System and method for automatic detection of events in industrial control system

Abstract

The present disclosure relates to a system and method for automatic event detection within an industrial control system environment. The method encompasses the following steps: first, employing a processing unit to execute a log identification procedure, thereby extracting a targeted set of log entries from a plurality of log entries. The method further comprises parsing the set of log entries into a series of data items. The method further involves analyzing these generated data items alongside a series of event definitions (514) - each definition outlining criteria for the recognition of specific events within the log entries-to identify a variety of events (518). The culmination of this process sees the assembly of data items and the identified events presented to the user via a display device, thereby facilitating the monitoring and management of events in an industrial control system through an automated and efficient approach.

Description

[0001] SYSTEM AND METHOD FOR AUTOMATIC DETECTION OF EVENTS IN

[0002] INDUSTRIAL CONTROL SYSTEM

[0003] The present invention pertains to the field of industrial automation and control systems, and more particularly, to a method and system for automatic detection and analysis of events within industrial control systems using advanced data processing and artificial intelligence technologies.

[0004] The Industrial Internet of Things (I loT) is being rapidly adopted, and as a result, a vast infrastructure is supporting an ever-increasing number of linked devices inside the industrial operations landscape. While increasing operational efficiency and data collecting capabilities are made possible by this spread of technology, managing and maintaining industrial control systems becomes increasingly difficult. In particular, the occurrence of service failures in this architecture requires domain specialists to carefully review large amounts of log data.

[0005] The issue domain can be divided into three main components, each of which offers distinct potential for innovation as well as challenges:

[0006] Parsing the Logs: A major obstacle to the development of generic solutions for log analysis is the lack of industry-wide standards regarding the format of software log data. Software services generate log data in a variety of formats, so they need a solution that can parse and transform this unstructured data into a tabular, structured version. They also need a schema that helps them usefully categorize the structured data.

[0007] Identifying and Determining Events: After logs are transformed into structured data, the next task is to determine which events require intervention or attention. A schema that can handle and comprehend these complexities is required because industrial environments frequently have complicated circumstances and observational sequences that set off events. An interface that makes this process easier for domain experts to use is necessary for the definition of events, including the setting of preconditions for their relevance. Creating Events: The main task at hand is creating an execution engine that can create events according to pre-established structures and rules. It also needs to support hierarchical information processing, which enables the creation of complex events from simpler ones, and it needs to enable recursive event definitions in order to accurately capture the complex and nuanced nature of real-world operations.

[0008] Although there may be isolated solutions to these sub-problems in public repositories, there is a clear need for an integrated framework that tackles these issues in a cogent manner.

[0009] The object of the invention is achieved by a system for automatic detection of events within an industrial control system. The system leverages advanced processing techniques to analyze a plurality of log entries. The system comprises a processing unit is configured to selectively extract and analyze log entries, turning them into actionable data items and event notifications for user review.

[0010] The processing unit is configure to extract a set of log entries from a plurality of log entries by implementation of a log identification procedure on the plurality of log entries. The plurality of log entries comprises records of events or actions within the industrial control system. In one example, the plurality of log entries comprises a plurality of error messages. In another example the plurality of log entries comprises information associated with a plurality of user inputs provided by a user in the industrial control system. Each log entry of the plurality of log entries is a textual description of an event which has taken place in the industrial control system. Examples of the event include but is not limited to a temperature value exceeding a temperature limit, an occurrence of a fault in the industrial control system, and an occurrence of a system failure in the industrial control system.

[0011] The log identification procedure refers to a systematic approach employed by the processing unit to distinguish and select relevant log entries from the plurality of log entries. The log identification procedure utilizes specific criteria or coded algo- rithms to identify one or more log entries which are pertinent to ongoing analysis or event detection efforts.

[0012] To implement the log identification procedure, the processing unit applies a series of predefined filters and pattern recognition algorithms on the plurality of log entries. The series of predefined filters are configured to recognize the one or more log entries based on one or more attributes such as timestamps, error codes, operational identifiers, or custom user-defined parameters. Advantageously, the determined set of log entries only comprises log entries of interest to one or more users of the industrial control system.

[0013] In one scenario where the industrial control system is monitoring for overheating events, the log identification procedure would be configured to sift the plurality of log entries to identify the one or more log entries containing temperature readings. By focusing on log entries with specific error codes related to temperature thresholds or logs tagged with operational identifiers for temperature control mechanisms, the processing unit efficiently isolates logs that indicate potential overheating issues for immediate analysis and response.

[0014] The processing unit is further configured to parse at least one data unit of the plurality of log entries based on one or more user defined parameters. In one example, the at least one data unit refers to a collection or batch of log entries that share common characteristics or are related to a specific aspect of the industrial control system. Examples of the at least one data unit includes a series of error logs generated by a specific machine failure. The at least one data unit comprises one or more log entries of the plurality of log entries.

[0015] The processing unit is configured to receive the one or more user defined parameters from the one or more users via a user interface of the system. The user interface enables direct user interaction for setting the one or more user defined parameters. The user interface supports categorization of events based on user input, enhancing an adaptability of the system to various operational contexts. The one or more user-defined parameters include, but are not limited to, a data syntax, a list of data variables, and a list of data types. The data syntax specifies a specific structure of data within the plurality of log entries. The list of data variables comprises information associated with specific points of interest in the plurality of log entries. The list of data types comprises information associated with nature of the data, such as numerical, textual, etc. In one example, the plurality of user- defined parameters comprises parameters which focus on log entries with numerical data relating to temperature readings, employing a specific syntax that identifies these entries among all others.

[0016] The processing unit is further configured to generate a dictionary that comprises a plurality of data definitions derived from the analysis of the parsed at least one data unit. The plurality of data definitions comprises information associated with the one or more user parameters. The dictionary serves as a comprehensive guide to data encountered in the plurality of log entries. The plurality of data definitions detail structure, format, and constraints of specific data types identified by the processing unit during parsing of the at least one data unit. Each data definition of the plurality of data definitions is a blueprint for interpreting similar data in the plurality of log entries, ensuring consistency and accuracy in data analysis and event detection. Each data definition of the plurality of data definitions comprises information associated with a structure, a format, and one or more constraints of a specific datatype within the at least one data unit of the plurality of log entries.

[0017] In one example, at least one data definition comprises a data structure and a format associated with temperature readings. If the processing unit parses a log entry containing temperature readings, then the processing unit is configure to recognize data structure and format used for the temperature reading. In one example, the at least one data definition comprises a numerical value followed by a degree symbol. Furthermore, the at least one data definition comprises a format which comprises two decimal places. Furthermore, the at least one data definition has constraints associated with valid range of temperatures for operational safety. The processing unit is configured to parse the extracted set of log entries to generate a plurality of data items. In one example, the processing unit is configured to parse the set of log entries by use of the plurality of data definitions.

[0018] In one example, the plurality of data definitions are generated with an artificial intelligence model designed to analyze the plurality of data items found within the set of log entries. The artificial intelligence model is configured to cluster the plurality of data items into a plurality of clusters and determining a plurality of data parameters which are common in data items of each cluster of the plurality of clusters. Furthermore, the artificial intelligence model generates a unique data definition for every cluster, derived from the identified data parameters, thereby facilitating a nuanced understanding and categorization of the logged data. In one example, the artificial intelligence model is a large language model such as a generative pretrained transformer.

[0019] The processing unit is configured to receive the plurality of event definitions via the user interface of the system. The user interface enables direct user interaction for setting the plurality of event definitions. In one example, the user interface is further configured to receive user input to define one or more events in the plurality of log entries. The user interface is further configured to categorize the one or more events as one of univariate or multivariate based on the received user input. In such a case, the processing unit is configured to generate the plurality of event definitions based on the received user input.

[0020] The user input comprises information associated with the plurality of event definitions. The plurality of event definitions comprises information associated with criteria to determine that one or more events has taken place. Examples of the plurality of event definitions includes a threshold Crossing event definition, a pattern recognition event definition, an anomaly detection event definition, a status change event definition, a time-based event definition, a resource utilization event definition, and a user interaction event definition. Threshold Crossing event definition defines an event which is is triggered when a monitored parameter exceeds or falls below a predefined limit. Pattern Recognition event definition defines an event which is identified through specific sequences or patterns of activities indicating significant occurrences. Anomaly Detection event definition defines an event which occurs when there is a deviation from normal or expected behavior or patterns. Status Change event definition defines an event which is triggered by a change in the operational state or status of a component or system. Time-based Criteria event definition defines an event which is defined by the occurrence or nonoccurrence of an expected action within a set timeframe. Resource Utilization event definition defines an event which occurs when the usage levels of critical resources reach predefined thresholds. Error and Exception Reporting event definition defines an event which is triggered by the occurrence of errors or exceptions that could impact system functionality or data integrity. Lastly, User Interaction event definition defines an event which is defined by specific actions or inactions of users within a system.

[0021] Each of the plurality of event definitions comprises a plurality of conditions like triggers, thresholds, time constraints, data patterns, and a combination of conditions. The triggers are conditions or patterns indicating an event. The thresholds are specific values that when exceeded, mark an event. The time constraints require conditions to be met for a certain duration to qualify as an event. The data patterns show trends like increasing vibration levels hinting at potential mechanical failure. The combinations of conditions where several unusual readings across multiple sensors may signify a critical event.

[0022] In one example, the plurality of the event definitions are stored using non- deterministic Finite Automata in a JavaScript Object Notation (JSON) file format. The JSON file is a flat file comprising the plurality of event definitions and the plurality of data definitions. The flat file comprises the generated dictionary.

[0023] An artificial intelligence model is integrated to further analyze data items, cluster them based on common parameters, and refine data definitions. This model enables the system to adapt and improve its detection capabilities over time. The processing unit is further configured to analyze the plurality of data items against the plurality of event definitions. The processing unit is further configured to determine a plurality of events in the extracted set of log entries based on an analysis of a plurality of event definitions and the generated plurality of data items. The processing unit is configured to apply one or more algorithms to the plurality of data items and the plurality of event definitions to generate the plurality of events. Examples of the one or more algorithms include but is not limited to artificial intelligence algorithms and sequence matching algorithms. The one or more algorithms further comprises statistical algorithms such as anomaly detection, Machine learning algorithms, such as supervised learning models and clustering algorithms configured to group similar events together to discover new insights without predefined labels.

[0024] In other words, the processing unit is configured to sift through the plurality of log entries to recognize patterns that match one or more criteria specified in the plurality of event definitions. Advantageously, the processing unit not only identifies known issues but can also help in spotting unforeseen anomalies that could suggest new potential problems or areas for improvement.

[0025] The processing unit is further configured to categorize each event of the plurality of events based on a type and an urgency of the event. The type and the urgency of the event is mentioned in the plurality of event definitions. After determination of each event of the plurality of events, the processing unit triggers a specific workflow. The specific workflow may be defined in the plurality of event definitions. In one example, the specific workflow comprises logging the determined event for further analysis, alerting system operators of the determined event, or initiating automated corrective actions depending on a severity and a nature of the determined event. The system comprises a memory to store a plurality of actions associated with each event of the plurality of events. The plurality of actions are defined in the plurality of event definitions. In one example, the plurality of actions comprises at least one of a first action to adjust one or more operating parameters of the industrial control system, a second action to send one or more alerts to the user, a third action to initiate one or more emergency protocols, a fourth action to start or stop specific user devices, and a fifth action to adjust the user interface. Each action in the plurality of actions comprises a segment of program code which is configured to perform the specific action. In other words, execution of each action by the processing unit or a programmable logic controller, causes execution of a sequence of operational procedures in the industrial control system.

[0026] In one example, the system uses a rule-based algorithm to determine a specific set of actions from the plurality of actions. Each action of the specific set of actions is determined based on a specific events occurring within the industrial control system. When the set of actions are executed by the processing unit, a series of operational procedures are triggered by the processing unit. In one example, a user decides which actions to be executed. The processing unit then executes the set of actions to control one or more devices within the industrial system. Thus, each event is met with a precise, predefined response, enhancing the system’s efficiency and responsiveness.

[0027] The processing unit is further configured to execute the determined set of actions to control one or more devices in the industrial control system. In one example, the one or more devices are industrial devices such as pumps, valves, conveyors, motors, robots, HVAC systems, and generators. In one example, the plurality of actions comprises sourcecode, which when executed by a programmable logic controller, causes the programmable logic controller to control the one or more devices based on the detected plurality of events. In one example, a user or a system operator is enabled to select a set of events for which the processing unit is configured to execute one or more actions of the plurality of actions.

[0028] The processing unit is further configured to display the Identified plurality of events and the plurality of data items to a user through a display device via the user interface.

[0029] The object of the present invention is also achieved by a method for automatic detection of events in an industrial control system. The system comprises a processing unit is configured to selectively extract and analyze log entries, turning them into actionable data items and event notifications for user review. The method further comprises extracting a set of log entries from a plurality of log entries by implementation of a log identification procedure on the plurality of log entries. The plurality of log entries comprises records of events or actions within the industrial control system. In one example, the plurality of log entries comprises a plurality of error messages. In another example the plurality of log entries comprises information associated with a plurality of actions performed by a user in the industrial control system.

[0030] The method further comprises parsing at least one data unit of the plurality of log entries using one or more user defined parameters. In one example, a "data unit" here refers to a collection or batch of log entries that share common characteristics or are related to a specific aspect of the industrial control system's operation, such as a series of error logs generated by a specific machine failure.

[0031] The method further comprises receiving the one or more user defined parameters via a user interface of the system. The user interface enables direct user interaction for setting the one or more user defined parameters. This interface supports the categorization of events based on user input, enhancing the system's adaptability to various operational contexts.

[0032] The one or more user-defined parameters include, but are not limited to, a data syntax, a list of data variables, and a list of data types. The data syntax specifies a specific structure of data within the plurality of log entries. The list of data variables comprises information associated with specific points of interest in the plurality of log entries. The list of data types comprises information associated with nature of the data, such as numerical, textual, etc. In one example, the plurality of user- defined parameters comprise parameters which focus on log entries with numerical data relating to temperature readings, employing a specific syntax that identifies these entries among all others.

[0033] The method further comprises generating a dictionary that comprises a plurality of data definitions derived from the analysis of the parsed at least one data unit. The plurality of data definitions comprises information associated with the one or more user parameters. The dictionary serves as a comprehensive guide to data encountered in the plurality of log entries. The plurality of data definitions detail structure, format, and constraints of specific data types identified by the processing unit during parsing of the at least one data unit. Each data definition of the plurality of data definitions is a blueprint for interpreting similar data in the plurality of log entries, ensuring consistency and accuracy in data analysis and event detection.

[0034] In one example, at least one data definition comprises a data structure and a format associated with temperature readings. If the processing unit parses a log entry containing temperature readings, then the processing unit is configure to recognize data structure and format used for the temperature reading. In one example, the at least one data definition comprises a numerical value followed by a degree symbol. Furthermore, the at least one data definition comprises a format which comprises two decimal places. Furthermore, the at least one data definition has constraints associated with valid range of temperatures for operational safety.

[0035] The method further comprises parsing the extracted set of log entries to generate a plurality of data items. In one example, the processing unit is configured to parse the set of log entries by use of the plurality of data definitions.

[0036] In one example, the plurality of data definitions are generated with an artificial intelligence model designed to analyze the plurality of data items found within the set of log entries. The artificial intelligence model is adept at clustering the plurality of data items into distinct groups and determining a set of common data parameters within each cluster. Furthermore, the artificial intelligence model generates a unique data definition for every cluster, derived from the identified data parameters, thereby facilitating a nuanced understanding and categorization of the logged data. The method further comprises receiving a plurality of event definitions via the user interface of the system. The user interface enables direct user interaction for setting the plurality of event definitions.

[0037] The method further comprises receiving user input to define one or more events in the plurality of log entries. The user interface is further configured to categorize the one or more events as one of univariate or multivariate based on the received user input. In such a case, the processing unit is configured to generate the plurality of event definitions based on the received user input.

[0038] The user input comprises information associated with the plurality of event definitions such as criteria to determine that one or more events has taken place. Examples of the plurality of event definition includes a threshold Crossing event definition, a pattern recognition event definition, an anomaly detection event definition, a status change event definition, a time-based event definition, a resource utilization event definition, and a user interaction event definition. Threshold Crossing event definition defines an event which is triggered when a monitored parameter exceeds or falls below a predefined limit. Pattern Recognition event definition defines an event which is identified through specific sequences or patterns of activities indicating significant occurrences. Anomaly Detection event definition defines an event which occurs when there is a deviation from normal or expected behavior or patterns. Status Change event definition defines an event which is triggered by a change in the operational state or status of a component or system. Time-based Criteria event definition defines an event which is defined by the occurrence or non-occurrence of an expected action within a set timeframe. Resource Utilization event definition defines an event which occurs when the usage levels of critical resources reach predefined thresholds. Error and Exception Reporting event definition defines an event which is triggered by the occurrence of errors or exceptions that could impact system functionality or data integrity. Lastly, User Interaction event definition defines an event which is defined by specific actions or inactions of users within a system. The plurality of the event definitions are stored using non-deterministic Finite Automata in a JavaScript Object Notation (JSON) file format. The JSON file is a flat file comprising the plurality of event definitions and the plurality of data definitions. The flat file comprises the generated dictionary.

[0039] The method further comprises analyzing the plurality of data items using an artificial intelligence model. This model enables the system to adapt and improve its detection capabilities over time.

[0040] The method further comprises analyzing the plurality of data items against the plurality of event definitions. Each event definition of the plurality of event definitions specifies criteria for identifying an occurrence of a specific event in the industrial control system. In one example, the specific event may be an overheating event in which a temperature reading exceeds a threshold.

[0041] The method further comprises determining, by the processing unit, a plurality of events in the extracted set of log entries based on an analysis of a plurality of event definitions and the generated plurality of data items. Each event definition is indicative of a criteria for identifying an occurrence of a specific event from the plurality of log entries. The processing unit is configured to apply one or more algorithms to the plurality of data items and the plurality of event definitions to generate the plurality of events. Examples of the one or more algorithms include but is not limited to artificial intelligence algorithms and sequence matching algorithms. In other words, the processing unit is configured to sift through the plurality of log entries to recognize patterns that match one or more criteria specified in the plurality of event definitions. Advantageously, the processing unit not only identifies known issues but can also help in spotting unforeseen anomalies that could suggest new potential problems or areas for improvement.

[0042] The method further comprises categorizing, by the processing unit, each event of the plurality of events based on a type and an urgency of the event. The type and the urgency of the event is mentioned in the plurality of event definitions. After determination of each event of the plurality of events, the processing unit triggers a specific workflow. The specific workflow may be defined in the plurality of event definitions. In one example, the specific workflow comprises logging the determined event for further analysis, alerting system operators of the determined event, or initiating automated corrective actions depending on a severity and a nature of the determined event. The system comprises a memory to store a plurality of actions associated with each event of the plurality of events. The plurality of actions are defined in the plurality of event definitions. In one example, the plurality of actions comprises at least one of a first action to adjust one or more operating parameters of the industrial control system, a second action to send one or more alerts to the user, a third action to initiate one or more emergency protocols, a fourth action to start or stop specific user devices, and a fifth action to adjust the user interface. Each action in the plurality of actions comprises a segment of program code which is configured to perform the specific action. In other words, execution of each action by the processing unit or a programmable logic controller, causes execution of a sequence of operational procedures in the industrial control system.

[0043] The method further comprises applying, by the processing unit, a rule-based algorithm on the plurality of events to determine a specific set of actions from the plurality of actions. Each action of the specific set of actions is determined based on a specific events occurring within the industrial control system. In one example, the the rule-based algorithm is configured to function by applying a predefined set of rules to interpret the plurality of events and determine the specific set of actions based on the plurality of events. The rule-based algorithm is especially useful in environments where specific conditions or scenarios need to trigger well-defined responses.

[0044] In one example, the rule-based algorithm operates on a set of "if-then" statements or logical conditions that define how to respond to one or more events of the plurality of events. The rule-based algorithm scans the plurality of events to identify patterns or specific conditions outlined in a set of rules of the rule-based algorithm. Each rule corresponds to a specific event of the plurality of events or a specific combination of events within the plurality of events. In a case where the pro- cessing unit detects that conditions pertaining to at least one rule of the set of rules are met, then the rule-based algorithm is configured to determine a predefined action for the specific event or the specific combination of events.

[0045] The processing unit is further configured to execute the determined set of actions to control one or more devices in the industrial control system. In one example, the one or more devices are industrial devices such as pumps, valves, conveyors, motors, robots, HVAC systems, and generators. In one example, the plurality of actions comprises source code, which when executed by a programmable logic controller, causes the programmable logic controller to control the one or more devices based on the detected plurality of events. In one example, a user or a system operator is enabled to select a set of events for which the processing unit is configured to execute one or more actions of the plurality of actions.

[0046] The method further comprises displaying the Identified plurality of events and the plurality of data items to a user through a display device via the user interface.

[0047] The above-mentioned and other features of the invention will now be addressed with reference to the accompanying drawings of the present invention. The illustrated embodiments are intended to illustrate, but not limit the invention.

[0048] The present invention is further described hereinafter with reference to illustrated embodiments shown in the accompanying drawings, in which:

[0049] FIG 1 is a block diagram of a system for automatic event detection in an industrial control system , according to an embodiment of the present invention;

[0050] FIG 2 is a block diagram of the industrial control system, such as those shown in FIG. 1 , in which an embodiment of the present invention can be implemented; FIG 3 is a block diagram of an automation module, such as those shown in FIG 2, in which an embodiment of the present invention can be implemented;

[0051] FIG 4 is a process flowchart illustrating an exemplary method of automatic event detection in the industrial control system, according to an embodiment of the present invention; and

[0052] FIG 5 is a process flowchart illustrating an exemplary method of automatically detecting events in an industrial control system, according to an embodiment of the present invention;

[0053] Various embodiments are described with reference to the drawings, wherein like reference numerals are used to refer the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for the purpose of explanation, numerous specific details are set forth in order to provide thorough understanding of one or more embodiments. It may be evident that such embodiments may be practiced without these specific details.

[0054] FIG 1 is a block diagram of a system for automatic event detection in an industrial control system, according to an embodiment of the present invention. In FIG 1 , the system 100 includes an industrial control system 102, a technical installation 106 and one or more client devices 120A-N. As used herein, “industrial environment” refers to a processing environment comprising configurable computing physical and logical resources, for example, networks, servers, storage, applications, services, etc., and data distributed over a platform, such as cloud computing platform. The system 100 provides on-demand network access to a shared pool of the configurable computing physical and logical resources. The industrial control system 102 is communicatively connected to the technical installation 106 via the network 104 (such as Local Area Network (LAN), Wide Area Network (WAN), Wi-Fi, Internet, any short range or wide range communication). The industrial control system 102 is also connected to the one or more client devices 120A-N via the network 104. The industrial control system 102 is connected to one or more engineering objects 108A-N in the technical installation 106 via the network 104. The one or more engineering objects 108A-N may include servers, robots, switches, automation devices, programmable logic controllers (PLC)s, human machine interfaces (HMIs), motors, valves, pumps, actuators, sensors and other industrial equipment(s). The one or more engineering objects 108A-N may be connected to each other or several other components (not shown in FIG 1 ) via physical connections. The physical connections may be through wiring between the one or more engineering objects 108A-N. Alternatively, the one or more engineering objects 108A-N may also be connected via non-physical connections (such as Internet of Things (IOT)) and 5G networks. Although, FIG 1 illustrates the industrial control system 102 connected to one technical installation 106, one skilled in the art can envision that the industrial control system 102 can be connected to several technical installations 106 located at different geographical locations via the network 104.

[0055] The client devices 120A-N may be a desktop computer, laptop computer, tablet, smart phone and the like. Each of the client devices 120A-N is provided with an engineering tool 122A-N for generating and / or editing engineering programs respectively. The client devices 120A-N can access the industrial control system 102 for automatically generating engineering programs. The client devices 120A-N can access cloud applications (such as providing performance visualization of the one or more engineering objects 108A-N via a web browser). Throughout the specification, the terms “client device” and “user device” are used interchangeably.

[0056] The industrial control system 102 may be a standalone server deployed at a control station or may be a remote server on a cloud computing platform. In a preferred embodiment, the industrial control system 102 may be a cloud-based engineering system. The industrial control system 102 is capable of delivering applications (such as cloud applications) for managing a technical installation 106 comprising one or more engineering objects 108A-N. The industrial control system 102 may comprise a platform 1 10 (such as a cloud computing platform), an automation module 112, a server 1 14 including hardware resources and an operating system (OS), a network interface 116 and a database 118. The network interface 116 enables communication between the industrial control system 102, the technical installation 106, and the client device(s) 120A-N. The interface (such as cloud inter- face)(not shown in FIG 1 ) may allow the engineers at the one or more client device^) 120A-N to access engineering project files stored at the industrial control system 102 and perform one or more actions on the engineering project files as same instance. The server 114 may include one or more servers on which the OS is installed. The servers 114 may comprise one or more processors, one or more storage devices, such as, memory units, for storing data and machine-readable instructions for example, applications and application programming interfaces (APIs), and other peripherals required for providing computing (such as cloud computing) functionality. The platform 110 enables functionalities such as data reception, data processing, data rendering, data communication, etc. using the hardware resources and the OS of the servers 114 and delivers the aforementioned services using the application programming interfaces deployed therein. The platform 110 may comprise a combination of dedicated hardware and software built on top of the hardware and the OS. In an exemplary embodiment, the platform 110 may correspond to an Integrated Development Environment (IDE) comprising program editors and compilers which allow the users of the client devices 120A-N to generate engineering programs. The platform 110 may further comprise an automation module 112 configured for generating engineering programs. Details of the automation module 112 is explained in FIG. 3.

[0057] The database 118 stores the information relating to the technical installation 106 and the client device(s) 120A-N. The database 118 is, for example, a structured query language (SQL) data store or a not only SQL (NoSQL) data store. In an exemplary embodiment, the database 118 may be configured as cloud-based database implemented in the system 100, where computing resources are delivered as a service over the platform 110. The database 118, according to another embodiment of the present invention, is a location on a file system directly accessible by the automation module 112. The database 118 is configured to store engineering project files, engineering programs, object behavior model, parameter values associated with the one or more engineering objects 108A-N, test results, simulation results, status messages, one or more simulation instances, graphical programs, program logics, program logic patterns, engineering objects 108A-N and engineering object properties, one or more engineering object blocks, relationship information between the engineering objects, requirements, program update messages and the like.

[0058] FIG 2 is a block diagram of an industrial control system 102, such as those shown in FIG 1 , in which an embodiment of the present invention can be implemented. In FIG 2, the industrial control system 102 includes a processor(s) 202, an accessible memory 204, a storage unit 206, a communication interface 208, an input-output unit 210, a network interface 212 and a bus 214.

[0059] The processor(s) 202, as used herein, means any type of computational circuit, such as, but not limited to, a microprocessor unit, microcontroller, complex instruction set computing microprocessor unit, reduced instruction set computing microprocessor unit, very long instruction word microprocessor unit, explicitly parallel instruction computing microprocessor unit, graphics processing unit, digital signal processing unit, or any other type of processing circuit. The processor(s) 202 may also include embedded controllers, such as generic or programmable logic devices or arrays, application specific integrated circuits, single-chip computers, and the like.

[0060] The memory 204 may be non-transitory volatile memory and non-volatile memory. The memory 204 may be coupled for communication with the processor(s) 202, such as being a computer-readable storage medium. The processor(s) 202 may execute machine-readable instructions and / or source code stored in the memory 204. A variety of machine-readable instructions may be stored in and accessed from the memory 204. The memory 204 may include any suitable elements for storing data and machine-readable instructions, such as read only memory, random access memory, erasable programmable read only memory, electrically erasable programmable read only memory, a hard drive, a removable media drive for handling compact disks, digital video disks, diskettes, magnetic tape cartridges, memory cards, and the like. In the present embodiment, the memory 204 includes an integrated development environment (IDE) 216. The IDE 216 includes an automation module 112 stored in the form of machine-readable instructions on any of the above-mentioned storage media and may be in communication with and executed by the processor(s) 202.

[0061] When executed by the processor(s) 202, the automation module 112 causes the processor(s) 202 to generate engineering programs in the industrial control system 102. In an embodiment, the automation module 112 causes the processor(s) 202 to receive a request to generate an engineering program for the one or more engineering objects 108A-N in the technical installation 106. The request comprises an industrial domain associated with the technical installation 106. The industrial domain of the technical installation 106 is indicative of an objective of the technical installation 106. For example, in one example, the technical installation 106 may be a manufacturing plant to manufacture glass bottles. In such a case, the industrial domain of the technical installation 106 may be “glass manufacturing industry”. Similarly, examples of the industrial domain may include, but is not limited to a “oil refining industry”, “a food processing industry” and “a coal mining industry”. A plurality of functions of the one or more engineering objects 108A-N may vary based on the industrial domain of the technical installation 106. Thus the received request comprises an instruction to generate the engineering program which, when executed by the one or more engineering objects 108A-N, causes the one or more engineering objects 108A-N to perform a set of functions which are specific to the industrial domain of the technical installation 106. The engineering program is generated based on the one or more one or more engineering objects 108A-N in a portion of the technical installation 106, physical connections between the one or more engineering objects 108A-N, and a plurality of parameter values associated with the one or more engineering objects 108A-N and the physical connections.

[0062] When executed by the processing unit 202, the automation module 112 causes the processing unit 202 to extract a set of log entries from a plurality of log entries by implementation of a log identification procedure on the plurality of log entries. The plurality of log entries comprises records of events or actions within the industrial control system. In one example, the plurality of log entries comprises a plurali- ty of error messages. In another example the plurality of log entries comprises information associated with a plurality of actions performed by a user in the industrial control system.

[0063] The log identification procedure refers to a systematic approach employed by the processing unit to distinguish and select relevant log entries from a comprehensive collection of log data. The log identification procedure utilizes specific criteria or coded algorithms to identify one or more log entries which are pertinent to ongoing analysis or event detection efforts.

[0064] To implement the log identification procedure, the automation module 112 causes the processing unit 202 apply a series of predefined filters and pattern recognition algorithms on the plurality of log entries. These filters are designed to recognize the one or more log entries based on one or more attributes such as timestamps, error codes, operational identifiers, or custom user-defined parameters. Thus, the set of log entries only comprises log entries of interest.

[0065] In one scenario where the industrial control system 102 is monitoring for overheating events, the log identification procedure would be configured to sift the plurality of log entries to identify the one or more log entries containing temperature readings. By focusing on log entries with specific error codes related to temperature thresholds or logs tagged with operational identifiers for temperature control mechanisms, the processing unit 202 efficiently isolates logs that indicate potential overheating issues for immediate analysis and response.

[0066] The automation module 112 causes the processing unit 202 to parse at least one data unit of the plurality of log entries using one or more user defined parameters. In one example, a "data unit" here refers to a collection or batch of log entries that share common characteristics or are related to a specific aspect of the industrial control system's operation, such as a series of error logs generated by a specific machine failure. The automation module 112 causes the processing unit 202 to receive the one or more user defined parameters via a user interface of the system 100. The user interface may be one of the engineering tool 122A-N hosted in the one or more client devices 120A-N. The user interface enables direct user interaction for setting the one or more user defined parameters. This interface supports the categorization of events based on user input, enhancing the adaptability of the industrial control system 102 to various operational contexts.

[0067] The one or more user-defined parameters include, but are not limited to, a data syntax, a list of data variables, and a list of data types. The data syntax specifies a specific structure of data within the plurality of log entries. The list of data variables comprises information associated with specific points of interest in the plurality of log entries. The list of data types comprises information associated with nature of the data, such as numerical, textual, etc. In one example, the plurality of user- defined parameters comprises parameters which focus on log entries with numerical data relating to temperature readings, employing a specific syntax that identifies these entries among all others.

[0068] The automation module 112 causes the processing unit 202 to generate a dictionary that comprises a plurality of data definitions derived from the analysis of the parsed at least one data unit. The plurality of data definitions comprises information associated with the one or more user parameters. The dictionary serves as a comprehensive guide to data encountered in the plurality of log entries. The plurality of data definitions detail structure, format, and constraints of specific data types identified by the processing unit during parsing of the at least one data unit. Each data definition of the plurality of data definitions is a blueprint for interpreting similar data in the plurality of log entries, ensuring consistency and accuracy in data analysis and event detection.

[0069] In one example, at least one data definition comprises a data structure and a format associated with temperature readings. If the processing unit parses a log entry containing temperature readings, then the processing unit is configure to recognize data structure and format used for the temperature reading. In one example, the at least one data definition comprises a numerical value followed by a degree symbol. Furthermore, the at least one data definition comprises a format which comprises two decimal places. Furthermore, the at least one data definition has constraints associated with valid range of temperatures for operational safety.

[0070] The automation module 112 causes the processing unit 202 to parse the extracted set of log entries to generate a plurality of data items. In one example, the processing unit is configured to parse the set of log entries by use of the plurality of data definitions.

[0071] In one example, the plurality of data definitions are generated with an artificial intelligence model designed to analyze the plurality of data items found within the set of log entries. The artificial intelligence model is adept at clustering the plurality of data items into distinct groups and determining a set of common data parameters within each cluster. Furthermore, the artificial intelligence model generates a unique data definition for every cluster, derived from the identified data parameters, thereby facilitating a nuanced understanding and categorization of the logged data.

[0072] The automation module 112 causes the processing unit 202 to receive the plurality of event definitions via the user interface of the system 100. The user interface enables direct user interaction for setting the plurality of event definitions.

[0073] In one example, the user interface is further configured to receive user input to define one or more events in the plurality of log entries. The user interface is further configured to categorize the one or more events as one of univariate or multivariate based on the received user input. In such a case, the processing unit is configured to generate the plurality of event definitions based on the received user input.

[0074] The user input comprises information associated with the plurality of event definitions such as criteria to determine that one or more events has taken place. Examples of the plurality of event definition includes a threshold Crossing event defi- nition, a pattern recognition event definition, an anomaly detection event definition, a status change event definition, a time-based event definition, a resource utilization event definition, and a user interaction event definition. Threshold Crossing event definition defines an event which is triggered when a monitored parameter exceeds or falls below a predefined limit. Pattern Recognition event definition defines an event which is identified through specific sequences or patterns of activities indicating significant occurrences. Anomaly Detection event definition defines an event which occurs when there is a deviation from normal or expected behavior or patterns. Status Change event definition defines an event which is triggered by a change in the operational state or status of a component or system. Time-based Criteria event definition defines an event which is defined by the occurrence or non-occurrence of an expected action within a set timeframe. Resource Utilization event definition defines an event which occurs when the usage levels of critical resources reach predefined thresholds. Error and Exception Reporting event definition defines an event which is triggered by the occurrence of errors or exceptions that could impact system functionality or data integrity. Lastly, User Interaction event definition defines an event which is defined by specific actions or inactions of users within a system.

[0075] The plurality of the event definitions are stored using non-deterministic Finite Automata in a JavaScript Object Notation (JSON) file format. The JSON file is a flat file comprising the plurality of event definitions and the plurality of data definitions. The flat file comprises the generated dictionary.

[0076] An artificial intelligence model is integrated to further analyze data items, cluster them based on common parameters, and refine data definitions. This model enables the system 100 to adapt and improve its detection capabilities over time.

[0077] The automation module 112 causes the processing unit 202 to analyze the plurality of data items against the plurality of event definitions. Each event definition of the plurality of event definitions specifies criteria for identifying an occurrence of a specific event in the industrial control system. In one example, the specific event may be an overheating event in which a temperature reading exceeds a threshold. The automation module 1 12 causes the processing unit 202 to determine a plurality of events in the extracted set of log entries based on an analysis of a plurality of event definitions and the generated plurality of data items. The automation module 112 causes the processing unit 202 to apply one or more algorithms to the plurality of data items and the plurality of event definitions to generate the plurality of events. Examples of the one or more algorithms include but is not limited to artificial intelligence algorithms and sequence matching algorithms. The one or more algorithms further comprises statistical algorithms such as anomaly detection, Machine learning algorithms, such as supervised learning models and clustering algorithms configured to group similar events together to discover new insights without predefined labels.

[0078] In other words, the processing unit is configured to sift through the plurality of log entries to recognize patterns that match one or more criteria specified in the plurality of event definitions. Advantageously, the processing unit not only identifies known issues but can also help in spotting unforeseen anomalies that could suggest new potential problems or areas for improvement.

[0079] The automation module 1 12 causes the processing unit 202 to categorize each event of the plurality of events based on a type and an urgency of the event. The type and the urgency of the event is mentioned in the plurality of event definitions. After determination of each event of the plurality of events, the processing unit triggers a specific workflow. The specific workflow may be defined in the plurality of event defintions. In one example, the specific workflow comprises logging the determined event for further analysis, alerting system operators of the determined event, or initiating automated corrective actions depending on a severity and a nature of the determined event. The system comprises a memory to store a plurality of actions associated with each event of the plurality of events. The plurality of actions are defined in the plurality of event definitions. In one example, the plurality of actions comprises at least one of a first action to adjust one or more operating parameters of the industrial control system, a second action to send one or more alerts to the user, a third action to initiate one or more emergency protocols, a fourth action to start or stop specific user devices, and a fifth action to adjust the user interface. Each action in the plurality of actions comprises a segment of program code which is configured to perform the specific action. In other words, execution of each action by the processing unit or a programmable logic controller, causes execution of a sequence of operational procedures in the industrial control system.

[0080] In one example, the system uses a rule-based algorithm to determine a specific set of actions from the plurality of actions. Each action of the specific set of actions is determined based on a specific events occurring within the industrial control system. When the set of actions are executed by the processing unit, a series of operational procedures are triggered by the processing unit. In one example, a user decides which actions to be executed. The processing unit then executes the set of actions to control one or more devices within the industrial system. Thus, each event is met with a precise, predefined response, enhancing the system’s efficiency and responsiveness.

[0081] The automation module 112 causes the processing unit 202 to execute the determined set of actions to control one or more devices in the industrial control system. In one example, the one or more devices are industrial devices such as pumps, valves, conveyors, motors, robots, HVAC systems, and generators. In one example, the plurality of actions comprises source code, which when executed by a programmable logic controller, causes the programmable logic controller to control the one or more devices based on the detected plurality of events. The one or more industrial devices are the one or more engineering objects 108A-N. In one example, a user or a system operator is enabled to select a set of events for which the processing unit is configured to execute one or more actions of the plurality of actions.

[0082] The automation module 112 causes the processing unit 202 to display the identified plurality of events and the plurality of data items to a user through a display device such as the one or more client devices 120A-N via the user interface. The storage unit 206 may be a non-transitory storage medium configured for storing a database (such as database 118) which comprises the plurality of log entries.

[0083] The communication interface 208 is configured for establishing communication sessions between the one or more client devices 120A-N and the industrial control system 102. The communication interface 208 allows the one or more engineering applications running on the client devices 120A-N to import / export engineering project files into the industrial control system 102. In an embodiment, the communication interface 208 interacts with the interface at the one or more client devices 120A-N for allowing the engineers to access the engineering programs associated with an engineering project file and perform one or more actions on the engineering programs stored in the industrial control system 102.

[0084] The input-output unit 210 may include input devices a keypad, touch-sensitive display, camera (such as a camera receiving gesture-based inputs), etc. capable of receiving one or more input signals, such as user commands to process engineering project file. Also, the input-output unit 210 may be a display unit for displaying a graphical user interface which visualizes the behavior model associated with the modified engineering programs and also displays the status information associated with each set of actions performed on the graphical user interface. The set of actions may include execution of predefined tests, download, compile and deploy of graphical programs. The bus 214 acts as interconnect between the processor 202, the memory 204, and the input-output unit 210.

[0085] The network interface 212 may be configured to handle network connectivity, bandwidth and network traffic between the industrial control system 102, client devices 120A-N and the technical installation 106.

[0086] Those of ordinary skilled in the art will appreciate that the hardware depicted in FIG 2 may vary for particular implementations. For example, other peripheral devices such as an optical disk drive and the like, Local Area Network (LAN), Wide Area Network (WAN), Wireless (e.g., Wi-Fi) adapter, graphics adapter, disk con- trailer, input / output (I / O) adapter also may be used in addition or in place of the hardware depicted. The depicted example is provided for the purpose of explanation only and is not meant to imply architectural limitations with respect to the present disclosure.

[0087] Those skilled in the art will recognize that, for simplicity and clarity, the full structure and operation of all data processing systems suitable for use with the present disclosure is not being depicted or described herein. Instead, only so much of an industrial control system 102 as is unique to the present disclosure or necessary for an understanding of the present disclosure is depicted and described. The remainder of the construction and operation of the industrial control system 102 may conform to any of the various current implementation and practices known in the art.

[0088] FIG 3 is a block diagram of an automation module 112, such as those shown in FIG 2, in which an embodiment of the present invention can be implemented. In FIG 3, the automation module 112 comprises a request handler module 302, a data definition module 304, an event definition module 306, a parser 308, an event detection module 310, a display module 312 and a model training module 314. FIG. 3 is explained in conjunction with FIG. 1 and FIG. 2.

[0089] The Request Handler Module 302 is configured to receive incoming requests for log data analysis. The Request Handler Module 302 prioritizes and directs the flow of log entries to the appropriate processing components, ensuring efficient handling and categorization of data for further analysis.

[0090] The Data Definition Module 304 generates and maintains a dictionary of data definitions derived from parsed log entries. The Data Definition Module 304 outlines the structure, format, and constraints of identified data types, providing a foundational reference for accurate data interpretation and analysis.

[0091] The Event Definition Module 306 facilitates the creation and storage of event definitions, utilizing user input and predefined criteria. The Event Definition Module 306 enables the system to recognize specific patterns or conditions within log data as events, supporting dynamic and precise event detection capabilities.

[0092] The Parser 308 breaks down log entries into manageable data units based on user-defined parameters. The Parser 308 extracts relevant information from the logs, preparing the data for detailed analysis and event detection processes.

[0093] The Event Detection Module 310 analyzes parsed data against a set of event definitions to identify occurrences of specific events within the industrial control system. The Event Detection Module 310 leverages advanced pattern recognition and anomaly detection techniques to flag critical events for user review.

[0094] The Display Module 312 visualizes the data items and detected events to the user. The Display Module 312 presents the information in an intuitive and accessible manner on the user interface, facilitating easy review and action on identified events.

[0095] The Model Training Module 312 utilizes machine learning algorithms to continuously improve event detection accuracy of the system 100. The Model Training Module 312 analyzes historical data and detected events to refine data and event definitions, enhancing the system's predictive capabilities over time.

[0096] FIG 4 is a process flowchart illustrating an exemplary method 400 of automatic event detection in an industrial control system 102, according to an embodiment of the present invention.

[0097] At 402, the processing unit 202 extracts a set of log entries from a plurality of log entries. Step 402 is executed by implementing a log identification procedure on the plurality of log entries, utilizing a processing unit. Step 402 is a foundational step which is crucial for isolating relevant data from the broader dataset for further analysis. At step 404, the processing unit 202 is configured to parse the extracted set of log entries. The processing unit parses the set of log entries to generate a plurality of data items, which are derived based on an analysis of the set of log entries and a plurality of data definitions. During the parsing, raw log data is transformed into structured, analyzable entities.

[0098] At step 406 a plurality of events are determined by the processing unit 202 from within the extracted set of log entries. The determination is grounded on an analysis that leverages a plurality of event definitions alongside the previously generated plurality of data items. Each event definition serves as a beacon, guiding the identification of specific events amidst the sea of log entries, highlighting occurrences that meet predefined criteria.

[0099] At step 408, the generated plurality of data items and the determined plurality of events are presented by the processing unit 202 to the user via a user interface. The plurality of data items and the determined plurality of events is displayed via a display device, where the insights gained through rigorous processing and analysis are made accessible to the user, enabling informed decision-making and timely response to identified plurality of events.

[0100] At step 410, one or more industrial devices in the industrial control system are controlled by the processing unit 202 by executing at least one action from a set of actions. The at least one action is associated with at least one event of the plurality of events. The one or more industrial devices are the one or more engineering objects 108A-N.

[0101] FIG 5 is a process flowchart illustrating an exemplary method of automatically detecting events in an industrial control system, according to an embodiment of the present invention. FIG. 5 is explained in conjunction with FIGs. 1 , 2, 3, and 4.

[0102] The system 100 is a robust system for automatic detection of events within the industrial control systems 102. The system 100 focusses on the pivotal role of data definition and event detection. The system 100 comprises a Data Definition Tool, a user interface that revolutionizes how users interact with log data, providing a nu- anced level of control and customization never before seen.

[0103] Data definition is a critical component that empowers users to instruct the processing unit 202 to parse log files into a structured dictionary. Advantageously, flexibility extends to handling of the plurality of log entries, whether they encompass multiple lines or a single line contains multiple units. Transformation of individual values into various data types further enriches this process, allowing for a diverse range of operations and comparisons to be applied with precision. Once a user crafts a data definition, it acts as a key to unlock the log's data, converting each unit into a dictionary that is flat and devoid of nesting elements, with all field names user-defined.

[0104] The user interface facilitates creation of data definitions. The user interface not only displays log file for user inspection but also enables selection of different parts of a log unit for field definition, requiring the user to assign names to each field. These names play a crucial role in the subsequent Event Definition process. While the solution is designed to be comprehensive, allowing users to fulfill typical use cases without external tools, it also accommodates flexibility by enabling data export in comma-separated file format, should users prefer to use external tools for further analysis.

[0105] The user interface further comprises an Event Definition Tool, a sophisticated component that allows users to define events based on the plurality of log entries. This tool is designed to be generic, accommodating the diverse and unstandardized formats of software logs. The event definition tool enables definition of both univariate and multivariate events. The univariate events depends on a single field. The multivariate events depend on multiple fields, facilitating the creation of complex event hierarchies that include both primitive and complex events.

[0106] The plurality of event definitions are stored in a JSON file format, representing a Non-Deterministic Finite Automata (NFA) that is built according to the dictionary fields prepared in the Data Definition phase. This seamless integration between data and event definitions exemplifies the solution's holistic approach.

[0107] In an exemplary illustration of a working of the present invention, a user configures the plurality of data definitions and the plurality of event definitions such that the industrial control system 102 ceases operation of one or more motors in response to potential degradation indicators attributable to erosion or other mechanical stress factors. Initially, the plurality of data definitions configured detect and analyze temperature data entries. The plurality of event definitions are configured such that each event definition information of a predetermined high threshold. The predetermined threshold is set at a level considered critical, beyond which the continued operation of the motor may lead to increased wear or imminent failure, necessitating immediate precautionary intervention. When the processing unit identifies that the predetermined high temperature threshold is met, then the processing unit triggers a predefined response protocol. In one example, the predefined response protocol is to immediately discontinue power to motor, effectively halting an operation of the motor. Thus, the system safeguards the motor from the potential for extensive damage that could result from operating under hazardous conditions.

[0108] Central to execution of the plurality of data and event definitions is a Runtime Complex Event Processing Engine 500. The Runtime Complex Event Processing Engine 500 is a I3S GED runtime execution engine. The Runtime Complex Event Processing Engine 500 acts as operational core of the system 100. Functioning as a pipeline, The Runtime Complex Event Processing Engine 500 an input data 502 is first deserialized at a first step 504. The Runtime Complex Event Processing Engine 500 then parses the input data 502 according to a plurality of data definitions 506 at a second step 508. The Runtime Complex Event Processing Engine 500 then generates a dictionary 510. The data in the dictionary is then processed using the plurality of event definitions 514 at a third step 512, to generate a plurality of events 518. A connector 516 transmits the plurality of events 518 to a display device. The Runtime Complex Event Processing Engine 500, primed with event definitions at startup, remains vigilant, ready to identify and raise events as dictat- ed by the predefined criteria, thus embodying a dynamic and responsive system architecture.

[0109] This innovative solution not only streamlines the process of event detection in the industrial control system 102 but also empowers users with unprecedented flexibility and control over data analysis. It represents a significant leap forward in the field, promising enhanced operational awareness and proactive management capabilities. Further refinements to data and event definitions are always possible, ensuring that the system remains adaptable and aligned with the evolving needs of the user and the complexities of the industrial environment it serves.

[0110] The system 100 further facilitates visual delineation and identification of various segments within a log unit without necessitating a user’s proficiency in programming. Traditionally, the delineation of such fields was accomplished through utilization of regular expressions — a method often criticized for its complexity and lack of accessibility to all programmers.

[0111] Furthermore, the system 100 has a novel linguistic framework, herein referred to as J-Rex, specifically engineered for the facile definition of fields. J-Rex has enhanced comprehensibility and simplicity in parsing. The system 100 processes the plurality of log entries in a left-to-right manner, applying field-defining rules sequentially. Upon the application of a rule and the subsequent extraction of results, the system 100 deductively removes the identified segment from further consideration.

[0112] The J-Rex framework distinguishes between two categories of rules: Optional Rules, which do not necessitate fulfillment for successful execution, and Non- optional Rules, which are imperative for the presence of specific fields within each input. Failure to meet a Non-optional Rule results in the cessation of processing and the generation of an error message. The concept of a "current reading position" is instrumental in the methodology, signifying the dynamic location within the input from which fields are sequentially extracted. Moreover, J-Rex facilitates field definition through various methodologies, including the use of starting and ending delimiters, a combination of starting delimiters and predetermined length, ending delimiters, fixed length from the current reading position, and the extraction of all remaining characters from the current position to the input's conclusion.

[0113] Advantageously a parsing technique of the system 100 offers a significant leap in efficiency over preceding methods, underscoring that the system 100 is a substantial improvement over existing solutions.

[0114] The system 100 has a modular architecture, ensuring seamless integration capabilities with extant systems. The modularity not only promotes interoperability but also mitigates the necessity for modifications to legacy systems, thereby broadening the invention's applicability and reducing the overhead associated with system upgrades.

[0115] Central to the invention's design is a user-friendly approach to data definition, facilitating compatibility with both legacy and contemporary systems without the need for extensive reconfiguration. Furthermore, the preemptive definition of events and the flexibility imbued in the event-raising mechanism significantly curtail the volume of data requiring expert analysis, thereby streamlining processes such as Predictive Maintenance (PM) and Root Cause Analysis (RCA).

[0116] From a business perspective, the system 100 addresses a critical challenge faced within Information Technology / Operational Technology (IT / OT) infrastructures. Each component's log emissions, integral to reporting its internal state, pose substantial monitoring and correlation challenges in large-scale industrial settings. By converting these logs into meaningful events, the system 100 presents a robust solution to this pervasive issue.

[0117] The system 100 as a versatility which extends to compatibility with legacy devices and an array of log formats, rendering it a universally applicable solution across diverse market segments. The system 100 has a potential for integration into both new and existing systems, coupled with the possibility of marketing it as an additional feature for older systems, significantly enhances its market penetration.

[0118] Designed for ease of deployment without necessitating hardware upgrades in most instances, the system 100 can also be employed in offline scenarios, thereby extending its applicability to remote systems. Targeted primarily at loT infrastructures, the system 100 offers a valuable upgrade path for both new and existing loT systems, underscoring its substantial impact on the industry and positioning it as a pivotal tool in the domains of RCA and PM.

[0119] The present invention can take a form of a computer program product comprising program modules accessible from computer-usable or computer-readable medium storing program code for use by or in connection with one or more computers, processors, or instruction execution system. For the purpose of this description, a computer-usable or computer-readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation mediums in and of themselves as signal carriers are not included in the definition of physical computer- readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, random access memory (RAM), a read only memory (ROM), a rigid magnetic disk and optical disk such as compact disk readonly memory (CD-ROM), compact disk read / write, and DVD. Both processors and program code for implementing each aspect of the technology can be centralized or distributed (or a combination thereof) as known to those skilled in the art.

[0120] While the present invention has been described in detail with reference to certain embodiments, it should be appreciated that the present invention is not limited to those embodiments. In view of the present disclosure, many modifications and variations would be present themselves, to those skilled in the art without departing from the scope of the various embodiments of the present invention, as described herein. The scope of the present invention is, therefore, indicated by the following claims rather than by the foregoing description. All changes, modifications, and variations coming within the meaning and range of equivalency of the claims are to be considered within their scope. All advantageous embodiments claimed in method claims may also be apply to system / apparatus claims.

[0121] List of reference numerals

[0122] 1 . A system 100

[0123] 2. an industrial control system 102

[0124] 3. one or more client devices 120A-N

[0125] 4. a network 104

[0126] 5. one or more engineering objects 108A-N

[0127] 6. a platform 110

[0128] 7. a user monitoring module 112

[0129] 8. a server 114

[0130] 9. a network interface 116

[0131] 10. a database 118

[0132] 11 . a processor(s) 202

[0133] 12. an accessible memory 204

[0134] 13. a storage unit 206

[0135] 14. a communication interface 208

[0136] 15. an input-output unit 210

[0137] 16. a network interface 212

[0138] 17. a bus 214

[0139] 18. an integrated development environment (IDE) 216

[0140] 19. a request handler module 302

[0141] 20. a data definition module 304

[0142] 21 . an event definition module 306

[0143] 22. a parser 308

[0144] 23. an event detection module 310

[0145] 24. a display module 312

[0146] 25. a model training module 314

[0147] 26. the input data 502

[0148] 27. a plurality of data definitions 506

[0149] 28. a dictionary 510.

[0150] 29. the plurality of event definitions 514

[0151] 30. connector 516

[0152] 31 . The Runtime Complex Event Processing Engine 500

[0153] 32. a plurality of events 518 33. dictionary 510

Claims

Claims1. A system (100) for automatic event detection in an industrial control system (102), the system comprising: a processing unit (202) configured to: extract a set of log entries from the plurality of log entries by implementation of a log identification procedure on the plurality of log entries; parse the extracted set of log entries to generate a plurality of data items, wherein the plurality of data items are generated based on an analysis of the set of log entries and a plurality of data definitions (506); determine a plurality of events in the extracted set of log entries based on an analysis of a plurality of event definitions (514) and the generated plurality of data items, wherein each event definition is indicative of a criteria for identifying an occurrence of a specific event from the plurality of log entries; and control one or more devices (108A-N) in the industrial control system (102) by executing at least one action from a set of actions, wherein the at least one action is associated with at least one event of the plurality of events (518).

2. The system (100) of claim 1 , wherein the processing unit (202) is further configured to: determine, the set of actions from a plurality of actions by application of a rule-based algorithm on each event of the plurality of events (518), wherein each action of the plurality of actions comprises at least one portion of a program code, and execution of each action by the processing unit, causes the processing unit to perform a sequence of operational procedures in the industrial control system; and execute each action of the determined set of actions to control one or more devices (108A-N) in the industrial control system (102).

3. The system (100) of claim 1 , wherein the processing unit (202) is further configured to: parse at least one data unit of the plurality of log entries based on one or more user-defined parameters, wherein the at least one data unit comprises one or more log entries of the plurality of log entries, andthe one or more user-defined parameters comprises at least one of a data syntax, a list of data variables, and a list of data types; and generate a dictionary (510) comprising the plurality of data definitions (506) based on the parsed at least one data unit, wherein each data definition of the plurality of data definitions comprises information associated with a structure, a format, and one or more constraints of a specific datatype within the at least one data unit of the plurality of log entries.

4. The system according to any of the preceding claims, further comprising a user interface which is displayed on an user input-output device, wherein the user interface is configured to: receive the one or more user-defined parameters from one or more users; and display the generated plurality of data items and the determined plurality of events (518) to a user via a display device.

5. The system according to any of the preceding claims, wherein the user interface is further configured to: receive user input to define one or more events in the plurality of log entries; and categorize the one or more events as one of univariate or multivariate based on the received user input.

6. The system (100) of claim 4 or 5, wherein the processing unit (202) is further configured to generate the plurality of event definitions based on the received user input.

7. The system (100) of claim 6, further the plurality of event definitions (514) are stored as a non-deterministic Finite Automata in a JavaScript Object Notation (json) file.

8. The system according to any of the preceding claims, further comprising an output module configured to generate a flat file comprising the plurality of data definitions (506), wherein the flat file comprises the generated dictionary.

9. The system according to any of the preceding claims, further comprising an artificial intelligence model configured to: analyze a plurality of data items in the plurality of log entries;clustering the plurality of data items into a plurality of clusters; determining a plurality of data parameters which are common in data items in each cluster of the plurality of clusters; and generating a data definition for each cluster of the plurality of clusters based on the plurality of data parameters associated with the cluster.

10. A method for automatic event detection in an industrial control system (102), comprising:Extracting a set of log entries from a plurality of log entries by implementing a log identification procedure on the plurality of log entries;Parsing the extracted set of log entries to generate a plurality of data items based on an analysis of the set of log entries and a plurality of data definitions (506);Determining a plurality of events in the extracted set of log entries based on an analysis of a plurality of event definitions and the generated plurality of data items, wherein each event definition is indicative of a criteria for identifying an occurrence of a specific event from the plurality of log entries; and controlling one or more devices (108A-N) in the industrial control system (102) by executing at least one action from a set of actions, wherein the at least one action is associated with at least one event of the plurality of events.11 . The method of claim 10, wherein determining, the set of actions from a plurality of actions by application of a rule-based algorithm on each event of the plurality of events, wherein each action of the plurality of actions comprises at least one portion of a program code, and execution of each action causes a processing unit (202) to perform a sequence of operational procedures in the industrial control system (102); and executing each action of the determined set of actions to control one or more devices in the industrial control system.

12. The method of claim 10 or 11 , further comprising:Parsing at least one data unit of the plurality of log entries based on one or more user-defined parameters, wherein the at least one data unit comprises one or more log entries of the plurality of log entries, and the one or more user-defined parameters comprises at least one of a data syntax, a list of data variables, and a list of data types;Generating a dictionary (510) comprising the plurality of data definitions (506) based on the parsed at least one data unit, wherein each data definition comprises information associated with a structure, a format, and one or more constraints of a specific datatype within the at least one data unit of the plurality of log entries.

13. The method according to any of the preceding method claims, further comprising:Receiving one or more user-defined parameters from one or more users via a user interface displayed on a user input-output device; andDisplaying the generated plurality of data items and the determined plurality of events (518) to a user via a display device.

14. The method according to any of the preceding claims, further comprising:Receiving user input to define one or more events in the plurality of log entries; andCategorizing the one or more events as one of univariate or multivariate based on the received user input.

15. The method according to any of the preceding claims, further comprising:Generating the plurality of event definitions based on the received user inputExecuting a comparison operation on the determined plurality of events and the generated plurality of event definitions; andDisplaying a result of the comparison to the user.

16. The method according to any of the preceding claims, further comprising:Analyzing a plurality of data items in the plurality of log entries using an artificial intelligence model; Clustering the plurality of data items into a plurality of clusters;Determining a plurality of data parameters common in data items in each cluster of the plurality of clusters; and Generating a data definition for each cluster of the plurality of clusters based on the plurality of data parameters associated with the cluster.

Images