Kaspersky Industrial CyberSecurity for Networks

Rules with defined conditions for tag values

March 22, 2024

ID 140567

To monitor the values of tags, you can employ Process Control rules in which conditions are defined for the values of tags. Each rule can contain one of the provided types of conditions. A rule can be bound to only one tag. However, you can create up to 20 rules with different types of conditions for one tag.

Rules with defined conditions can be created automatically by the application when Process Control is running in learning mode. You can also manually create and edit rules with defined conditions for the values of tags.

For a Process Control rule, you can select one of the following types of conditions:

  • Value changed – the value of the controlled tag was either completely changed or was changed in a specific bit.

    If a particular bit of a value is not being specifically monitored, you can use this condition to monitor the value of any type of tag. You can also specify the number of saved (allowed) values of a tag whose detection will not result in the registration of an event. For a rule, you can specify a number of saved values from 1 to 10 (the saved values will be updated as new values are detected). By default, only the latest value is saved.

    If a particular bit of a value is being specifically monitored, you can use this condition to monitor only int and unsigned int tags. For monitoring purposes, you need to specify the sequence number of the monitored bit in the tag (integer within the range corresponding to the data type of the selected tag: from 1 to 8, 16, 32 or 64).

  • Tag missing – the controlled tag was not detected in monitored traffic during the defined time period.

    You can use this condition to monitor any type of tag.

  • Detection – the controlled tag was detected in the traffic being monitored.

    You can use this condition to monitor any type of tag.

  • In range – the value of the controlled tag is inside the specified range.

    You can use this condition to monitor only int and float tags.

    You can define values for the lower and/or upper limit of the range. The defined values for limits can be included in the range or excluded from it.

  • Out of range – the value of the controlled tag is outside of the specified range.

    You can use this condition to monitor only int and float tags.

    You can define values for the lower and/or upper limit of the range. The defined values for limits can be included in the range or excluded from it.

  • Equals – the value of the controlled tag is equal to one of the defined values, either completely or in a specific bit.

    If a particular bit of a value is not being specifically monitored, you can use this condition to monitor the value of int, bool and string tags. You can define from 1 to 10 values for comparison.

    If a particular bit of a value is being specifically monitored, you can use this condition to monitor only int and unsigned int tags. For monitoring purposes, you need to specify the sequence number of the monitored bit in the tag (integer within the range corresponding to the data type of the selected tag: from 1 to 8, 16, 32 or 64) and the value of the bit for comparison (indicated as one of two integers: zero or one).

  • Does not equal – the value of the controlled tag is not equal to one of the defined values, neither completely nor in a specific bit.

    If a particular bit of a value is not being specifically monitored, you can use this condition to monitor the value of int, bool and string tags. You can define from 1 to 10 values for comparison.

    If a particular bit of a value is being specifically monitored, you can use this condition to monitor only int and unsigned int tags. For monitoring purposes, you need to specify the sequence number of the monitored bit in the tag (integer within the range corresponding to the data type of the selected tag: from 1 to 8, 16, 32 or 64) and the value of the bit for comparison (indicated as one of two integers: zero or one).

  • Monotonic change violation – the value of a controlled tag violates the sequence of monotonic increase or reduction of values.

    You can use this condition to monitor only int and float tags.

For rules that monitor the values of tags, you need to take into account how the application processes values represented by denormalized numbers (low-order numbers approaching zero – for example, 2.22507e-308 if this value is represented with double precision). The application converts denormalized numbers into zero values.

For any condition, you can select the operations for which the application will monitor the values of a tag. The following monitoring options are available depending on operations performed with the tag:

  • Monitor when reading tag – the value is checked when reading a tag from a device.
  • Monitor when writing tag – the value is checked when writing a tag to a device.

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.