Software defined automation system and architecture

Patent metadata

Field	Value
Publication number	US-12585256-B2
Application number	US-202318095865-A
Country	US
Kind code	B2
Filing date	Jan 11, 2023
Priority date	Oct 13, 2015
Publication date	Mar 24, 2026
Grant date	Mar 24, 2026

Abstract

Embodiments of a software defined automation system that provides a reference architecture for designing, managing and maintaining a highly available, scalable and flexible automation system. In some embodiments, an SDA system can include a localized subsystem including a system controller node and multiple compute nodes. The multiple compute nodes can be communicatively coupled to the system controller node via a first communication network. The system controller node can manage the multiple compute nodes and virtualization of a control system on a compute node via the first communication network. The virtualized control system includes virtualized control system elements connected to a virtual network that is connected to a second communication network to enable the virtualized control system elements to control a physical control system element via the second communication network connected to the virtual network.

First claim

What is claimed is:

1 . A method for provisioning and configuring a functional unit in a software-defined automation (SDA) system comprising:
receiving a request to add or create a functional unit in an SDA system; authenticating the request based on at least one security policy; identifying or creating at least one virtual network in one or more compute node managed by the SDA system; creating and deploying a virtual instance of the functional unit in one or more compute nodes managed by the SDA system; and connecting the virtual instance of the functional unit to the at least one virtual network to provision the functional unit in the SDA system; receiving configuration information; determining at least one network path from the virtual instance of the functional unit to an automation device managed by the SDA system, the at least one network path traversing through the at least virtual network and a physical network; configuring, based on the received configuration information, the virtual instance of the functional unit and one or more network components in the at least one network path to enable the virtual instance of the functional unit to communicate with the automation device to control an automated process.

2 . The method of claim 1 , wherein configuring the one or more network components includes implementing one or more network policies to specify how the one or more network components are to direct different types of traffic flows.

3 . The method of claim 2 , wherein the one or more network policies includes policies for controlling at least one of: connectivity, bandwidth, latency and traffic flow.

4 . The method of claim 1 , wherein configuring the virtual instance of the functional unit further comprises configuring security of the virtual instance of the functional unit by implementing one or more security policies.

5 . The method of claim 4 , wherein in accordance with a security policy, configuring the security of the virtual instance of the functional unit includes creating a virtual instance of a security protection system on one or more compute nodes managed by the SDA system.

6 . The method of claim 4 , wherein configuring the security of the virtual instance of the functional unit further comprises configuring the security of one or more hosts on which the functional unit is executing, and the one or more compute nodes on which the one or more hosts are executing.

7 . The method of claim 6 , wherein in accordance with a security policy, validating an image of each of the one or more hosts on which the functional unit is executing.

8 . The method of claim 6 , wherein a host from the one or more hosts is one of a virtual machine, a container or a bare metal.

9 . The method of claim 1 , wherein receiving the request to add or create the functional unit in the SDA system further comprises receiving via a user interface a selection of a functional unit template from a functional unit template library, wherein the virtual instance of the functional unit is created from the selected functional unit template.

10 . The method of claim 9 , further comprising parameterizing the selected functional unit template by defining an instance identity, input/output connectivity and security profile.

11 . The method of claim 1 , wherein the virtual instance of the functional unit corresponds comprises two or more automation system components.

12 . The method of claim 1 , wherein a compute node in the one or more compute nodes is one of an automation controller, a server, a personal computer or a smart connected device.

13 . A software-defined automation (SDA) system comprising: a plurality of controllers and one or more compute nodes, wherein the plurality of controllers are communicatively coupled to the one or more compute nodes over a communication network, wherein the plurality of controllers are configured to work in coordination with one another to:
receive a request to add or create a functional unit in the SDA system; authenticate the request based on at least one security policy; identify or creating at least one virtual network in one or more compute nodes managed by the SDA system; create and deploy a virtual instance of the functional unit in one or more compute nodes managed by the SDA system; and connect the virtual instance of the functional unit to the at least one virtual network to provision the functional unit in the SDA system; receive configuration information; determine at least one network path from the virtual instance of the functional unit to an automation device managed by the SDA system, the at least one network path traversing through the at least virtual network and a physical network; configure, based on the received configuration information, the virtual instance of the functional unit and one or more network components in the at least one network path to enable the virtual instance of the functional unit to communicate with the automation device to control an automated process.

14 . The system of claim 13 , wherein the plurality of controllers include a system controller, a network controller and a cybersecurity controller.

15 . Non-transitory, computer-readable media comprising software instructions for provisioning and configuring a functional unit in a software-defined automation (SDA) system by:
receiving a request to add or create a functional unit in an SDA system; authenticating the request based on at least one security policy; identifying or creating at least one virtual network in one or more compute nodes managed by the SDA system; creating and deploying a virtual instance of the functional unit in one or more compute nodes managed by the SDA system; and connecting the virtual instance of the functional unit to the at least one virtual network to provision the functional unit in the SDA system; receiving configuration information; determining at least one network path from the virtual instance of the functional unit to an automation device managed by the SDA system, the at least one network path traversing through the at least virtual network and a physical network; configuring, based on the received configuration information, the virtual instance of the functional unit and one or more network components in the at least one network path to enable the virtual instance of the functional unit to communicate with the automation device to control an automated process.

16 . The non-transitory, computer-readable media of claim 15 , wherein configuring the one or more network components includes implementing one or more network policies to specify how the one or more network components are to direct different types of traffic flows.

17 . The non-transitory, computer-readable media of claim 16 , wherein the one or more network policies includes policies for controlling at least one of: connectivity, bandwidth, latency and traffic flow.

18 . The non-transitory, computer-readable media of claim 15 , wherein configuring the virtual instance of the functional unit further comprises configuring security of the virtual instance of the functional unit by implementing one or more security policies.

19 . The non-transitory, computer-readable media of claim 18 , wherein in accordance with a security policy, configuring the security of the virtual instance of the functional unit includes creating a virtual instance of a security protection system on one or more compute nodes managed by the SDA system.

20 . The non-transitory, compu

Assignees

• Schneider Electric Ind Sas

Inventors

• Chauvet Antonio
• Wilhelm Philippe
• Harriman Merrill
• Alfano Eric
• Mehmedagic Alen
• Kling Andrew Lee David
• Doggett David
• Vallala Vijay
• Nappey Philippe

Classifications

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L41/0806

  for initial configuration or provisioning, e.g. plug-and-play · CPC title

• H04L41/08

  Configuration management of networks or network elements (address allocation H04L61/50) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title