Method for a safe guard detection of unexpected operations launched by an operator (Op-LA, Op_LB, OP-M) for a Manufacturing Execution System, called hereafter a «MES-System», where the MES-System is provided with - a first database containing - a set of operations, - a set of operators, - calendar information for a shift (Shift Cal) - calendar information for the equipment of a MES-System (Equip Cal); - a second database containing - a login history of carried out logins of the operator (Op-LA, Op-LB, OP-Z, OP-M); - a set of rules defining allowed combinations of operations being launched by an operator (Op-LA, Op-LB, OP-Z, OP-M) at a specific time according to the content of the first database; the method comprising the steps - checking launched operations whether they comply with the set of rules; - in case of non-compliance of a launched operation storing said launched operation together with data identifying the operator (Op-LA, Op-LB, OP-Z, OP-M) and his login data as an entry in an event trace file (EvTr) ; - analyzing the entries in the event trace file by an intrusion detection system (IDS) and - generating alerts based on the analysis of the entries in the event trace file (EvTr), wherein the step of checking launched operations includes at least one step selected from the group consisting of: 1) crosschecking of logins for detecting, whether an operator (Op-LA, Op-LB, OP-Z, OP-M) logs-in himself at different places at the same time where such simultaneous logins may not be expected, 2) determining whether an operation complies with an order scheduling being defined by the calendar information in the first database, and 3) performing a comparison of a login time of the operator (Op-LA, Op-LB, OP-Z, OP-M) with the calendar information for a shift stored in the first database. - a first database containing - a set of operations, - a set of operators, - calendar information for a shift (Shift Cal) - calendar information for the equipment of a MES-System (Equip Cal); - a set of operations, - a set of operators, - calendar information for a shift (Shift Cal) - calendar information for the equipment of a MES-System (Equip Cal); - a second database containing - a login history of carried out logins of the operator (Op-LA, Op-LB, OP-Z, OP-M); - a login history of carried out logins of the operator (Op-LA, Op-LB, OP-Z, OP-M); - a set of rules defining allowed combinations of operations being launched by an operator (Op-LA, Op-LB, OP-Z, OP-M) at a specific time according to the content of the first database; - checking launched operations whether they comply with the set of rules; - in case of non-compliance of a launched operation storing said launched operation together with data identifying the operator (Op-LA, Op-LB, OP-Z, OP-M) and his login data as an entry in an event trace file (EvTr) ; - analyzing the entries in the event trace file by an intrusion detection system (IDS) and - generating alerts based on the analysis of the entries in the event trace file (EvTr), 1) crosschecking of logins for detecting, whether an operator (Op-LA, Op-LB, OP-Z, OP-M) logs-in himself at different places at the same time where such simultaneous logins may not be expected, 2) determining whether an operation complies with an order scheduling being defined by the calendar information in the first database, and 3) performing a comparison of a login time of the operator (Op-LA, Op-LB, OP-Z, OP-M) with the calendar information for a shift stored in the first database. <EOS>