Abstract: A method for automatically providing a time signal to containers in an operating system level virtualization or to virtual machines, the method including: —creating a pool of clocks; executing one or more containers in an operating system level virtualization or one or more virtual machines running on an executing hardware device; allocating one or more clocks of the pool of clocks to client containers in the one or more containers or to client virtual machines of the one or more virtual machines, thereby obtaining allocated clocks allocated to the client containers or the client virtual machines; wherein each of the allocated clocks provides a time signal in a time domain to at least one of the client containers or to at least one of the client virtual machines.

Abstract: A technique for a control method and a control system in a substation is provided. The control system includes a substation feeder, an intelligent electronic device, IED, a merging unit, and BUS network connecting the IED and the merging unit. The control method includes providing measurement signals by the substation feeder to the merging unit, transmitting, by the merging unit, measurement data based on the measurement signals of the substation feeder to the IED via the BUS network, identifying, by the IED, a fault condition based on the measurement data, transmitting, by the IED, a conditional control command to the merging unit via the BUS network, determining, by the merging unit, whether the condition of the conditional control command is met, and if so initiating, by the merging unit, the control measure of the substation feeder circuit.

Abstract: To determine system settings for an industrial system, digital twin data of a digital twin of the industrial system is retrieved. System simulations of the industrial system are performed based on the digital twin data to explore candidate system settings for the industrial system prior to application of one of the candidate system settings to the industrial system. At least one optimization objective or at least one constraint used in the system simulations is changed while the system simulations are being performed on an ongoing basis. The results of the system simulations are used to identify one of the candidate system settings for application to the industrial system.

Abstract: To commission an industrial automation control system, IACS, a computing device generates commands to automatically set or verify a security configuration of the IACS. The commands are generated by the computing device based on a machine-readable security baseline, and, optionally, based on a machine-readable configuration file of the IACS.

Abstract: The invention relates to a method and system for detecting and mitigating cabling issues with devices connected in industrial redundant networks. An agent runs on each device and generates information about traffic received at the corresponding device. The agent running on a node generates indicators of traffic received at each port, and error rates for traffic at each port. The agent running on a switch generates information about switch misconfiguration by collecting device identifiers for each port of the switch. The agents send the information to a network manager, which determines switch misconfigurations and wrong cabling from the received information. The network manager also mitigates cabling issues by sending a signal to the affected device(s) or sending a communication to mitigate the issue.

Abstract: To facilitate storage of data from plural data sources of an industrial automation control system, power distribution system or power generation system, a decision making device executes a machine learning algorithm to determine a compression technique in dependence on the data source from which data originates.

Abstract: The invention relates to a method and system for detecting and mitigating cabling issues with devices connected in industrial redundant networks. An agent runs on each device and generates information about traffic received at the corresponding device. The agent running on a node generates indicators of traffic received at each port, and error rates for traffic at each port. The agent running on a switch generates information about switch misconfiguration by collecting device identifiers for each port of the switch. The agents send the information to a network manager, which determines switch misconfigurations and wrong cabling from the received information. The network manager also mitigates cabling issues by sending a signal to the affected device(s) or sending a communication to mitigate the issue.

Abstract: The present invention provides a method for message authentication, in particular in case of low of transmission or storage capacities. The present invention further provides corresponding devices for generating or sending authenticated messages and for receiving or retrieving authenticated messages as well as a system comprising such devices. In an embodiment, the method may comprise (a) preparing a data block having an uncompressed length; (b) compressing the data block so that the data block has a compressed length smaller than the uncompressed length; (c) determining an available length from at least the compressed length and a maximum length of a data frame; (d) calculating a message authentication code, MAC, from at least the data block, having a MAC length not greater than the available length; and (e) creating the data frame, comprising the data block and the MAC.

Abstract: A method for detecting system problems in a distributed control system including a plurality of computational devices is suggested. The method includes:—deploying one or more software agents on one or more devices of the system;—monitoring, via the one or more software agents, a system configuration and/or a system functionality;—detecting a problem in the monitored system configuration and/or a system functionality;—adding one or more new software agents and deploying the one or more new software agents on one or more devices of the system associated with the problem;—collecting data associated with the problem, via the added software agents.

Abstract: A method for automatically improving security of a network system includes: collecting security relevant information from network devices of the network system, the security relevant information including security settings and operational information of the network devices; analyzing the security relevant information for determining weak security settings of a network device, the weak security settings being not necessary for a regular operation of the network system; determining hardened security settings for the network devices based on the weak security settings, the hardened security settings restricting a possible operation of the network device but allow a regular operation of the network system; and applying the hardened security settings to the network device.

Abstract: To determine system settings for an industrial system, digital twin data of a digital twin of the industrial system is retrieved. System simulations of the industrial system are performed based on the digital twin data to explore candidate system settings for the industrial system prior to application of one of the candidate system settings to the industrial system. At least one optimization objective or at least one constraint used in the system simulations is changed while the system simulations are being performed on an ongoing basis. The results of the system simulations are used to identify one of the candidate system settings for application to the industrial system.

Abstract: A method includes transmitting time-critical messages in an OSI layer 2 network tunnel from a first IED in a first substation to a second IED in a second substation over a WAN, wherein each of the first and second substation comprises an edge IED and is associated with a substation LAN, wherein each of the time-critical messages comprises message parameters. The method includes: creating a translation table comprising corresponding values of the message parameters, between the LANs and the WAN; defining a virtual IED in the second substation using the translated values of the message parameters, to impersonate the first IED; translating the message parameters according to the translation table, by the edge IED of the first and second substation; forwarding the time-critical messages from the first IED in the first substation to the WAN; and receiving the time-critical messages by the second IED in the second substation from the WAN.

Abstract: A method for automatically improving security of a network system includes: collecting security relevant information from network devices of the network system, the security relevant information including security settings and operational information of the network devices; analyzing the security relevant information for determining weak security settings of a network device, the weak security settings being not necessary for a regular operation of the network system; determining hardened security settings for the network devices based on the weak security settings, the hardened security settings restricting a possible operation of the network device but allow a regular operation of the network system; and applying the hardened security settings to the network device.

Abstract: To commission an industrial automation control system, IACS, a computing device generates commands to automatically set or verify a security configuration of the IACS. The commands are generated by the computing device based on a machine-readable security baseline, and, optionally, based on a machine-readable configuration file of the IACS.

Abstract: The present invention discloses a method of transmitting time-critical messages in an OSI layer 2 network tunnel from a first TED in a first substation to a second IED in a second substation over a WAN, wherein each of the first and second substation comprises an edge IED and is associated with a substation LAN, wherein each of the time-critical messages comprises message parameters. The method comprises the steps of: a) creating a translation table comprising corresponding values of the message parameters, between the LANs and the WAN, b) defining a virtual FED in the second substation using the translated values of the message parameters, to impersonate the first IED, c) translating the message parameters according to the translation table, by the edge IED of the first and second substation, d) forwarding the time-critical messages from the first IED in the first substation to the WAN, and e) receiving the time-critical messages by the second IED in the second substation from the WAN.

Abstract: A device validates reachability of nodes of a communication network of an industrial automation and control system. The device includes a collector module configured to update a data set including discovered dataflow information by detecting direct neighbor nodes having a physical connection to a selected node, and updating the data set by adding the selected node and those direct neighbor nodes which have configured logical network constraints matching logical network constraints of the selected node. The device includes a repeater module configured to repeat the selecting of a direct neighbor node in the data set and directing the collector module to update the data set using the selected direct neighbor node. The device includes a validation module configured to validate reachability of nodes of the network by comparing the data set with a data set including designed dataflow information which defines reachability requirements for nodes of the communication network.

Abstract: A unit is disclosed for validating a communication network of an industrial automation and control system. The validation unit can include a planner module configured to store plan data defining a designed communication network of an industrial automation and control system, and a collector module configured to collect effective data defining a deployed communication network of the industrial automation and control system. A difference detector can detect differences between the designed communication network and the deployed communication network using the plan data and the effective data such that faults or errors in a deployed communication network of the industrial automation and control system can be efficiently detected.

Abstract: A device validates reachability of nodes of a communication network of an industrial automation and control system. The device includes a collector module configured to update a data set including discovered dataflow information by detecting direct neighbour nodes having a physical connection to a selected node, and updating the data set by adding the selected node and those direct neighbour nodes which have configured logical network constraints matching logical network constraints of the selected node. The device includes a repeater module configured to repeat the selecting of a direct neighbour node in the data set and directing the collector module to update the data set using the selected direct neighbour node. The device includes a validation module configured to validate reachability of nodes of the network by comparing the data set with a data set including designed dataflow information which defines reachability requirements for nodes of the communication network.