Automatic Surveillance of Accelerated Cooling Line Against Cyber-Attacks and Faults

Faults and cyber-attacks on industrial facilities have several common aspects. Both can severely damage equipment and plants, and harm the health of workers or even the environment. Both can create economic damage due to production stops or damage to connected equipment and facilities. To make the plant robust to cyber-attacks, a risk assessment must be firstly performed, by evaluating the vulnerability of the process, the equipment most susceptible to failure or intrusions, and related effects on production, and the eventual risks for process operators. Secondly, the industrial control system must be improved to increase its resilience against anomalies and intrusion, through ad-hoc algorithms implementing fault and cyber-attacks detection methodologies. This work proposes a solution for automatic detection of faults and attacks in accelerated cooling lines, an important process in steelworks. The detection system is composed of a physical computational platform and a software application for monitoring the state of the system, reacting to anomalies and attacks and sending alarms to operators. Detection algorithms exploit plant models, banks of extended Kalman filters and classification algorithms based on One Class Support Vector machines. The algorithms and software have been tested in real-time through a Hardware In the Loop approach with successful and encouraging results.