Tracking of health and resilience of physical equipment and related systems

Patent metadata

Field	Value
Publication number	US-12560639-B2
Application number	US-202217811843-A
Country	US
Kind code	B2
Filing date	Jul 11, 2022
Priority date	Jul 9, 2021
Publication date	Feb 24, 2026
Grant date	Feb 24, 2026

Abstract

Tracking of health and resilience of physical equipment and related systems are disclosed. A system includes physical equipment and one or more processors. The physical equipment includes one or more assets. The one or more processors are configured to determine a resilience metric for the physical equipment. The resilience metric includes a real power component and a reactive power component based, at least in part, on an aggregation of real components and reactive components of adaptive capacities of the one or more assets. A cyber-physical system includes physical equipment, network equipment configured to enable the physical equipment to communicate over one or more networks, a physical anomaly detection system (ADS) configured to detect anomalies in operation of the physical equipment and provide a physical component of a cyber-physical metric, and a cyber ADS configured to detect anomalies in network communications over the one or more networks.

First claim

What is claimed is:

1 . A system, comprising:
physical equipment including one or more assets; network equipment to enable at least one of the one or more assets to engage in network communications over one or more networks, the network communications including network communications of packets over the one or more networks; a human machine interface (HMI) operably coupled to the physical equipment and to the network equipment; and one or more processors configured to:
determine a physical health metric indicating a physical health of the physical equipment, the physical health metric determined based, at least in part, on detected anomalies in operation of the physical equipment;
determine a cyber health metric indicating a cyber health of the network equipment, the cyber health metric determined based, at least in part, on detected anomalies in traffic behavior of the network communications of the packets, the detected anomalies in the traffic behavior corresponding to cyberattacks on the one or more networks, the traffic behavior of the network communications of the packets identified from captured and analyzed packet header features of the packets;
determine a resilience metric for the physical equipment, the resilience metric including a real power component and a reactive power component determined based, at least in part, on an aggregation of real components and reactive components of adaptive capacities of the one or more assets;
generate a graphical user interface for display in the HMI, the graphical user interface including a diagram having a physical condition indicator, a cybernetic condition indicator, and a resilience condition indicator, the physical condition indicator based, at least in part, on the physical health metric, the cybernetic condition indicator based, at least in part, on the cyber health metric, and the resilience condition indicator based, at least in part, on the resilience metric; and
receive, via the HMI, a corrective action for processing in response to an adverse condition or threat indicated by the diagram of the graphical user interface, the corrective action to correct or prevent a system violation relating to a physical fault associated with the detected anomalies in the operation of the physical equipment when indicated by at least the physical condition indicator in the diagram, the corrective action to correct or prevent a system violation relating to a cyberattack-induced fault associated with the detected anomalies in the traffic behavior corresponding to a cyberattack when indicated by at least the cybernetic condition indicator in the diagram.

2 . The system of claim 1 , wherein the resilience metric is indicative of a magnitude and a duration of a disturbance during which the physical equipment is predicted to continue to operate within predefined normal operational parameters.

3 . The system of claim 1 , wherein the one or more processors are further configured to generate the graphical user interface including the diagram comprising a resilience-icon diagram, the resilience-icon diagram including the physical condition indicator, the cybernetic condition indicator, and the resilience condition indicator.

4 . The system of claim 3 , wherein the one or more processors are further configured to display resilience-icon diagrams for each of a plurality of aggregated system resources of an electrical power distribution system.

5 . The system of claim 1 , wherein the physical equipment includes electrical power distribution equipment.

6 . The system of claim 1 , wherein the physical equipment includes a solar generator asset.

7 . The system of claim 6 , wherein the one or more processors are configured to determine a solar resilience metric for the solar generator asset, the solar resilience metric based, at least in part, on a real component and a reactive component of an adaptive capacity of the solar generator asset, the solar resilience metric taking into consideration an uncertainty of the adaptive capacity of the solar generator asset.

8 . The system of claim 6 , wherein the physical equipment further includes a battery power storage asset.

9 . The system of claim 8 , wherein the one or more processors are configured to determine a battery resilience metric for the battery power storage asset, the battery resilience metric taking into consideration operation of the battery power storage asset as a power source during battery power discharge and as a power sink during battery power storage asset charging.

10 . The system of claim 1 , wherein the detected anomalies in the traffic behavior corresponding to the cyberattacks include multiple ones of a Denial-of-Service (DoS) attack, a reconnaissance attack, a replay attack, a data-insertion attack, a false-data-insertion attack, a Distributed Network Protocol 3 (DNP3) data injection attack, an IP scan attack, and a port scan attack.

11 . The system of claim 1 , wherein, in the graphical user interface, the diagram having the cybernetic condition indicator, the physical condition indicator, and the resilience condition indicator provides differentiation between physical faults associated with the physical equipment and cyber-attack-induced faults associated with the network equipment.

12 . A cyber-physical system, comprising:
physical equipment; network equipment configured to enable the physical equipment to engage in network communications over one or more networks, the network communications including network communications of packets over the one or more networks; a physical anomaly detection system (ADS) configured to detect anomalies in operation of the physical equipment and provide a physical component of a cyber-physical metric based on the detected anomalies in the operation of the physical equipment; a cyber ADS configured to detect anomalies in traffic behavior of the network communications of the packets over the one or more networks and provide a cyber component of the cyber-physical metric based on the detected anomalies in the traffic behavior, the detected anomalies in the traffic behavior corresponding to cyberattacks on the one or more networks, the traffic behavior of the network communications of the packets identified based on analysis of packet header features extracted from the packets; and human machine interface (HMI) operably coupled to the physical equipment and to the one or more networks, the HMI to:
present, for display, integrated information from the physical ADS and the cyber ADS, the integrated information including the cyber-physical metric indicating the physical component and the cyber component; and
receive a corrective action for processing in response to an adverse condition or threat indicated by the displayed integrated information, the corrective action to correct or prevent a system violation relating to a physical fault associated with the detected anomalies in the operation of the physical equipment when indicated by at least the physical component of the cyber-physical health metric, the corrective action to correct or prevent a system violation relating to a cyberattack-induced fault associated with the detected anomalies in the traffic behavior corresponding to a cyberattack when indicated by at least the cyber component of the cyber-physical health metric.

13 . The cyber-physical system of claim 12 , wherein the cyber ADS is configured to detect the anomalies in the behavior of the network communications of the packets by:
dissecting the packets communicated through the one or more networks; extracting the packet header features from dissected packets; and detecting anomalies in

Assignees

• Battelle Energy Alliance Llc
• Univ Virginia Commonwealth
• Univ Of Idaho

Inventors

• Lehmer Jacob P
• Rieger Craig G
• Vaagensmith Bjorn C
• Phillips Tyler B
• Mcjunkin Timothy R
• Ivans Robert C
• Singh Vivek Kumar
• Welch Justin J
• Li Ruixuan
• Marino Lizarazo Daniel
• Brahmana Mudiyanselage Chathurika Mudiyanselage Wickramasinghe
• Manic Milos
• Johnson Brian

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H02S50/10 Primary

  Testing of PV devices, e.g. of PV modules or single PV cells (testing of semiconductor devices during manufacturing {H10P74/00}) · CPC title

• H04L43/028

  by filtering · CPC title

• G06T2200/24

  involving graphical user interfaces [GUIs] · CPC title

• G01R31/36

  Arrangements for testing, measuring or monitoring the electrical condition of accumulators or electric batteries, e.g. capacity or state of charge [SoC] · CPC title