In this paper, problems of the online diagnostics of multiple faults in large scale systems are presented. Possibilities of recognition of multiple faults based on the knowledge of signatures of the single faults are discussed. The distinction between simultaneous faults and the series of faults is introduced and defined. The necessary condition for diagnostic reasoning assuming an occurrence of multiple faults is formulated. This paper will show that multiple faults appearing simultaneously or within short time intervals are correctly isolated under the assumption of single faults, if the subsets of faults suitable for isolation are disjunctive. A novel, practical and easy to implement algorithm designed for reasoning multiple faults is presented. An industrial example of the online diagnostics of a steam-water line of the power boiler is given.

The definitions and conditions for fault isolability of single faults for various forms of the diagnostic relation are reviewed. Fault isolability and unisolability on the basis of a binary diagnostic matrix are analyzed. Definitions for conditional and unconditional isolability and unisolability on the basis of a fault information system (FIS), symptom sequences and directional residuals are formulated. General definitions for conditional and unconditional isolability and unisolability in the cases of simultaneous evaluation of diagnostic signal values and a sequence of symptoms are provided. A comprehensive example is discussed.

This paper is concerned with the issue of the diagnostics of process faults and the detection of cyber-attacks in industrial control systems. This problem is of significant importance to energy production and distribution, which, being part of critical infrastructure, is usually equipped with process diagnostics and, at the same time, is often subject to cyber-attacks. A commonly used approach would be to separate the two types of anomalies. The detection of process faults would be handled by a control team, often with a help of dedicated diagnostic tools, whereas the detection of cyber-attacks would be handled by an information technology team. In this article, it is postulated here that the two can be usefully merged together into one, comprehensive, anomaly detection system. For this purpose, firstly, the main types of cyber-attacks and the main methods of detecting cyber-attacks are being reviewed. Subsequently, in the analogy to “process fault”—a term well established in process diagnostics—the term “cyber-fault” is introduced. Within this context a cyber-attack is considered as a vector containing a number of cyber-faults. Next, it is explained how methods used in process diagnostics for fault detection and isolation can be applied to the detection of cyber-attacks and, in some cases, also to isolation of the components of such attacks, i.e., cyber-faults. A laboratory stand and a simulator have been developed to test the proposed approach. Some test results are presented, demonstrating that, similarly to equipment/process faults, residua can be established and cyber-faults can be identified based on the mismatch between the real data from the system and the outputs of the simulation model.

The paper analyses the research problem of conducting diagnostic reasoning for dynamic objects to eliminate the possibility of formulating false diagnoses resulting from different delays of the symptoms related to a particular fault while simultaneously striving to obtain high distinguishability. The research aimed to develop a new diagnostic inference method robust to symptom delays and characterised by high accuracy of generated diagnosis. Known methods ensuring the correctness of inference in the case of symptom delays but at the cost of reducing distinguishability of faults have been characterised. A new inference method was developed, which uses the three-valued residual evaluation and knowledge regarding elementary symptom sequences. A formal description of the diagnosing system and the proposed method are given. The method of obtaining the knowledge about the order of symptoms based on a cause-and-effect graph and was characterised. The method’s effectiveness was presented in simulation studies on the example of diagnosing a set of serially connected tanks. The comparison of the fault distinguishability obtained using the proposed method and other approaches illustrates the new method’s advantages.