Cyber monitor segmented processing for control systems

1. A cyber monitored control system comprising:

a controller comprising a first processing resource of a processing system operable to execute a control application for a controlled system; and

a cyber monitor comprising a second processing resource of the processing system isolated from the first processing resource in processing circuitry and in separate sections of a memory system of the processing system, the cyber monitor operable to:

evaluate a plurality of inputs of the controller with respect to a cyber threat model;

receive a plurality of built-in test results of diagnostics executed by the control application and configured to detect a problem within the processing system;

apply trending using the cyber threat model to distinguish between a fault and a cyber attack, wherein the cyber threat model comprises a plurality of rules and/or characteristics that are indicative of the cyber attack;

isolate one or more subsystems of the cyber monitored control system based on identifying the cyber attack;

wherein the cyber monitoring system is coupled to a sensor system, and the cyber monitor is operable to compare a plurality of raw input data received from the sensor system with conversion logic outputs of the controller to verify conversion logic performance of the controller; and

the controller is implemented using one or more hardware processors.

2. The cyber monitoring system of claim 1 , wherein the inputs comprise one or more sensor inputs.

3. The cyber monitoring system of claim 2 , wherein one or more of the inputs are derived from redundant sensors and related input/output signals.

4. The cyber monitoring system of claim 3 , wherein the related input/output signals are received from a model of the controlled system configured to derive a model vector based on one or more input vectors, one or more output vectors, and one or more laws of physics associated with operation of the controlled system.

5. The cyber monitoring system of claim 4 , wherein trending identifies inconsistent behavior that does not match a known fault mode or an expected result from the model of the controlled system as a probable cyber attack.

6. The cyber monitoring system of claim 1 , wherein the cyber threat model is trained using artificial intelligence to adapt as one or more cyber threats are characterized.

7. The cyber monitoring system of claim 1 , wherein the cyber monitor is operable to verify one or more update rates of the controller and monitor behavior of one or more control loops of the controller.

8. The cyber monitoring system of claim 1 , wherein the cyber monitor is updateable through a cyber monitor update process comprising one or more security controls that are independent of an update process of the controller.

9. The cyber monitoring system of claim 1 , wherein the cyber monitor is operable to track one or more communication anomalies and isolate a communication interface associated with the one or more communication anomalies based on identifying the cyber attack.

10. A method comprising:

evaluating, by a cyber monitor, of a cyber monitored control system, a plurality of inputs of a controller of the cyber monitored control system with respect to a cyber threat model, the controller comprising a first processing resource of a processing system operable to execute a control application for a controlled system and the cyber monitor comprising a second processing resource isolated from the first processing resource in processing circuitry and in separate sections of a memory system of the processing system;

receiving a plurality of built-in test results of diagnostics executed by the control application and configured to detect a problem within the processing system;

applying trending, by the cyber monitor, using the cyber threat model to distinguish between a fault and a cyber attack, wherein the cyber threat model comprises a plurality of rules and/or characteristics that are indicative of the cyber attack;

isolating one or more subsystems of the cyber monitored control system based on identifying the cyber attack;

wherein the cyber monitoring system is coupled to a sensor system and further comprising: comparing, by the cyber monitor, a plurality of raw input data received from the sensor system with conversion logic outputs of the controller to verify conversion logic performance of the controller; and

the controller is implemented using one or more hardware processors.

11. The method of claim 10 , wherein the inputs comprise one or more sensor inputs.

12. The method of claim 11 , wherein one or more of the inputs are derived from redundant sensors and related input/output signals.

13. The method of claim 12 , further comprising:

receiving the related input/output signals from a model of the controlled system configured to derive a model vector based on one or more input vectors, one or more output vectors, and one or more laws of physics associated with operation of the controlled system.

14. The method of claim 13 , wherein trending identifies inconsistent behavior that does not match a known fault mode or an expected result from the model of the controlled system as a probable cyber attack.

15. The method of claim 10 , further comprising:

training the cyber threat model using artificial intelligence to adapt as one or more cyber threats are characterized.

16. The method of claim 10 , further comprising:

verifying, by the cyber monitor, one or more update rates of the controller; and

monitoring, by the cyber monitor, behavior of one or more control loops of the controller.

17. The method of claim 10 , wherein the cyber monitor is updateable through a cyber monitor update process comprising one or more security controls that are independent of an update process of the controller.

18. The method of claim 10 , further comprising:

tracking, by the cyber monitor, one or more communication anomalies and isolate a communication interface associated with the one or more communication anomalies based on identifying the cyber attack.