Industrial Incident Forensics: Sequence-of-Events Analysis Platform

Department

Development department — PFE 2026–2027

Context

When an industrial trip or incident occurs, operators must reconstruct the exact order of alarms, state changes and breaker operations recorded by PLCs, RTUs and protection relays. These events are scattered across systems with different formats and clocks, making post-incident analysis slow and incomplete.

Project

Build a platform that collects, centralizes, archives and displays time-stamped events for fast and reliable analysis.

Platform capabilities

• Event collection through OPC UA A&C, OPC A&E, IEC 104 and DNP3.
• Millisecond time-stamping and clock alignment.
• Centralized, long-term event archiving.
• Interactive timeline with filtering and correlation.
• First-out detection and incident reports.

Main topics

• Study SOE concepts, event sources and time synchronization.
• Design the event model and platform architecture.
• Develop event collection and archiving services.
• Build the timeline and analysis web interface.
• Validate the platform with simulated trips and load tests.

Deliverables

• Platform source code and setup.
• Web interface for event timelines and reports.
• Documentation including user guide, report and test reports.

Expected results

A single repository of all plant events, faster root-cause analysis after trips, and a reliable and auditable event history.

Keywords

Sequence of Events, Alarms & Events, Time Synchronization, Event Archiving, Root-Cause Analysis, IIoT, .NET/C#.