be collected, such as by exporting information from the SIS 140 to configure the collection points within the data logger 112a), no modifications need to be made to the SIS 140 to implement data logging using the data logger 112a. For example, unlike known data logging applications, it is not necessary to install software or enable certain services on a SIS engineering station (e.g., operator station 102) to allow the data logger 112a to perform information acquisition from the SIS 140 because the data logger 112a is able to discover the process control network and can automatically identify SIS-specific devices on the process control system network. Although the data logger 112a is a SIS-specific data logger, the exemplary data logger 131a is a BPCS-specific data logger that can be communicatively coupled to the regional control network 132 to capture and store all input information and BPCS-specific data that can be acquired for off-net evaluation as needed.

[0021] The data loggers 112a and 131a include respective integrated hardware data diodes 112b and 131b to prevent the data loggers 112a and / or 131a from being used as attack vectors (e.g., for purposes of cybersecurity attacks on the process control system 100 via malware injection). Figure 1In the example of FIG. 1 , data diodes 112 b and 131 b are shown within data loggers 112 a and 131 a, respectively. In this example, the connection between each of the data loggers and each of the data diodes is a physical connection. However, in some examples, the connection between the data loggers and the data diodes may be a logical connection rather than a physical connection. The data diodes 112 b and 131 b provide a listen-only capability to the data loggers 112 a and 131 a, enabling the data loggers 112 a and 131 a to capture and store input information, passing the information unidirectionally (e.g., unidirectionally) to the corresponding example data extractors 116 and / or 117, but preventing any input from the data extractors 116 and 117 to the process control system 100 (e.g., input to the SIS 140 via the data logger 112 a and / or input to the BPCS 150 via the data logger 131 a). In some examples, data diodes 112b and 131b can include two nodes or circuits (e.g., a "send-only" node and a "receive-only" node) that allow data to flow in only one direction from a source (e.g., local safety network 120 to data logger 112a via data diode 112b). In some examples, data diodes 112b and 131b can include an optical fiber with a transmitter (e.g., a port for sending information to an external device) on one side and a receiver (e.g., a port for receiving information from a process control system) on the other side to ensure that data can only be transmitted in one direction. For example, data diodes 112b and 131b can include interconnected switch fabrics (e.g., a first switch fabric and a second switch fabric) such that a port of the first switch fabric that transmits data (e.g., data from BPCS controller 106 and / or SIS controller 108 and / or data from local safety network 120 and / or regional control network 132) is connected to a port of the second switch fabric that receives data (e.g., data logger(s) 112a and / or 131a). However, there are no other connections between the switch fabrics to maintain a unidirectional flow of data. The switch fabric can be configured to ignore the link state (e.g., "link up" or "link down") for these interconnected switch ports, thereby allowing other ports of the first switch fabric to forward data packets (e.g., data sent over the network) to the second switch fabric. In some examples, a switch fabric port receiving data (e.g., a port of the second switch fabric, also referred to as an interconnect port because it can connect two separate devices (such as data recorder 112a and data extractor 116)) can forward the received data packets to other ports. In some examples, the switch fabric is configured to forward traffic as described above regardless of the internal MAC address table that may have been learned.For example, a MAC address table contains address information that a switch can use to forward traffic between ports, such that a MAC address in the table is associated with one or more ports. By disabling MAC address learning, the switch fabric will forward traffic based on a given configuration, thereby promoting a unidirectional flow of data while allowing devices connected to other ports of the switch to provide a good (e.g., connected) status. Data diodes extending from a network (e.g., the local security network 120 and / or the regional control network 132), as shown in conjunction with exemplary data diodes 112b and 131b, are oriented to transmit data out of the network, allowing the network to remain protected by ensuring that the same connection cannot be used in the opposite direction to reach the security network and impact the process control system 100 environment. In this way, data diodes can be used to segment a network, protect a network, and / or transmit information in a unidirectional manner (e.g., from the network to a data logger and then to a data extractor). In some examples, data diodes 112b and 131b may be embedded in data loggers 112a and 131a to send data from local security network 120 and / or regional control network 132 to external systems and / or users without creating a threat vector back to the security network.

[0022] exist Figure 1 In the example of FIG. 1 , data transmission from data loggers 112 a and 131 a to data extractors 116 and 117 , respectively, occurs using a local area network, and Figure 2The example details the use of a data logger to transmit data via an external network. In contrast to using software that is also vulnerable to network attacks (e.g., such as a firewall), embedding data diodes in the data logger allows for hardware-enforced data transmission, which provides a level of network security that is difficult to subvert using external attacks. However, the data diode-based data logger disclosed herein is not limited to application in safety instrumented systems or basic process control systems and, therefore, can be used in any type of industrial process control application (e.g., in a distributed control system) to enhance security. For example, because data diodes 112b and 131b are hardware-based, online attacks on data diodes 112b and 131b are difficult to perform because the (multiple) data diodes do not include any software, logic, or field programmable gate arrays and allow signals to propagate in one direction via a physical path. Similarly, any issues on the data logger network (e.g., a collection of data loggers connected together) will not affect the integrity of the safety network. For example, assuming that a data diode (e.g., data diode(s) 112b and 131b) is located between a process control system network (e.g., local safety network 120 and / or regional control network 132) and a data logger (e.g., data logger(s) 112a and / or 131a), since data is transmitted from the network to the data logger via the data diode, the data logger does not affect the network it is monitoring. In some examples, data logger(s) 112a and / or 131a can be configured to connect to more than one network (e.g., data logger 112a can be configured to connect to both local safety network 120 and regional control network 132) if appropriate security safeguards are in place. In an example where data collection is related to trip analysis, data logging can be configured to automatically discard any data not required for analysis to prevent the risk of using the data logger as a mechanism to decode safety network traffic for malicious purposes. In some examples, the SIS 140 and / or the BPCS 150 can be alerted when the data logger(s) 112a and / or 131a are not operational (e.g., by sending information from the data logger 112a to the SIS 140). In such examples of alerting the process control system that the data logger(s) 112a and / or 131a are not functioning properly, there is no traffic to the safety network 120. For example, the data logger 112a provides the information using a physical signal (e.g., a dry contact, such as the alarm 118) or a message on a separate network other than the safety network 120 (e.g., such as a message sent to the operator station 102 via the zone control network 132).

[0023] In some examples, data loggers 112a and 131a can be used to detect unusual traffic patterns within one or more safety networks. For example, data loggers 112a and 131a can be used to detect unexpected network nodes and trigger alarms (e.g., exemplary alarms 118, 119 connected to data logger(s) 112a and / or 131a) in response to such detection. For example, data logger(s) 112a and / or 131a can generate a baseline of traffic on the local safety network 120 and / or the regional control network 132. If data logger(s) 112a and / or 131a detect a significant change in traffic patterns, one or more alarms 118 and / or 119 can be used to alert SIS 140 and / or BPCS 150 of the potential safety issue. In some examples, one or more data loggers can be used to collect data on other networks (e.g., data logger 112a of SIS 140 can be used to collect data from the regional control network 132 of BPCS 150 in addition to the local safety network 120). Data collection in both SIS 140 and BPCS 150 (e.g. Figure 1As shown in the example of , where data logger 112a and data logger 131a are used to collect data from two process control system networks, both can be used to coordinate trigger signals so that the recorded data can be correlated. For example, using data collected from both SIS 140 and BPCS 150 allows for determining whether a SIS demand was generated by a BPCS failure. Thus, access to both data sets via one or more of the data logger(s) 112a and / or 131a can improve root cause analysis. In some examples, the data logger(s) 112a and / or 131a can include multiple ports, wherein the data logger(s) 112a and / or 131a have one or more data diodes (e.g., a data diode for each port). For example, the data logger(s) 112a and / or 131a can communicate via link 113, which allows the data loggers 112a and / or 131a to exchange information about the SIS 140 and / or BPCS 150. As information exchanges between data logger 112a and data logger 131a, SIS 140 remains isolated from BPCS 150 due to the positioning of data diode 112b, allowing the data logger to receive information from safety network 120 but not send information back to network 120. This provides additional protection for the process control system network in the event that data logger(s) 112a and / or 131a are damaged. In some examples, using the data loggers requires changing the switch configuration (e.g., setting a port to promiscuous mode) to allow all network traffic to be sent to that port. In some examples, data loggers 112a and 131a can be deployed as in-line devices to prevent the need to change the port configuration at the network switch (e.g., the network switch used for the local safety network 120 and / or the zone control network 132). In some examples, the data logger(s) 112a and / or 131a may include two ports (e.g., two ports for SIS 140 and / or two ports for BPCS 150 and / or one port each for SIS 140 and BPCS 150). This ensures that no changes are required to the control system network switches. For example, Figure 1 As shown, the data logger 112a is connected between a local safety network 120, which may include a network switch, and a network node to be monitored (e.g., a SIS controller 108). In some examples, the network node to be monitored may be, for example, a logic solver(s) 124 of a SIS. Figure 1As shown, data logger 131a is connected between a control system network switch (e.g., a network switch of the regional control network 132) and a network node to be monitored (e.g., BPCS controller 106). In some examples, data logger(s) 112a and / or 131a may have additional ports for networking with other data loggers (e.g., allowing SIS-specific data logger 112a to be networked with BPCS-specific data logger 131a), as well as additional dry contacts for alarm purposes (e.g., using alarm(s) 118 and / or 119). In some examples, one of the ports of data logger(s) 112a and / or 131a for BPCS 150 connection or SIS 140 connection may be disabled and instead connected to an unused port on the SIS 140 network (e.g., using a network switch of the local safety network 120) or the BPCS 150 network (e.g., using a network switch of the regional control network 132).

[0024] The data extractors 116 and / or 117 retrieve data stored in the data logger(s) 112a and / or 131a. For example, the data extractors 116 and / or 117 may be implemented using a computing device (e.g., a laptop or other mobile computer) that can connect to the data logger(s) 112a and / or 131a via Bluetooth. Such a connection requires physical access to the data logger(s) 112a and / or 131a (e.g., access to an internal network), which presents a lower security risk (e.g., as in conjunction with a remote network connection) than extracting data using a remote network connection. Figure 2 (described herein). Data extractor(s) 116 and / or 117 may also be a USB drive that is physically plugged into data logger(s) 112a and / or 131a. In some examples, a single computer may be used as data extractor 116 or 117 to extract data from data logger(s) 112a and / or 131a that are connected via separate and / or isolated networks.

[0025] The logic solver(s) 124 are implemented using the SIS controller 108, which is configured to implement one or more safety instrumented functions (SIFs). For example, a SIF may include monitoring one or more process conditions associated with one or more specific hazards and / or unsafe conditions, and evaluating the process conditions to determine whether shutdown of the process is warranted. If shutdown of the process is warranted, one or more field devices, components, and / or elements (e.g., shutoff valves) are engaged to implement or execute the shutdown. In some examples, each SIF may be implemented using at least one sensing device, a logic solver, and a field device. The logic solver(s) 124 may be configured to monitor at least one process control parameter via one or more sensors and, if a hazardous condition is detected, operate a field device (e.g., field device(s) 128) to achieve a safe shutdown of the process. For example, the logic solver(s) 124 may be communicatively coupled (e.g., via bus 126) to a field device 128 (e.g., a pressure sensor that senses pressure in a vessel or tank) that may be configured to assist in the shutdown procedure (e.g., opening a vent valve if an unsafe overpressure condition is detected via the pressure sensor). The logic solver(s) 124 may be configured to implement one or more safety instrumented functions and may be communicatively coupled to multiple safety level or certified field devices. Figure 1 As shown, the logic solver(s) 124 are communicatively coupled to the SIS controller 108 via an exemplary bus 126 and / or local safety network 120. However, the logic solver(s) 124 may alternatively be communicatively coupled within the system 100 in any other desired manner. Regardless of how the logic solver(s) 124 are coupled to the system 100, the logic solver(s) 124 are preferably, but not necessarily, logical counterparts to the SIS controller 108. Unlike the logic solver(s) 124, the logic solver(s) 136 are separate from the SIS 140 and do not have access to the SIS local safety network 120, which is also not accessible to other components of the BPCS 150. In some examples, the BPCS controller 106 may receive information from the logic solver(s) 124 via a different bus to allow plant operators to view SIS information. In some examples, as described above, a data diode-based data logger (e.g., data logger 131a) can be used to obtain this information, using an additional port to connect to a local safety network (e.g., via a local safety network 120 switch). In some examples, an additional port on data logger 131a can be used to connect to another data logger (e.g., data logger 112a) to obtain information related to the SIS.

[0026] The field devices 110, 111, and 128 can be smart or non-smart field devices, including sensors, actuators, and / or other process control devices that can be used to monitor process conditions and / or implement a controlled shutdown of the process control system 100. For example, the field devices 110, 111, and 128 can be safety-certified or service-rated sensors, temperature sensors, pressure sensors, shutoff valves, exhaust valves, isolation valves, critical on / off valves, and the like. Any number of field devices and / or logic solvers can be implemented in the process control system for any number of desired process control or safety instrumented functions. In the case where the field devices 128 are smart devices, for example, the logic solver 124 can communicate with the field devices 128 using a hardwired digital communication protocol (e.g., HART, Fieldbus, etc.). However, any other type of communication medium (e.g., wired, wireless, etc.) and protocol can be used instead.

[0027] Figure 2 is a block diagram of an example process control system 200 that may be configured to utilize the example secure data logger apparatus and methods described herein for the purpose of data extraction via an external network. Figure 2 Some elements of the illustrated examples are combined with the above Figure 1 Therefore, the description of the same elements will not be repeated here. Figure 2 Like elements are shown with like reference numerals in the accompanying drawings, which provides a complete description of those like numbered elements. Figure 1 Compared to the example shown in Figure 2 In the example process control system 200 of FIG. 1 , the example data loggers 112 a and 131 a have the additional capability of transmitting data to a data extractor via an external network (eg, external network 212 ). For example, Figure 2The data loggers 112a and 131a may provide edge gateway capabilities (e.g., access to external networks outside of the process control network, including the local safety network 120 and the regional control network 132). For example, the data loggers 112a and 131a may be used to pre-process data locally at the edge before sending it to the cloud (e.g., the external network 212), thereby providing a gateway between the networks via data flows at the boundary between the control networks. In this way, the data logger(s) 112a and / or 131a use the collected data to allow it to be transmitted to an end user via the external network 212 instead of using a separate edge gateway and data logging device. For example, the data logger(s) 112a and / or 131a may route information from the control system (e.g., the SIS 240 and / or BPCS 250) that is not used by the control system (e.g., the BPCS controller 108 and / or the SIS controller 108) in a secure manner to make it available to external applications.

[0028] In some examples, the data logger(s) 112a and / or 131a may be connected to one or more SIS 240 and / or BPCS input / output (I / O) system(s) 208 and / or 216, as in Figure 2 As shown in the example of FIG. (a) and (b) the I / O system(s) 208 and / or 216 receive data from the field device(s) 128 and convert the data into communications that can be processed by the example controller(s) 106 and / or 108. Similarly, the I / O system(s) 208 and / or 216 can convert data or communications from the controller(s) 106 and / or 108 into a data format that can be processed by the corresponding field device(s) 128. In some examples, the I / O subsystem is a master control system I / O subsystem that receives information from field devices (e.g., field device(s) 128) deployed in the process control system. In such an example, the data loggers 112a and 131a can listen to data available from the regional control network 132 and / or the local safety network 120 via the I / O system and send the data via the external network. In such an example, the data logger(s) 112a and / or 131a do not need to access each individual process control system network. Communications from the data logger(s) 112a and / or 131a to the external network 212 may occur via, for example, an Ethernet connection, a coaxial cable system, a satellite system, a line-of-site wireless system, or the like.

[0029] Figure 3is a block diagram illustrating an example data logger for logging data in the process control system network 100 and / or 200 according to the teachings of the present disclosure. The example data logger 300 may be used to implement the data loggers 112 a and 131 a and includes an example data store 302, an example configurator 304, an example timer 306, an example event detector 308, an example data parser 310, an example identifier 312, and an example connector 314.

[0030] The data store 302 stores information received by process controllers (e.g., the basic process control system (BPCS) controller 106 and / or the safety instrumented system (SIS) controller 108). The process control system information stored by the data store 302 may include any information received by the controllers 106 and / or 108 and captured by the data logger 300. In some examples, the input information may be continuously stored in the data store 302 (e.g., a hard disk). The data store 302 may include data related to the activity of the controllers 106 and / or 108 occurring over a period of time, such as data captured from the field device(s) 110, 111, and / or 128 (e.g., sensors, final control elements, shutoff valves, etc.). In some examples, the data stored in the data store 302 may be overwritten after a specified time period via a user-based configuration. The data captured by the data logger(s) 112a and / or 131a and stored in the data store 302 may include information relevant to performing a trip analysis (e.g., resulting from a trip event associated with an unplanned but safe process control system shutdown). Such information may include a timestamp for each collected data point provided by the controller 106 and / or 108, where the data point corresponds to information related to the state of the process control system (e.g., SIS 240 and / or BPCS 250) (e.g., temperature, pressure, flow rate, weight, strain, etc.). In some examples, the data store 302 stores metadata, recorded data, and time information at the time of broadcast to allow the data logger 300 to be used in developing applications for interpreting, searching, and reporting on the data. In some examples, the data store 302 begins logging data once the data logger 300 is connected to the process control system network. For example, the data logger 300 participates in process control system self-discovery to enable automatic detection of devices on the process control system network.

[0031] The configurator 304 can be used to configure the data logger 300. For example, the configurator 304 can be used to set a time period (e.g., via a timer 306) for storing collected data in the data store 302 before it is overwritten. The timer 306 can be used to determine when a time interval (e.g., a user-configured data collection time interval) has elapsed, causing the data logger 300 to overwrite the existing stored information in the data store 302. In some examples, the data logger 300 can be configured to store safety-related event data (such as recorded data, metadata, and timestamp information) using the configurator 304. In some examples, the configurator 304 can be used to configure the data store 302 based on the type of data evaluation to be performed using the collected process control system-based information. In some examples, the configurator 304 is used to configure the storage and logging of pre-trip and post-trip data for the purpose of analyzing safety-related event information, and can include using the data store 302 to maintain certain logs based on process control system parameters of interest for safety-related event evaluation. For example, certain data logs can help determine the integrity level of a protection system, such as the reliability of process control system components that can be determined through testing.

[0032] The event detector 308 identifies events of interest (e.g., triggering events) on the process control system 100 and / or 200 network. For example, a triggering event can be a safety-related event that occurs on the SIS 240 and / or BPCS 250 network. Safety-related events include the appearance of unexpected nodes on one or more process control networks or a change in the traffic pattern of one or more process control networks that corresponds to a deviation from a designated normal traffic pattern. In some examples, the event can be any event of interest that may occur on the industrial system network (e.g., a change in a specific process control system parameter).

[0033] The data parser 310 parses information stored in the data store 302 for data related to triggering events. For example, in the presence of a safety-related event, the data parser 310 retrieves data before and after the safety-related event. Such data may include logged data, metadata, and timestamp information. This allows for a comprehensive assessment of process control system activity and may include the analysis of data from one or more process control system networks (e.g., Figure 1-2 In some examples, if the data parser 310 cannot recognize any incoming data (e.g., input) from a process controller (e.g., processor controller(s) 106 and / or 108) to the data store 302, the data parser 310 triggers an alarm external to the process control system network (e.g., Figure 1-2118), which is used when the input information of the process controller is not accessible.

[0034] Once the data parser 310 has retrieved data corresponding to data before and / or after a triggering event from the data store 302, the identifier 312 identifies specific data content required for a given assessment (e.g., root cause analysis) from the retrieved data. For example, the identifier 312 may retrieve signal value information, data integrity information, and timestamp information captured by the process controller(s) 106 and / or 108.

[0035] Connector 314 transmits event data to a data extractor (e.g., data extractor 116). In some examples, assuming that a data diode (e.g., data diode 112b) can be embedded in a data logger (e.g., data logger 112a) to transmit data unidirectionally from a process control system network (e.g., local safety network 120) to the data logger (e.g., data logger 112a), the data extractor can receive information from the data logger 300, but the data logger 300 does not allow information to be transmitted to the process control system network (e.g., local safety network 120). The data logger 300 can have multiple connectors (e.g., ports) that allow information to be transmitted (e.g., via an internal network or an external network). In some examples, connector 314 can be used to connect one data logger to another data logger (e.g., a data logger storing data from a different process controller) to receive information about a separate process control system (e.g., aggregated data for both the SIS 240 and the BPCS 250). In some examples, connector 314 is used to transfer data from the regional control network 132 and / or the local safety network 120 via an I / O system (e.g., I / O system(s) 208 and / or 216) to a data extractor (e.g., a USB drive, a laptop, etc.) or an external network (e.g., external network 212) without requiring access to each individual process control system network. In some examples, connector 314 is connected to an embedded computer rather than a general-purpose computer to prevent remote connections and improve hardening (e.g., removing unnecessary applications and services that may introduce security risks). In some examples, acquisition of data may be limited to methods that require physical presence (e.g., connections requiring a computer or other data acquisition means that can be achieved through direct connection to the data logger(s)).

[0036] although Figure 3 The implementation is shown in Figure 1-2 An exemplary embodiment of a data logger device, Figure 3One or more of the elements, processes, and / or devices shown in the example data recorder 300 may be combined, divided, rearranged, omitted, eliminated, and / or implemented in any other manner. Furthermore, the example data store 302, the example configurator 304, the example timer 306, the example event detector 308, the example data parser 310, the example identifier 312, the example connector 314, and / or more generally, the example data recorder 300 may be implemented by hardware, software, firmware, and / or any combination of hardware, software, and / or firmware. Thus, for example, the example data storage 302, the example configurator 304, the example timer 306, the example event detector 308, the example data parser 310, the example identifier 312, the example connector 314, and / or more generally, the example data recorder 300 may be implemented by one or more analog or digital circuits, logic circuits, programmable processor(s), programmable controller(s), graphics processing unit(s) (GPU(s), digital signal processor(s) (DSP(s), application specific integrated circuit(s) (ASIC(s), programmable logic device(s) (PLD(s), and / or field programmable logic device(s) (FPLD(s)). When any of the apparatus claims or system claims of this patent are read to encompass pure software and / or firmware implementations, the example data storage 302, the example configurator 304, the example timer 306, the example event detector 308, the example data parser 310, the example identifier 312, and / or the example connector 314 are expressly defined herein to include a non-transitory computer-readable storage device or storage disk, such as a memory, a digital versatile disk (DVD), a compact disk (CD), a Blu-ray disk, etc., including software and / or firmware. Further, the example data recorder 300 may include, in addition to or in lieu of, Figure 3 In addition to those shown, one or more elements, processes, and / or devices may be included, and / or more than one of any or all of the shown elements, processes, and devices may be included. As used herein, the phrase "in communication," including variations thereof, encompasses direct communication and / or indirect communication through one or more intermediate components, and does not require direct physical (e.g., wired) communication and / or continuous communication, but additionally includes selective communication at periodic intervals, scheduled intervals, non-periodic intervals, and / or one-time events.

[0037] exist Figure 4 The diagram shows the method for implementing Figure 3 The machine readable instructions may be a portion of one or more executable programs or executable programs, such as the following, in conjunction with Figure 5The program is executed by a processor such as the processor 506 shown in the exemplary processor platform 500 discussed. The program may be embodied in software stored in a non-transitory computer-readable storage medium such as a CD-ROM, floppy disk, hard drive, digital versatile disk (DVD), Blu-ray disk, or memory associated with the processor 506, but the entire program and / or portions thereof may alternatively be executed by a device other than the processor 506 and / or embodied in firmware or dedicated hardware. Furthermore, although reference is made to Figure 4 The flowchart shown in describes an exemplary program, however, many other methods of implementing the exemplary data logger 300 may be used instead. For example, the order of execution of the blocks may be changed, and / or some of the blocks described may be changed, eliminated, or combined. Additionally or alternatively, any or all of the blocks may be implemented by one or more hardware circuits (e.g., discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, comparators, operational amplifiers (op-amps), logic circuits, etc.) configured to perform the corresponding operations without the need for software or firmware.

[0038] The machine-readable instructions described herein may be stored in one or more of a compressed format, an encrypted format, a segmented format, a packaged format, and the like. The machine-readable instructions described herein may be stored as data (e.g., portions of instructions, code, code representations, etc.) that can be used to create, manufacture, and / or generate machine-executable instructions. For example, the machine-readable instructions may be segmented and stored on one or more storage devices and / or computing devices (e.g., servers). The machine-readable instructions may require one or more of installation, modification, adaptation, updating, combination, supplementation, configuration, decryption, decompression, unpacking, distribution, redistribution, etc., so that they can be directly read and / or executed by a computing device and / or other machine. For example, the machine-readable instructions may be stored in multiple parts that are compressed, encrypted, and stored on separate computing devices, wherein the parts, when decrypted, decompressed, and combined, form a set of executable instructions that implement a program such as described herein. In another example, the machine-readable instructions may be stored in a state in which they can be read by a computer, but require the addition of a library (e.g., a dynamic link library (DLL)), a software development kit (SDK), an application programming interface (API), etc., in order for the instructions to be executed on a specific computing device or other device. In another example, before the machine-readable instructions and / or corresponding program(s) can be executed in whole or in part, the machine-readable instructions may need to be configured (e.g., stored settings, data inputs, recorded network addresses, etc.). Thus, the disclosed machine-readable instructions and / or corresponding program(s) are intended to encompass such machine-readable instructions and / or programs, regardless of the specific format or state of the machine-readable instructions and / or programs, when stored or otherwise at rest or transmitted.

[0039] As mentioned above, Figure 4 The exemplary processes of can be implemented using executable instructions (e.g., computer and / or machine readable instructions) stored on a non-transitory computer and / or machine readable medium (e.g., a hard drive, flash memory, read-only memory (ROM), compact disc (CD), digital versatile disc (DVD), cache, random access memory (RAM), and / or any other storage device or storage disk in which information is stored for any duration (desirable period of time, permanent, temporary, temporary buffering, and / or cached information). As used herein, the term non-transitory computer-readable storage medium is expressly defined to include any type of computer-readable storage device and / or storage disk and to exclude propagating signals and to exclude transmission media.

[0040] "Include" and "comprising" (and all their forms and tenses) are used herein as open-ended terms. Thus, whenever a claim employs any form of "include" or "comprising" (e.g., includes, comprises, comprising, comprising, including, having, etc.) as a preamble or in any type of claim recitation, it should be understood that additional elements, terms, etc. may be present without falling within the scope of the corresponding claim or recitation. As used herein, when the phrase "at least" is used as a transition term, such as in the preamble of a claim, it is open-ended in the same manner that the terms "include" and "comprising" are open-ended. The term "and / or" when used, for example, in a form such as A, B, and / or C, refers to any combination or subset of A, B, and C, such as (1) only A, (2) only B, (3) only C, (4) A and B, (5) A and C, (6) B and C, and (7) A and B and C. As used herein in the context of describing structures, components, items, objects, and / or things, the phrase "at least one of A and B" is intended to mean embodiments that include any of the following: (1) at least one A, (2) at least one B, and (3) at least one A and at least one B. Similarly, as used herein in the context of describing structures, components, items, objects, and / or things, the phrase "at least one of A or B" is intended to mean embodiments that include any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B. As used herein in describing the performance or execution of processes, instructions, actions, activities, and / or steps, the phrase "at least one of A and B" is intended to mean embodiments that include any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B. Similarly, as used herein in the context of describing the execution or performance of a process, instruction, action, activity, and / or step, the phrase "at least one of A or B" is intended to mean an embodiment that includes any of the following: (1) at least one A, (2) at least one B, and (3) at least one A and at least one B.

[0041] Figure 4 It means that it can be executed to achieve Figure 3Flowchart 400 of machine-readable instructions for an exemplary data logger 300 is shown. A configurator 304 configures data collection points for the data logger based on user input. For example, a user may indicate a time interval at which data collection (e.g., data stored in the data store 302 of the data logger 300) should occur before the data in the data store 302 is overwritten (block 402). Once the data logger 300 is connected to a process control system network (e.g., SIS 240 and / or BPCS 250) via a data diode (e.g., data diode(s) 112b and / or 131b), the data store 302 stores input information from the local safety network 120 and / or the regional control network 132 to the process controller(s) 106 and / or 108 (block 404). An event detector 308 monitors the process control system network information to determine whether a triggering event is detected (block 406). For example, a triggering event may include a safety-related event on the SIS 240 network, such as a trip event (e.g., an unexpected shutdown of the SIS 240). In other examples, a triggering event can be any event defined by a user as being interpreted as a triggering event (e.g., a change in a process control system parameter, an unexpected change in network traffic, etc.). If a triggering event is not detected, the timer 306 determines whether a given time interval (T) has elapsed (e.g., a user-configured time interval) (block 408). If the time interval has not elapsed and a triggering event has not been detected, the data recorder 300 continues to capture and store data from the process control system (block 404). If the time interval has elapsed, the data store 302 begins overwriting existing data with new data (block 410).

[0042] If the event detector 308 detects a triggering event at block 406, the data parser 310 uses the data store 302 to identify data before and after the triggering event (block 412). For example, if the triggering event is a safety-related event (such as a tripping event), evaluating the event to identify potential causes may require the use of data captured before and after the triggering event. In some examples, the data parser 310 parses this data to obtain data specific to the analysis of the triggering event (block 414). This data may include recorded data, metadata, and timestamp information. In some examples, the configurator 304 is used to determine the type of data of interest (e.g., the input required by an application to perform a comprehensive assessment of the triggering event). In some examples, the data logger 300 obtains data related to the event from one or more other data loggers that capture information from the process control system (block 416). For example, the data logger 300 may include several connectors 314 that allow information to be transmitted not only to the data extractors 116 and / or 117 or the external network 212, but also to another data logger. Thus, if the user configuration requires data to be acquired from the entire process control system (e.g., not limited to the SIS 240 and / or BPCS 250), the connector 314 can be used to acquire event-related data to supplement the data acquired from the process control system being monitored (block 418). If the information is collected via the data extractor(s) 116 and / or 117, the connector 314 is connected to the data extractor(s) 116 and / or 117 (block 420). The data diodes 112b and / or 131b enable unidirectional transmission of data from the process control system network to the data recorder 300 so that the data can be acquired using the data extractor 116. In some examples, the data recorder 300 has more than one port for transmitting information via the connector(s) 314 (e.g., one port for transmitting information to another data recorder, another port for transmitting information to a data extractor). The captured data is then used to perform post-mortem analysis (block 422) to determine the root cause of, for example, a trip event or other triggering event (block 424). To improve security by limiting the type and amount of data transmitted to the data extractor 116, for example, the identifier 312 identifies data required for post-analysis (e.g., signal value information, data integrity information, and time stamp information captured by the process controllers 106 and / or 108). The connector 314 only uses the configurator 304 to transmit this data, or any type of data included in the configuration of the data logger(s) 112a and / or 131a, to the data extractor 116.

[0043] Figure 5 can be used and / or programmed to perform Figure 4An exemplary processor platform and / or more generally to implement an exemplary method of Figure 1-3 The processor platform 500 can be, for example, a server, a personal computer, a workstation, a self-learning machine (e.g., a neural network), a mobile device (e.g., a cell phone, a smartphone, a tablet computer, etc. (such as an iPad) TM ), personal digital assistant (PDA), internet appliance, DVD player, CD player, digital video recorder, Blu-ray player, game console, personal video recorder, set-top box, headphones or other wearable device, or any other type of computing device.

[0044] The processor platform 500 of the illustrated example includes a processor 506. The processor 506 of the illustrated example is hardware. For example, the processor 506 can be implemented by one or more integrated circuits, logic circuits, microprocessors, GPUs, DSPs, or controllers from any desired series or manufacturer. The hardware processor can be a semiconductor-based (e.g., silicon-based) device. In this example, the processor 506 implements the configurator 304, timer 306, event detector 308, data parser 310, identifier 312, and connector 314 of (multiple) data recorders 112a and / or 131a.

[0045] The processor 506 of the illustrated example includes a local memory 508 (e.g., a cache). The processor 506 of the illustrated example communicates with a main memory including a volatile memory 502 and a non-volatile memory 504 via a bus 518. The volatile memory 502 may be comprised of synchronous dynamic random access memory (SDRAM), dynamic random access memory (DRAM), Dynamic Random Access Memory The non-volatile memory 504 may be implemented by flash memory and / or any other desired type of storage device. Access to the main memories 502 and 504 is controlled by a memory controller.

[0046] The processor platform 500 of the illustrated example also includes an interface circuit 514. The interface circuit 514 may be implemented by any type of interface standard (such as an Ethernet interface, a universal serial bus (USB), interface, near field communication (NFC) interface and / or PCI Express interface).

[0047] In the example shown, one or more input devices 512 are connected to the interface circuitry 514. The input device(s) 512 allow a user to enter data and commands into the processor 506. This may be implemented through, for example, an audio sensor, a microphone, a camera (still or video), a keyboard, buttons, a mouse, a touch screen, a trackpad, a trackball, isopoint, and / or a voice recognition system.

[0048] One or more output devices 516 are also connected to the interface circuit 514 of the illustrated example. The output device 516 can be implemented, for example, by a display device (e.g., a light emitting diode (LED), an organic light emitting diode (OLED), a liquid crystal display (LCD), a cathode ray tube display (CRT)), an in-place switch (IPS) display, a touch screen, etc.), a tactile output device, a printer, and / or a speaker. Therefore, the interface circuit 514 of the illustrated example typically includes a graphics driver card, a graphics driver chip, or a graphics driver processor.

[0049] The interface circuitry 514 of the illustrated example also includes communication devices (such as transmitters, receivers, transceivers, modems, residential gateways, wireless access points, and / or network interfaces) to facilitate the exchange of data with external machines (e.g., any kind of computing device) via a network 524. Communication may be via, for example, an Ethernet connection, a digital subscriber line (DSL) connection, a telephone line connection, a coaxial cable system, a satellite system, a field-line wireless system, a cellular telephone system, etc.

[0050] The processor platform 500 of the illustrated example also includes one or more mass storage devices 510 for storing software and / or data. Examples of such mass storage devices 510 include floppy disk drives, hard disk drives, compact disk drives, Blu-ray disk drives, redundant arrays of independent disk systems (RAID), and digital versatile disk (DVD) drives. The mass storage includes the exemplary data storage 302.

[0051] Figure 4 The machine-executable instructions 400 may be stored in the mass storage device 510, in the volatile memory 502, in the non-volatile memory 504, and / or on a removable, non-transitory computer-readable storage medium such as a CD or DVD.

[0052] Although certain example methods, apparatus, and systems have been disclosed herein, the scope of coverage of this patent is not limited thereto. On the contrary, this patent covers all methods, apparatus, and articles of manufacture fairly falling within the scope of the claims of this patent.

Claims

1. A method for secure data transmission from a process control system network, comprising: storing information received by a process controller, including a safety instrumented system controller or a process control system controller, via the process control system network, the information being unidirectionally transmitted from the process control system network to a data logger via a data diode; identifying a triggering event on the process control system network; responsive to identifying the triggering event, parsing the information for event data, the information obtained from the data logger; as well as The event data is transmitted from the data logger to a data extractor.

2. The method according to claim 1, wherein Parsing the information includes obtaining data before and after the triggering event.

3. The method according to claim 1 or 2, wherein: Transmitting the event data includes transmitting only one or more of signal value information, data integrity information, and time stamp information captured by the process controller if the triggering event is a safety-related event.

4. The method according to claim 1 or 2, wherein The process control system network includes a local safety network or a regional control network.

5. The method according to claim 4, wherein Parsing the information includes parsing the event data for at least one of the local safety network or the regional control network.

6. The method according to claim 1 or 2, wherein: The event data includes recorded data, metadata, and timestamp information.

7. The method according to claim 1, wherein The triggering event is a safety-related event including the appearance of an unexpected node on the process control system network or a change in a traffic pattern of the process control system network corresponding to a deviation from a traffic pattern designated as normal.

8. The method of claim 1 or 2, further comprising configuring the event data based on user input, the user input including a data collection time interval of interest.

9. The method of claim 8, further comprising determining when a user-configured time interval has elapsed, and overwriting the information when the user-configured time interval has elapsed.

10. The method of claim 1 or 2, further comprising initiating an alarm external to the process control system network, the alarm being used when input information to the process controller is inaccessible.

11. An apparatus for secure data transmission from a process control system network, comprising: a data storage for storing information received by a process controller via the process control system network, the process controller including a safety instrumented system controller or a process control system controller, the information being unidirectionally transmitted from the process control system network to a data logger via a data diode; an event detector for identifying a triggering event on the process control system network; a data parser for parsing the information for event data in response to identifying the triggering event, the information obtained from the data logger; as well as A connector is provided for transmitting the event data from the data logger to a data extractor.

12. The device according to claim 11, wherein The data parser is used to obtain data before and after the triggering event when the triggering event is a security-related event.

13. The device according to claim 12, wherein The connector is used to transmit the event data, where the event data includes one or more of signal value information, data integrity information, and time stamp information captured by the process controller.

14. The device according to any one of claims 11 to 13, wherein: The data parser is for parsing the event data for at least one of a local safety network or a regional control network.

15. The apparatus according to any one of claims 11 to 13, further comprising a configurator for configuring the event data based on user input, the user input including a data collection time interval of interest.

16. The apparatus of claim 15, further comprising a timer to determine when a user-configured time interval has elapsed and to overwrite the information when the user-configured time interval has elapsed.

17. A non-transitory computer-readable storage medium comprising instructions that, when executed, cause a machine to at least: storing information received by a process controller, including a safety instrumented system controller or a process control system controller, via a process control system network, the information being unidirectionally transmitted from the process control system network to a data logger via a data diode; identifying a triggering event on the process control system network; responsive to identifying the triggering event, parsing the information for event data, the information obtained from the data logger; as well as The event data is transmitted from the data logger to a data extractor.

18. The non-transitory computer-readable storage medium of claim 17, wherein: The instructions, when executed, further cause the machine to transmit one or more of signal value information, data integrity information, and timestamp information captured by the process controller.

19. The non-transitory computer-readable storage medium according to claim 17 or 18, wherein: The instructions, when executed, further cause the machine to parse the event data for at least one of a local safety network or a regional control network.

20. The non-transitory computer-readable storage medium according to claim 17 or 18, wherein: The instructions, when executed, further cause the machine to determine when a user-configured time interval has elapsed, and to overwrite the information when the user-configured time interval has elapsed.

Images