Software defined automation system and architecture

Patent metadata

Field	Value
Publication number	US-11579595-B2
Application number	US-201715700443-A
Country	US
Kind code	B2
Filing date	Sep 11, 2017
Priority date	Oct 13, 2015
Publication date	Feb 14, 2023
Grant date	Feb 14, 2023

Abstract

Embodiments of a software defined automation system that provides a reference architecture for designing, managing and maintaining a highly available, scalable and flexible automation system. In some embodiments, an SDA system can include a localized subsystem including a system controller node and multiple compute nodes. The multiple compute nodes can be communicatively coupled to the system controller node via a first communication network. The system controller node can manage the multiple compute nodes and virtualization of a control system on a compute node via the first communication network. The virtualized control system includes virtualized control system elements connected to a virtual network that is connected to a second communication network to enable the virtualized control system elements to control a physical control system element via the second communication network connected to the virtual network.

First claim

What is claimed is:

1. A software-defined automation (SDA) system implementing a virtualized automation control system on at least one host running on at least one compute node, comprising:
a system controller executing on a host running on a compute node, the system controller managing one or more compute nodes over a first communication network; and
wherein the system controller in response to receiving virtualization description specifying at least a type and quantity of automation devices that comprise an automation control system or a portion thereof and an associated redundancy requirement, create a virtualized automation control system corresponding to the received virtualization description along with associated virtual network on at least one compute node from the one or more compute nodes,
wherein the virtualized automation control system includes at least one virtual automation controller executing an automation control system function, the virtualized automation control system executing on at least one host running on the at least one compute node, the at least one virtual automation controller of the virtualized automation control system remotely controlling operation of at least one physical automation control system component in real time via a second communication network in place of a physical automation controller controlling operation of the at least one physical automation control system component in real time, the physical automation controller being offline with respect to the at least one physical automation control system component while the at least one virtual automation controller is controlling the at least one physical automation control system component.

2. The SDA system of claim 1 , wherein the one or more compute nodes includes an edge device that is selected in part based on its proximity to the at least one physical automation control system component and a server machine.

3. The SDA system of claim 1 , wherein the at least one host includes a virtual machine, container or bare metal.

4. The SDA system of claim 1 , further comprising:
a cyber security controller, wherein the cyber security controller provides at least one security policy to the system controller in response to creation of the virtualized automation control system for configuring security of the virtualized automation control system, and the at least one host executing the virtualized automation control system on the at least one compute node.

5. The SDA system of claim 4 , wherein the at least one security policy requires a firewall for the virtualized automation control system, and wherein the system controller, in accordance with the at least one security policy, instantiates a virtual firewall for the virtualized automation control system on the at least one compute node.

6. The SDA system of claim 4 , further comprising:
a network controller, wherein the network controller, in response to creation of the virtualized automation control system by the system controller, configures at least one physical or virtual network component to manage network traffic flow associated with the control of the at least one physical automation control system component.

7. The SDA system of claim 6 , wherein the network controller controls the at least one physical or virtual network component by deploying one or more network policies.

8. The SDA system of claim 7 , wherein the one or more network policies include policies for controlling at least one of: connectivity, bandwidth, latency and traffic flow.

9. The SDA system of claim 6 , wherein the cyber security controller provides at least one security policy to the network controller to configure security of at the least one physical or virtual network component.

10. The SDA system of claim 9 , wherein the at least one security policy specifies types of commands allowed to propagate through the second communication network to the at least one physical automation control system component via the at least one physical or virtual network component.

11. The SDA system of claim 1 , further comprising:
a network controller, wherein the network controller, in response to a change in the automation control system, configures at least one physical or virtual network component to manage network traffic flow associated with the control of the at least one physical automation control system component.

12. The SDA system of claim 11 , wherein the network controller includes a time sensitive network component for handling time-sensitive deterministic network traffic.

13. The SDA system of claim 1 , wherein the virtualized automation control system includes a component of a software implementation of an embedded system or a component in an embedded system.

14. The SDA system of claim 1 , wherein managing the one or more compute nodes includes instantiating, configuring, starting, stopping and destroying hosts on the one or more compute nodes.

15. The SDA system of claim 1 , further comprising a system software running on a host on a compute node from the one or more compute nodes, the system software communicating, via an application programming interface, the virtualization description.

16. The SDA system of claim 1 , further comprising a system software through which at least two of: topology, inventory, configuration or diagnostics information corresponding to the automation control system are accessible to an entity, the system software running on a host on a compute node from the one or more compute nodes.

17. The SDA system of claim 1 , wherein the system controller and the one or more compute nodes are localized in a single highly available server.

18. The SDA system of claim 1 , wherein the automation control system is a control system associated with a building automation system.

19. The SDA system of claim 1 , wherein the automation control system is a control system associated with an industrial automation system.

20. A method of defining an automation system via software comprising:
in response to receiving virtualization description specifying at least a type and quantity of automation devices that comprise an automation control system or a portion thereof and an associated redundancy requirement, creating a virtualized automation control system corresponding to the received virtualization description along with associated virtual network on at least one compute node from one or more compute nodes, wherein the system controller is communicatively coupled to the one or more compute nodes via a first communication network,
wherein the virtualized automation control system includes at least one virtual automation controller executing an automation control system function, the virtualized control system executing on at least one host running on the at least one compute node; and
remotely controlling, by the at least one virtual automation controller of the virtualized automation control system in real time, operation of at least one physical automation control system component via a second communication network in place of a physical automation controller controlling operation of the at least one physical automation control system component in real time, the physical automation controller being offline with respect to the at least one physical automation control system component while the at least one virtual automation controller is controlling the at least one physical automation control system component.

21. A software-defined automation (SDA) system comprising:
a pl

Assignees

• Schneider Electric Ind Sas

Inventors

• Chauvet Antonio
• Wilhelm Philippe
• Harriman Merrill
• Alfano Eric
• Mehmedagic Alen
• Kling Andrew Lee David
• Doggett David
• Vallala Vijay
• Nappey Philippe

Classifications

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L41/0806

  for initial configuration or provisioning, e.g. plug-and-play · CPC title

• H04L41/08

  Configuration management of networks or network elements (address allocation H04L61/50) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title