Edge gateway system with contextualized process plant knowledge base

Abstract

An edge gateway system securely transmits and displays data generated by and / or related to a process plant for consumption by external systems, and includes an edge-facing component that receives process plant-related data from the process plant via a field-facing component of the system. The received data can be consistent with a displayable data type system using a syntax known to the external system. The edge-facing component stores the received data in a data lake and mines the data lake to discover relationships between the stored data points. The received data and indications of the discovered relationships are stored in a contextualized process plant knowledge base such as a graph database, which can be accessed by external systems and other systems and applications via one or more access mechanisms, which may include utilities, services, servers and / or applications. Some access mechanisms allow external applications to be installed at edge-facing components.

Description

Technical Field

[0001] The present disclosure relates generally to process plants and process control systems, and more particularly to securing the transmission of process plant related data from the process plant / process control system to external systems that use or consume the process plant related data. Background Art

[0002] Distributed process control systems, such as those used in chemical, petroleum, pharmaceutical, paper product processing or other process plants, typically include one or more process controllers that are communicatively coupled to one or more field devices via an analog, digital or combined analog / digital bus, or via a wireless communication link or network. Field devices may be, for example, valves, valve positioners, switches, and transmitters (e.g., temperature, pressure, level, and flow rate sensors) that are located within a process environment and typically perform physical or process control functions, such as opening or closing a valve, or measuring a process parameter (e.g., pressure, temperature, etc.) to control one or more processes performed within a process plant or system. Intelligent field devices, such as field devices that conform to the well-known Fieldbus protocol, may also perform control calculations, alarm functions, and other control functions typically implemented within a controller. A process controller is also typically located within a plant environment, receives signals indicating process measurements made by a field device and / or other information related to the field device, and executes a controller application that runs, for example, different control modules that make process control decisions, generates control signals based on the received information, and coordinates with control modules or blocks executed in field devices, such as and Fieldbus field devices. A control module in a controller sends control signals to a field device via a communication line or link, thereby controlling the operation of at least a portion of a process plant or system.

[0003] Information from field devices and controllers is typically available through data highways to one or more other hardware devices, such as operator workstations, personal computers or computing devices, data historian devices, report generators, centralized databases or other centralized management computing devices, which are typically located in a control room or other locations away from a more hostile plant environment. Each of these hardware devices is typically concentrated on the entire process plant or a portion of the process plant. These hardware devices run applications that can, for example, enable operators to perform functions related to controlling processes and / or operating process plants, such as changing the settings of process control routines, modifying the operation of control modules within controllers or field devices, viewing the current state of the process, viewing alarms generated by field devices and controllers, simulating the operation of processes for the purpose of training personnel or testing process control software, maintaining and updating configuration databases, etc. The data highways used by hardware devices, controllers, and field devices may include wired communication paths, wireless communication paths, or a combination of wired and wireless communication paths.

[0004] As an example, the DeltaV sold by Emerson Automation Solutions TMThe control system includes multiple applications stored in different devices at different locations within the process plant and executed by these devices. Configuration applications residing in one or more workstations or computing devices enable users to create or change process control modules and download these process control modules to dedicated distributed controllers through data highways. Typically, these control modules consist of communicatively interconnected function blocks, which are objects in object-oriented programming protocols that perform functions within the control scheme based on their inputs and provide outputs to other function blocks within the control scheme. The configuration application can also allow the configuration designer to create or change an operator interface, which is used by the viewing application to display data to the operator and enable the operator to change settings within the process control routine, such as set points. Each dedicated controller, and in some cases, one or more field devices, stores and executes a respective controller application, which runs the control module assigned and downloaded thereto to implement the actual process control function. A viewing application, which may be executed on one or more operator workstations (or on one or more remote computing devices communicatively coupled to the operator workstations and the data highway), receives data from the controller application via the data highway and displays the data to a process control system designer, operator, or user using a user interface, and may provide any of a number of different views, such as an operator's view, an engineer's view, a technician's view, etc. A data historian application is typically stored in and executed by a data historian device that collects and stores some or all of the data provided via the data highway, while a configuration database application may be executed in another computer connected to the data highway to store the current process control routine configuration and data associated therewith. Alternatively, the configuration database may be located on the same workstation as the configuration application.

[0005] Generally speaking, the process control system of a process plant includes field devices, controllers, workstations and other devices interconnected by a set of hierarchical networks and buses. The process control system can be connected to various commercial and external networks, for example, to reduce manufacturing and operating costs, improve productivity and efficiency, provide timely access to process control and / or process plant information, etc. On the other hand, the interconnection of process plants and / or process control systems with enterprise and / or external networks and systems increases the risk of network intrusion and / or malicious network attacks, which may be caused by expected vulnerabilities in business systems and applications such as those used in enterprise and / or external networks. Network intrusion and malicious network attacks of process plants, networks and / or control systems may adversely affect the confidentiality, integrity and / or availability of information assets, which are generally similar vulnerabilities to general computing networks. However, unlike general computer networks, network intrusions of process plants, networks and / or control systems may also lead to not only damage, destruction and / or loss of plant equipment, products and other physical assets, but also loss of human life. For example, network intrusions may cause processes to become uncontrolled and thus produce explosions, fires, floods, exposure to hazardous materials, etc. Therefore, protecting communications related to process control plants and systems is extremely important. Summary of the invention

[0006] In an embodiment, a method for securely transmitting knowledge related to a process plant from a process plant via an edge gateway system for consumption by one or more external systems is disclosed. The method includes: receiving content data generated by the process plant when operating to control an industrial process from a field-oriented component of the edge gateway system at an edge-oriented component of the edge gateway system, and storing the content data in a data lake in one or more memories of the edge-oriented component. The method also includes: mining the data lake by the edge-oriented component to discover one or more relationships between different data points included in the content data; storing the content data and indications of the discovered relationships in a contextualized process plant knowledge base by the edge-oriented component; and providing one or more mechanisms by the edge-oriented component to access the contextualized process plant knowledge base, so that the information stored in the contextualized process plant knowledge base is available to one or more external systems via the edge-oriented component.

[0007] In an embodiment, an edge gateway system is disclosed for securely transmitting knowledge related to a process plant from a process plant for consumption by one or more external applications and / or systems. The edge gateway system includes an edge-facing component that is communicatively connected to a field-facing component of the edge gateway system, wherein the field-facing component is communicatively connected to the process plant. The edge-facing component includes one or more processors and one or more non-transitory memories, wherein the one or more non-transitory memories store a presentable data type system corresponding to the process plant and generated by the field-facing component; a contextual knowledge base that corresponds to the presentable data type system and stores content data provided by the process plant and indications of relationships between the content data; and one or more access mechanisms to the contextual knowledge base. At least one of the one or more access mechanisms is exposed to one or more external applications and / or systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 is a block diagram of an example edge gateway system for an industrial process plant.

[0009] Figure 2 is a block diagram of an example industrial process plant, particularly illustrating the interconnection between various example components of the process plant or process control system, the process control system itself, and other example associated systems and / or networks at a similar security level as the process plant.

[0010] Figure 3 is a block diagram of example field-oriented components of an edge gateway system for a process plant or process control system.

[0011] Figures 4A-4C Example data types of an example demonstrable data type system generated by a field-oriented component of an edge gateway system for a process plant or process control system are shown.

[0012] Figure 5A is a block diagram of a first portion of edge-oriented components of an edge gateway system for a process plant or process control system.

[0013] Figure 5B yes Figure 5A Block diagram of the second part of the edge-facing component. DETAILED DESCRIPTION

[0014] Protecting process plants and process control systems from network intrusions and malicious network attacks typically utilizes a layered or hierarchical security hierarchy, where at least some layers or levels are protected by using firewalls and other security mechanisms. Using the Purdue model of the control hierarchy logic framework standardized by ISA (International Society of Automation) 95.01-IEC (International Electrotechnical Commission) 62264-1 as an example framework, process control systems typically fall into security levels 0-2 (e.g., OT (operational technology) levels, which have a higher level of trust in terms of the security and validity of messages, packets, and other communications), and manufacturing, corporate, and enterprise systems typically fall into security levels 3-5 (e.g., IT (information technology) levels, which have a lower level of trust). For example, for example, by using a demilitarized zone (DMZ) and / or one or more firewalls, process plant systems, networks, and devices at security levels 0-3 can be protected from threats from enterprise networks at security levels 4-5 and / or from any external network higher than security level 5 that utilizes the enterprise network. However, as more and more services and applications that operate on process plant data are moved to execute remotely, for example, on networks and systems outside or external to the process plant (e.g., at security level 4 and / or 5 within the enterprise or business with which the process plant is associated, owned and / or operated), and / or even on networks and systems external to the enterprise or business (e.g., above security level 5, via the Internet or other public networks), stronger techniques are needed to prevent process plant systems, networks, and devices from being compromised.

[0015] The innovative systems, components, apparatus, methods and techniques described herein address these and other security issues associated with process plants and their networks, and particularly relate to securely transmitting process plant-related data to one or more external systems that are consumers of the process plant-related data.

[0016] To illustrate, Figure 1 is a block diagram of an example edge gateway system 1 that securely communicates process plant related data (e.g., field data) from a process plant 5 to one or more external data consuming applications and / or systems (which may include enterprise applications and / or systems (e.g., at an IT security level, such as security level 3-5)), and / or third-party applications and / or systems. The edge gateway system 1 includes a field-facing component 10 that is communicatively connected to an edge-facing component 12 via a data diode 15. The field-facing component 10 includes one or more processors 18 and one or more non-transitory memories or data storage devices 20 storing at least one data set and at least one set of computer executable instructions, wherein the at least one set of computer executable instructions is executable by the one or more processors 18. For example, Figure 1As shown, one or more memories 20 of the field-oriented component 10 store corresponding data sets, such as one or more interest lists 22, a displayable data type system 24A, and optional other data sets (not shown). The one or more memories 20 of the field-oriented component 10 also store computer executable instructions for a data classifier (data typer) 25, and may store other computer executable instruction sets (not shown). The field-oriented component 10 is communicatively connected to one or more process plant communication networks, data networks and / or links 28, which may include any number of wired and / or wireless communication networks, data networks and / or links, which are communicatively connected to various devices and / or other data sources 30 associated with the process plant 5, and generate data, for example, when the process plant 5 operates to control an industrial process. A more detailed description of embodiments of the field-oriented component 10 and its subcomponents of the edge gateway system 1 is provided in other parts of the present disclosure.

[0017] The edge-facing component 12 of the edge gateway system 1 includes one or more processors 35 and one or more non-transitory memories or data storage devices 38 storing at least one data set and at least one set of computer-executable instructions, wherein the at least one set of computer-executable instructions can be executed by the one or more processors 35. For example, Figure 1 As shown, one or more memories 38 of the edge-oriented component 12 store at least a partial copy 24B of the displayable data type system 24A of the field-oriented component 10, corresponding data sets corresponding to the data lake 40 and the contextual knowledge base 42, and one or more memories 38 of the edge-oriented component 12 store corresponding computer executable instructions of the contextual knowledge miner 45 and one or more access mechanisms 48 of the contextual knowledge base 42. Of course, although Figure 1 Although not shown, one or more memories 38 of the edge-facing component 12 may store other data sets and / or other computer-executable instruction sets. Figure 1 As shown, the edge-oriented component 12 of the edge gateway system 1 is communicatively connected to one or more external data consumption systems 8 via one or more external communication networks, data networks and / or links 50. One or more external communication networks, data networks and / or links 50 may include any number of wired and / or wireless communication networks, data networks and / or links, and may include any number of private and / or public networks and / or links. One or more external systems 8 may include any number of public computing systems and / or private computing systems, which may be implemented using any suitable technology, such as server groups, cloud computing systems, etc., respectively, and various applications (e.g., third-party applications, websites, etc.) may be executed thereon. A more detailed description of embodiments of the edge-oriented component 12 and its subcomponents is provided in other parts of the present disclosure.

[0018] like Figure 1 As shown, the field-facing component 10 and the edge-facing component 12 are interconnected via a data diode 15 (although in some embodiments of the edge gateway system 1 (not shown), the data diode 15 may be omitted and the field-facing component 10 and the edge-facing component 12 are directly connected, or are an integrated, single logical and / or physical component). In any case, as Figure 1 As shown, the data diode 15 includes one or more transmission media via which data (e.g., electronic data) is transmitted from the field-facing component 10 to the edge-facing component 12, wherein the data diode 15 is the only communication connection between the field-facing component 10 and the edge-facing component 12. In a preferred embodiment, the data diode 15 is unidirectional, so that any and all types of data (e.g., signaling data, control data, management data, payload data, etc.) only flow from the field-facing component 10 to the edge-facing component 12, and do not flow from the edge-facing component 12 to (and indeed, in some embodiments, cannot physically flow to) the field-facing component 10. That is, the data diode 15 can be physically and / or logically configured to prevent any and all types of data (e.g., signaling data, control data, management data, payload data, etc.) from flowing from the edge-facing component 12 to the field-facing component 10. In one example, the unidirectional data diode 15 is implemented using a fiber optic link or cable, or some other suitable type of high bandwidth hardware and / or software transmission medium, such as an Ethernet link, a wireless data diode, a software defined data diode, etc. In another example, the hardware and / or software of the unidirectional data diode 15 may be otherwise configured to prevent any type of data (e.g., signaling data, control data, management data, payload data, etc.) from flowing from the edge-facing component 12 to the field-facing component 10, while supporting data from the field-facing component 10 to the edge-facing component 12. For example, a physical port of the edge-facing component 12 that would otherwise receive data from one or more external systems 8 may be blocked, disabled, and / or omitted.

[0019] For additional security, data transmitted from the field-oriented component 10 through the data diode 15 to the edge-oriented component 10 can be encrypted by the field-oriented component 10 and decrypted by the edge-oriented component 12. In addition, for efficiency, the data diode 15 is configured to support high-throughput data streaming, such as at a rate of 100K parameters per second or higher. In fact, in some embodiments, the data diode 15 can operate at a rate of 1 gigabit per second or higher. For example, the data diode 15 can be implemented using an optical fiber link or optical cable, or some other suitable type of high-bandwidth hardware and / or software transmission medium (such as an Ethernet link, a wireless data diode, a software-defined data diode, etc.) to support high-throughput data streaming capabilities. This high-bandwidth hardware and / or software transmission medium can be implemented as a unidirectional transmission capability for the field-oriented component 10 and does not have any receiving capability, thereby further implementing only a single-way, unidirectional data transmission from the field-oriented component 10 to the edge-oriented component 12. In addition, the data diode 15 can be easily scaled to accommodate system growth. For example, multiple cores and / or multiple threads may be added and / or utilized to support system growth and a corresponding increase in the amount and rate of data transferred from the field-oriented component 10 to the edge-oriented component 12 .

[0020] In general, the edge gateway system 1 securely connects and / or bridges a process plant 5 and related systems at a lower security level with one or more data consuming systems 8 at a higher security level. For example, referring to the Purdue model (or other similar security hierarchy), the data source 30 and the network / link 28 through which the edge gateway system 1 obtains process plant related data can be at a lower security level (e.g., security level 0 to security level 2), and can include, for example, process control systems, safety instrumented systems, configuration systems, analysis systems, communication / network systems, asset management systems, diagnostic and / or test tools and / or systems, debugging tools and / or systems, user devices and / or operator interfaces, historical library systems, batch systems, software defined networks, virtual networks such as virtual private networks, virtual local area networks (VLANs) and / or virtual extensible local area networks (VXLANs), and other systems, networks, applications and / or devices associated with the process plant 5. Therefore, for ease of discussion herein, and not for limitation, the term "process plant 5" is used to collectively refer to the physical process plant and other systems associated with and communicatively connected to the physical process plant that generate and / or transmit data at a lower security level.

[0021] exist Figure 1In the edge gateway system 1, the field-oriented component 10 that obtains and initially processes the process plant-related data (e.g., field data) generated by the process plant 5 may be at security level 2 to security level 3, and the data diode 15 and the edge-oriented component 12 may be at security level 3. One or more external data consuming systems 8 may be at security level 4 or higher, and may include any number of public and / or private systems and various applications executed thereon, such as enterprise applications and / or systems, third-party applications and / or systems, publicly available applications and / or systems, websites, etc. In this way, the edge gateway system 1 securely transmits the field data generated by the process plant and its related systems, networks, and / or applications 5 at a lower security level to the systems, networks, and / or applications 8 at a higher security level.

[0022] In particular, if Figure 1 As shown, the field-oriented component 10 of the edge gateway system 1 obtains or collects field data from a data source 30 according to one or more interest lists 22 stored at the field-oriented component 10. The interest list 22 indicates specific process plant-related or field data generated by the process plant 5 and related to the plant 5 operating to control an industrial process, wherein the indicated process plant-related field data is allowed to be displayed (e.g., displayable) to an external system, network and / or application 8. In this way, the interest list 22 included in the edge gateway system 1 provides an initial level of field-oriented security to prevent protected field data from being inadvertently released from the process plant 5 to an external data consuming system 8. The interest list 22 can indicate specific field data of interest and / or combinations thereof, such as specific runtime data, event data, historical data, configuration data and / or any other type of process plant-related data, which is generated by and / or related to equipment, components and / or systems of the process plant 5 at a lower security level (e.g., at security levels 0-2). The interest list 22 can be accessed via an interest manager ( Figure 1 ) to be configured and / or defined, which is described in more detail in other parts of this disclosure.

[0023] In addition, at the field-oriented component 10, a data classifier 25 classifies the obtained interest list data content according to the displayable data type system 24A. In general, the displayable data type system 24A defines or configures a system of data types (including data definitions, names, values, fields, structures, classes, objects, etc.) that are displayed or otherwise available to the external data consumption system 8. In addition, the displayable data system 24A defines the names, mappings, conversions, groupings, assignments, and / or other arrangements of process plant-related or field data types to displayable data types so that the process plant-related data content can be utilized and understood by the external data consumption system 8. The terms "process plant-related data types" or "field data types" used interchangeably herein generally refer to data types (e.g., data definitions, names, values, fields, structures, classes, objects, etc.) that have been defined and / or configured for use by applications, devices, components, systems, and / or networks of the process plant 5 and its related systems at a lower security level. In an embodiment, the displayable data type system 24A may be defined or configured via an interest manager (e.g., in a manner such as described elsewhere in this disclosure). Regardless, the presentable data system 24A allows the external system 8 to interpret process plant related / field data generated by the process plant 5 and associated lower security level systems without the external system 8 needing to know any internal data definitions and / or configurations of the plant 5 and without having to query and / or initiate communications with and / or send responses to the process plant 5. In this way, the presentable data type system 24A and data classifier 25 of the edge gateway system 1 further protect the process plant 5 from possible security breaches from the external system 8. The presentable data type system 24A and data classifier 25 are described in more detail elsewhere in this disclosure.

[0024] At least due to the use of the data type displayable system 24A and the data classifier 25, the data diode 15 can be a truly unidirectional data diode. Currently known data diodes provide a unidirectional flow of content data, but allow a bidirectional flow of signaling, control and / or management data by allowing positive acknowledgements and / or error conditions to be transmitted from the data receiving end to the data sending end. However, the data diode 15 of the edge gateway system 1 can be truly unidirectional because no data of any type flows from its data receiving end to its data sending end. In fact, in an embodiment, the data diode 15 is physically configured to prevent any type of data (e.g., signaling, control, management, content, etc.) from being transmitted from the edge-facing component 12 to the field-facing component 10, for example, such as in an embodiment in which the data diode 15 is implemented via an optical transmission medium. In this way, at least due to the truly unidirectional nature of the data diode 15, the data diode 15 of the edge gateway system 1 further protects the process plant 5 from possible security breaches from the external system 8.

[0025] At the edge-facing component 12 of the edge gateway system 1, the classified field content data received from the field-facing component 10 via the data diode 15 is stored in the data lake 40. The contextual knowledge miner 45 mines the data lake 40 to discover relationships and associations between various field content data stored in the data lake 40, and generates / modifies / updates the contextual knowledge base 48 so that the contextual knowledge base 48 includes the received field content data and indications of the discovered relationships and / or associations (e.g., the contexts of the received field content data). In this way, the contextual knowledge base 48 stores process plant-related or field content data (e.g., runtime data, event data, historical data, and / or other types of data provided by the process plant 5), as well as contextual information indicating relationships between the provided process plant-related / field content data, conditions corresponding to the generation, transmission, and / or receipt of the process plant-related / field content data within the process plant 5, and / or other types of contexts of the process plant-related / field content data. The knowledge (eg, content data and associated context information, and optionally other data) stored in the context knowledge base 48 may be exposed to (eg, made available to) one or more external data consuming systems 8 .

[0026] In practice, the edge-facing component 12 provides one or more access mechanisms 48, via which the external data consumption system 8 can access at least some of the knowledge stored in the contextual knowledge base 48. Each access mechanism can include another level of protection against possible security breaches from the external system 8. For example, the access mechanism 48 can be implemented using an application programming interface (API), a container, etc. to help prevent unauthorized access to the contextual knowledge base 48 and / or the process plant 5 by an external system. In an embodiment, at least one access mechanism 48 may include a corresponding server or protected application, such as a search engine, executed at the edge-facing component 12, where a specific access mechanism (e.g., a server-specific or application-specific API) for the server or private application is exposed to the external system 8 for their use. The edge-facing component 12 and its subcomponents of the edge gateway system 1 are discussed in more detail in other sections of the present disclosure.

[0027] In general, the features, components, and architecture of the edge gateway system 1 provide an external data consuming system 8 with virtually unlimited access to process plant related data in a highly secure manner without affecting the performance of the process plant 5. In addition, because the edge gateway system 1 provides process plant related data to the external system 8 based on the context, such as providing process plant related content data within the context of the configuration of the process plant 5, the external system 8 can find and consume process plant related data faster and more easily. In addition, the edge gateway system 1 allows a variety of different types of data consuming applications to safely and easily operate on the contextual knowledge corresponding to the process plant 5, such as mobile connection applications, advanced analytical applications, open system technology applications (e.g., Node.JS, Docker, Linux, etc.), custom applications, IoT applications, IIoT applications, business and / or enterprise applications (e.g., Excel, Power BI, etc.) and / or other types of applications. In addition, the edge gateway system 1 is easily adapted to aggregate process plant related data from multiple process plants and discover relevant aggregated knowledge therefrom, as well as aggregate data from external systems with higher security levels (e.g., weather forecast systems, supply chain systems, financial systems, inventory management systems, etc.) and discover relevant aggregated knowledge therefrom.

[0028] Note that although Figure 1 The edge gateway system 1 is shown as including a single field-facing component 10 that is communicatively connected to the edge-facing component 12 via a unidirectional data diode 15, but this is only one of many possible arrangements. For example, in some embodiments, the field-facing component 10 and the edge-facing component 12 can be implemented as an integral component within the edge gateway system 1, and the data diode 15 can be omitted. In some embodiments, the field-facing component 10 and the data diode 15 can be implemented as an integral component of the edge gateway system 1, or the data diode 15 and the edge-facing component 12 can be implemented as an integral component. In some embodiments, multiple instances of the data diode 15 can be included in the edge gateway system 1, such as when an integral field-facing component 10 / data diode instance 15 is communicatively connected to an integral data diode instance 15 / edge-facing component 12. In other embodiments, the edge gateway system 1 may include a single edge-facing component 12 that is communicatively connected to multiple field-facing components 10 via corresponding data diodes 15. In these embodiments, the edge gateway system 1 can serve an entire process plant site, where field-wide data can be aggregated at the edge-facing component 12 and operated by various applications, such as monitoring applications, analysis applications, reporting applications, display applications, etc. Configurations of a single edge-facing component 12 and multiple field-facing components 10 can also be useful for serving multiple process plant sites, multiple process control systems, and / or other distributed configurations throughout an enterprise.

[0029] Process plant and related data sources

[0030] Figure 2 is a block diagram of an example process plant 100 configured to control an industrial process during online or runtime operation, and from which process plant-related data may be securely transmitted via an embodiment of an edge gateway system 1. For example, Figure 1 The process plant 5 may include Figure 2 At least a portion of a process plant 100. Figure 2 As shown, the process plant 100 is communicatively connected to an edge gateway system 102, which may be, for example, Figure 1 An embodiment of an edge gateway system 1.

[0031] The process plant 100 (also interchangeably referred to herein as a process control system 100 or process control environment 100) includes one or more process controllers that receive signals indicating process and / or other types of measurements made by field devices, process the information to implement control routines, and generate control signals that are sent to other field devices via a wired or wireless process control communication link or network to control the operation of an industrial process in the plant 100. Typically, at least one field device performs a physical function (e.g., opens or closes a valve, raises or lowers a temperature, makes a measurement, senses a condition, etc.) to control the operation of a process. Some types of field devices communicate with the controller using I / O devices and / or I / O electronic marshaling devices, hubs, servers, or systems. Process controllers, field devices, and I / O devices may be wired or wireless, and any number of wired and wireless process controllers, field devices, and I / O devices and combinations thereof may be included in the process plant environment or system 100.

[0032] For example, Figure 2A process controller 111 is shown that is communicatively coupled to wired field devices 115-122 via input / output (I / O) cards 126 and 128, and to wireless field devices 140-146 via a wireless gateway 135 and a process control data highway or trunk 110. The process control data highway 110 may include one or more wired and / or wireless communication links, and may be implemented using any desired or suitable or communication protocols, such as an Ethernet protocol, IP or other packet protocols, etc. In some configurations (not shown), the controller 111 may be communicatively coupled to the wireless gateway 135 using one or more communication networks other than or in addition to the trunk 110, such as by using any number of other wired or wireless communication links that support one or more communication protocols, data protocols, and / or industrial automation protocols, such as Wi-Fi or other IEEE 802.11 compliant wireless local area network protocols, mobile communication protocols (e.g., WiMAX, LTE or other ITU-R compliant protocols), HART-IP, other packet protocols, streaming protocols, Profibus, Fieldbus, etc.

[0033] Controller 111, for example, may be a DeltaV sold by Emerson Automation Solutions TM The controller 111 may be operable to implement a batch process or a continuous process using at least some of the field devices 115-122 and 140-146. In an embodiment, in addition to being communicatively connected to the process control data highway 110, the controller 111 is also communicatively connected to at least some of the field devices 115-122 and 140-146 using any desired hardware and software that is compatible with, for example, standard 4-20 mA devices, I / O cards 126, 128, and / or any smart communication protocol (e.g., Fieldbus protocol, protocol, Protocol, etc.). Figure 2 In the embodiment, controller 111, field devices 115-122 and I / O cards 126, 128 are wired devices, and field devices 140-146 are wireless field devices. Of course, wired field devices 115-122 and wireless field devices 140-146 can conform to any other desired standards or protocols, such as any wired or wireless protocols, including any standards or protocols developed in the future.

[0034] Figure 2The process controller 111 includes a processor 130 that implements or monitors one or more process control routines 138 (e.g., stored in a memory 132). The processor 130 is configured to communicate with the field devices 115-122 and 140-146 and with other nodes that are communicatively connected to the controller 111. It should be noted that any control routine or module described herein may have its portion implemented or executed by a different controller or other device, if desired. Likewise, the control routine or module 138 described herein to be implemented within the process control system 100 may take any form, including software, firmware, hardware, etc. The control routine may be implemented in any desired software format, such as using object-oriented programming, ladder logic, sequential function charts, functional block diagrams, or using any other software programming language or design paradigm. The control routine 138 may be stored in any desired type of memory 132, such as a random access memory (RAM) or a read-only memory (ROM). Likewise, the control routine 138 may be hard-coded into, for example, one or more EPROMs, EEPROMs, application specific integrated circuits (ASICs), or any other hardware or firmware elements. Thus, the controller 111 may be configured to implement a control strategy or control routine in any desired manner.

[0035] The controller 111 implements the control strategy using what are commonly referred to as function blocks, where each function block is an object or other portion (e.g., a subroutine) of an overall control routine and operates with other function blocks (via communications referred to as links) to implement a process control loop within the process control system 100. Control-based function blocks typically perform one of the following: an input function, such as an input function associated with a transmitter, sensor, or other process parameter measurement device; a control function, such as a control function associated with a control routine that performs PID, fuzzy logic, etc. control; or an output function, controlling the operation of some device, such as a valve, to perform some physical function within the process control system 100. Of course, there are hybrid and other types of function blocks. Function blocks can be stored in and executed by the controller 111, which is typically when these function blocks are used for standard 4-20mA devices and devices such as Some type of smart field device or situation associated with the device, or can be stored in and implemented by the field device itself, which can be Fieldbus device case. The controller 111 may thus include one or more control routines 138 that may implement one or more control loops that are executed by executing one or more function blocks.

[0036] Wired field devices 115-122 may be any type of device, such as sensors, valves, transmitters, positioners, etc., and I / O cards 126 and 128 may be any type of I / O device that conforms to any desired communication or controller protocol. Figure 2 In the embodiment, the field devices 115-118 are standard 4-20 mA devices or devices that communicate with the I / O card 126 via analog lines or combined analog and digital lines. devices, and the field devices 119-122 are intelligent devices, such as Fieldbus field devices and their use The Fieldbus communication protocol communicates with the I / O card 128 via a digital bus. However, in some embodiments, at least some of the wired field devices 115, 116, and 118-121 and / or at least some of the I / O cards 126, 128 may additionally or alternatively communicate with the controller 111 using the process control data highway 110 and / or by using other suitable control system protocols (e.g., Profibus, DeviceNet, Foundation Fieldbus, ControlNet, Modbus, HART, etc.).

[0037] exist Figure 2 In the present invention, the wireless field devices 140-146 use wireless protocols such as Protocol, communicates via the wireless process control communication network 170. Such wireless field devices 140-146 can communicate directly with one or more other devices or nodes of the wireless network 170, which are also configured to communicate wirelessly (e.g., using the wireless protocol or another wireless protocol). In order to communicate with one or more other nodes that are not configured for wireless communication, the wireless field devices 140-146 can utilize a wireless gateway 135 connected to the process control data highway 110 or to another process control communication network. The wireless gateway 135 provides access to various wireless devices 140-158 of the wireless communication network 170. In particular, the wireless gateway 135 provides communication coupling between the wireless devices 140-158, the wired devices 115-128 and / or other nodes or devices of the process control plant 100. For example, the wireless gateway 135 can provide communication coupling by using the process control data highway 110 and / or by using one or more other communication networks of the process plant 100.

[0038] Similar to the wired field devices 115-122, the wireless field devices 140-146 of the wireless network 170 perform physical control functions within the process plant 100, such as opening or closing a valve, or taking measurements of a process parameter. However, the wireless field devices 140-146 are configured to communicate using the wireless protocol of the network 170. As such, the wireless field devices 140-146, the wireless gateway 135, and the other wireless nodes 152-158 of the wireless network 170 are producers and consumers of wireless communication packets.

[0039] In some configurations of the process plant 100, the wireless network 170 includes non-wireless devices. Figure 2 middle, Figure 2 Field device 148 is a legacy 4-20mA device, while field device 150 is a wired To communicate within the network 170, the field devices 148 and 150 may be connected to the wireless communication network 170 via respective wireless adapters 152A, 152B. The wireless adapters 152A, 152B support wireless protocols such as WirelessHART and may also support protocols such as Fieldbus, PROFIBUS, DeviceNet, etc. In addition, in some configurations, the wireless network 170 may include one or more network access points 155A, 155B, which may be separate physical devices in wired communication with the wireless gateway 135, or may be provided as an integrated device with the wireless gateway 135. The wireless network 170 may also include one or more routers 158 to forward packets from one wireless device to another wireless device within the wireless communication network 170. Figure 2 In the embodiment of the present invention, the wireless devices 140 - 146 and 152 - 158 communicate with each other and with the wireless gateway 135 through the wireless links 160 of the wireless communication network 170 and / or via the process control data highway 110 .

[0040] exist Figure 2 , the process control system 100 includes one or more operator workstations 171 that are communicatively coupled to the data highway 110. Using the operator workstations 171, an operator can view and monitor the runtime operation of the process plant 100, and can take any diagnostic, corrective, maintenance, and / or other actions that may be required. At least some of the operator workstations 171 can be located in various protected areas in or near the plant 100, such as in a backend environment of the plant 100, and in some cases, at least some of the operator workstations 171 can be remotely located, but still communicatively coupled to the plant 100. The operator workstations 171 can be wired or wireless computing devices.

[0041] The example process control system 100 is also shown to include a configuration application 172A and a configuration database 172B, each of which is also communicatively connected to the data highway 110. Various instances of the configuration application 172A can be executed on one or more computing devices (not shown) to enable a user to create or change process control modules and / or other types of modules and download these modules to the controller 111 and / or other devices of the process control system 100 via the data highway 110, and to enable a user to create or change an operator interface via which an operator can view data and change data settings within a process control routine. The configuration database 172B stores the created (e.g., configured) modules and / or operator interfaces. Typically, the configuration application 172A and the configuration database 172B are centralized and have a single logical appearance for the process control system 100, although multiple instances of the configuration application 72a can be executed simultaneously within the process control system 5 and the configuration database 172B can be implemented on multiple physical data storage devices. Thus, the configuration application 172A, configuration database 172B, and user interface thereto (not shown) comprise a configuration or development system 172 for control and / or display modules. Typically, but not necessarily, the user interface of the configuration system 172 is different from the operator workstation 171, in that configuration and development engineers utilize the user interface of the configuration system 172 regardless of whether the plant 100 is operating in real time, whereas operators utilize the operator workstation 171 during real-time operation of the process plant 100 (also interchangeably referred to herein as "runtime" operation of the process plant 100).

[0042] The example process control system 100 includes a data historian application 173A and a data historian database 173B, each of which is also communicatively coupled to the data highway 110. The data historian application 173A operates to collect some or all of the data provided via the data highway 110 and historize or store the data in the historian database 173B for long-term storage. Similar to the configuration application 172A and the configuration database 172B, the data historian application 173A and the historian database 173B are centralized and have a single logical appearance to the process control system 100, although multiple instances of the data historian application 173A may be executed simultaneously within the process control system 100 and the data historian 173B may be implemented on multiple physical data storage devices.

[0043] In some configurations, the process control system 100 includes one or more other wireless access points 174 that communicate with other devices using other wireless protocols, such as Wi-Fi or other IEEE 802.11 compliant wireless local area network protocols, mobile communication protocols (such as WiMAX (Worldwide Interoperability for Microwave Access), LTE (Long Term Evolution) or other ITU-R (International Telecommunication Union Radiocommunication Sector) compliant protocols), short wavelength radio communications (such as near field communication (NFC) and Bluetooth), or other wireless communication protocols. Typically, such wireless access points 174 allow handheld or other portable computing devices (e.g., user interface devices 175) to communicate through a corresponding wireless process control communication network that is different from the wireless network 170 and supports a different wireless protocol than the wireless network 170. For example, the wireless or portable user interface device 175 can be a mobile workstation or diagnostic test device (e.g., an instance of one of the operator workstations 171) used by an operator in the process plant 100. In some cases, in addition to the portable computing device, one or more process control devices (eg, the controller 111 , the field devices 115 - 122 , or the wireless devices 135 , 140 - 158 ) also communicate using a wireless protocol supported by the access point 174 .

[0044] In some configurations, the process control system 100 includes one or more gateways 176, 178 to systems external to the current process control system 100. Typically, such systems are consumers or providers of information generated or operated by the process control system 100. For example, the process control plant 100 may include a gateway node 176 to communicatively connect the current process plant 100 with another process plant. Additionally or alternatively, the process control plant 100 may include a gateway node 178 to communicatively connect the current process plant 100 with an external public or private system, such as a laboratory system (e.g., a laboratory information management system or LIMS), an operator rounds database, a material handling system, a maintenance management system, a product inventory control system, a production scheduling system, a weather data system, a shipping and handling system, a packaging system, the Internet, another provider's process control system, or other external system.

[0045] Note that although Figure 2Only a single controller 111 included in the example process plant 100 is shown with a limited number of field devices 115-122 and 140-146, wireless gateway 35, wireless adapter 152, access point 155, router 1158, and wireless process control communication network 170, but this is merely an exemplary and non-limiting embodiment. Any number of controllers 111 may be included in the process control plant or system 100, and any controller 111 may communicate with any number of wired or wireless devices and networks 115-122, 140-146, 135, 152, 155, 158, and 170 to control the process in the plant 100.

[0046] like Figure 2 As shown, reference is made for purposes of clarity and not limitation. Figure 1 , the process plant 100 is communicatively connected to an edge gateway system 102, which may be Figure 1 Embodiments of the edge gateway system 1. For example, the process plant 100 can be communicatively connected to the field-oriented components 10 of the edge gateway system 1 via one or more process plant communication networks, data networks and / or links, directly and / or via corresponding gateways of the process plant 100. For example, the field-oriented components 10 of the edge gateway system 1 can be communicatively connected to the process plant 100 via networks 110, 170, via gateways 135, 176, 178 and / or via other networks, links and / or gateways associated with the process plant, and the field-oriented components 10 receive or obtain data generated by various data sources 30 associated with the process plant 100 via the above networks, links and / or gateways.

[0047] In general, the data source 30 and the network / link 28 through which the edge gateway system 1 obtains process plant related data can be at a lower level of the Purdue model or a similar security level (e.g., level 0 to level 2), and can include controllers, field devices, I / O cards, and other types of process control devices. In addition, it should be understood that the set of data sources 30 associated with the process plant is not limited to process control devices that directly generate first-order process data, but can also or alternatively include any device or component within and / or associated with the process plant 100 that generates process data and / or other types of data as a result of the process plant 100 controlling online processes. For example, the set of data sources 30 may include modules, alarms, event historians, batch systems and / or historians, diagnostic devices or components that generate diagnostic data, network routing devices or components that transmit information between various components and / or devices of the process plant 100, asset management systems, configuration systems, analysis systems, mobile devices, software-defined networks, virtual networks such as virtual private networks, VLANs and / or VXLANs, etc. In fact, Figure 2Any one or more of the components shown (e.g., components 111, 115-122, 126, 128, 135, 140-146, 152, 155, 158, 160, 170, 171-176, 178) and Figure 2 Other components not shown may be a data source 30 that generates process plant related data that may be provided via the edge gateway system 1 , 102 for consumption by one or more external systems 8 .

[0048] Field-oriented components

[0049] Figure 3 is a block diagram of a field-oriented component 300 that may be included in an edge gateway system (e.g., edge gateway system 1 or edge gateway system 102). For example, the field-oriented component 300 may be Figure 1 The field-facing component 10 shown in FIG. 1 and / or may be used with Figure 2 For the purpose of illustration and not for the purpose of limitation, reference is made to Figure 1 and 2 To describe Figure 3 However, it should be understood that the field-oriented component 300 can be included in an edge gateway system other than the edge gateway system 1 or 102, and can be communicatively connected to a process plant other than the process plant 5 or the process plant 100.

[0050] like Figure 3 As shown, the field data receiver 302 of the field-oriented component 300 can be connected in communication with a process plant such as the process plant 5 or 102, and optionally connected in communication with other systems, devices and / or applications that support the process plant and / or are associated with the process plant in its runtime operation, such as a process control system, a safety instrumented system, a configuration system, an analysis system, a communication / network system, an asset management system, a diagnostic and / or test tool and / or system, a debugging tool and / or system, a user device and / or an operator interface, a historical library system, a batch system, a software-defined network, a virtual network such as a virtual private network, a VLAN and / or a VXLAN, and other systems, networks, applications and / or devices associated with the process plant. In general, the process plant and its supporting systems to which the field-oriented component 300 is connected in communication operate at security levels 0-2 of the Purdue model (or a similar security hierarchy). For ease of discussion herein and not for limitation, the term "process plant 5" is used to collectively refer to the physical process plant with which the field-facing components 300 communicate, as well as other systems associated with and communicatively connected to the physical process plant that generate and / or transmit data at a lower security level.

[0051] The field data receiver 302 is communicatively connected to the process plant 5 via one or more links, communication networks, and / or data networks 305 of the process plant 5 (collectively referred to herein as the "process plant network 305"). The process plant network 305 may include any number of wired and / or wireless links and / or networks supporting one or more communication protocols, data protocols, and / or industrial automation protocols, such as Ethernet, IP or other types of packet protocols, Wi-Fi or other wireless local area network protocols compliant with IEEE 802.11, mobile communication protocols (such as WiMAX, LTE or other ITU-R compliant protocols), other standardized communications and / or data protocols (such as those managed by the Internet Engineering Task Force (IETF), the Institute of Electrical and Electronics Engineers (IEEE), or the International Organization for Standardization (ISO)), HART-IP, Profibus, Fieldbus, field device integration technology (FDI), OPC (object linking and embedding for process control) UA (unified architecture), other types of industrial automation protocols, etc. For example, the process plant network 305 may include the process plant network 28, the wireless network 170, the trunk 110, and any other wired and / or wireless networks and / or links used in the process plant 5 and its related systems, such as asset management networks, historical library networks, data analysis networks, software-defined networks, virtual networks such as virtual private networks, VLANs and / or VXLANs, diagnostic and / or test networks, configuration networks, and / or other types of networks corresponding to the operation, maintenance and / or configuration of the process plant 5.

[0052] The field data receiver 302 obtains one or more field configurations of the process plant 5 from the process plant 5 via the process plant network 305. For example, when the process plant 5 includes a DeltaV process control system provided by Emerson Automation Solutions, the field data receiver 302 obtains one or more FHX files in which the configuration of the process control system and its components (e.g., physical, logical, and data components) are defined, for example, via the configuration application 172A. The interest manager 308 defines, creates, generates, and updates a displayable data type set or system 310 based on the obtained field configuration of the process plant 5. As described in more detail elsewhere within the present disclosure, the field-oriented component 300 transmits the system or set 310 of displayable data types to its corresponding edge-oriented component (e.g., the edge-oriented component 12). In an example embodiment, the displayable data type system or set 310 is Figure 1 Displayable data type system 24A.

[0053] In general, to define, create, generate, and update the presentable data type system 310, the interest manager 308 extracts information from the obtained field data configuration, wherein the extracted information is allowed to be presented (e.g., presentable) to the external data consuming system 8. Whether to allow specific information included in the obtained field configuration to be presented to the external system 8 can be pre-defined, for example, by the edge gateway system, the field-oriented component 300, and / or by the user via one or more interest lists 315, and / or can be indicated online during the extraction process, for example, by the edge gateway system, the field-oriented component 300, and / or the user. In any case, the interest manager 308 defines, names, maps, converts, groups, assigns values, and / or otherwise arranges the extracted information into corresponding data types and configurations of the presentable data type system 310, for example, by using a generally understood syntax, such as a standard syntax or an open source syntax. Thus, the displayable data type system 310 provides a common understanding of the types of displayable process plant-related data included in the field content data (e.g., which may include process plant-related data types, parameter types, block types, module types, event types, historical data types, equipment and equipment component types, displays and display component types, and other types of process plant-related data generated by the process plant) by using a syntax that is inherently understood by the external data consuming system 8.

[0054] For example, the displayable data type system 310 may include basic data types such as floating point, stateful floating point, signed integer, unsigned integer, and other basic data types that are inherently understood by the external data consuming system 8. In addition, the displayable data type system 310 may include more complex data configuration type definitions that are defined and structured at least in part based on basic data types, examples of which are shown in FIG. Figures 4A-4C Some data types of the data type system 310 may include multiple fields, such as Figure 4A , which is shown by an example schema type 312a that has been defined to include four fields of type ENUM. In practice, the data type system 310 may include types based on multiple enumerations, which may be user-defined or system-defined. For example, Figure 4C As shown, a portion 312 b of the example enumeration set included in the presentable data type system 310 is named and defined to indicate discrete HART states used in the process plant 5 . Figure 4B A portion 312c of an even more complex example is shown, in which a cause-effect matrix (CEM) function block of the process plant 5 is defined within the displayable data type system 310 by using block types. Of course, the displayable data type system 310 may include other Figures 4A-4C More data type definitions and / or configurations may be presented beyond the examples shown.

[0055] Typically, the system or collection 310 of displayable data types generated or defined by the interest manager 308 need not conform to defined data types, configurations, hierarchies, and architectures within the process plant 5 (although, if desired, some displayable data types 310 may be defined to conform at least partially to defined process plant data architectures and configurations). Additionally, it will be appreciated that the generation or definition of the system or collection 310 of displayable data types is typically not a one-to-one conversion or mapping of defined process plant data types to corresponding displayable data types. Rather, only process plant data types that are permitted to be displayed to external data consuming systems 8 are included in the collection / system 310, and such displayable process plant data types are reconfigured, rearranged, regrouped, merged, distributed, abstracted, defined, and / or otherwise expressed in an integrated data type system 310 that is more useful and / or more easily utilized by external systems 8 not only syntactically but also in the structure and arrangement of content.

[0056] In particular, as described above, in some embodiments, the interest manager 308 extracts the presentable data type system 310 from the obtained field configuration of the process plant 5 based at least in part on one or more interest lists 315. The interest lists 315 indicate which types of process plant-related data can be presented to the external data consumption system 8 by the field-oriented component 300, and the interest lists 315 can be defined by a user, the field-oriented component 300, the edge gateway system 1, and / or by some other computing system, such as via an interest list configuration application provided by the field-oriented component 300. For example, the field-oriented component 300 can provide a web-based user interface, via which a user can manually define one or more interest lists 315, such as by using JSON (JavaScript Object Notation) or other types of scripts or notations. Additionally or alternatively, the field-oriented component 300, the edge gateway system 1, and / or some other computing system may automatically determine or define one or more interest lists 315, such as by using templates and best practices, by including commonly written and / or read data points (e.g., via mining and / or analysis of operator interface data, process history data, event history data, etc.), and / or by using some other suitable automation technology. In an embodiment, the interest list set 315 at the field-oriented component 300 defines only data from the total data obtained by the field-oriented component from the process plant that is allowed to be presented by the field-oriented component to one or more external systems for consumption. If desired, different field-oriented components 300 of the process plant 5 may store different interest list sets 315, thereby indicating specific types of process plant-related data that the hosted field-oriented components are respectively allowed to present to the data consumption system 8.

[0057] The interest lists may indicate, for example, the names and corresponding groupings or arrangements of related modules, nodes, diagnostics, alarms, events, and / or other field data information that may be configured across multiple, sometimes disparate, configurations within the process plant 5. In practice, the interest lists 315 are not required to conform to a configuration hierarchy and / or configuration content defined in the process plant 5 (although, if desired, some interest lists 315 may be defined to conform at least in part to a defined process plant configuration hierarchy and / or configuration content). In general, the interest lists 315 may be defined in any manner (e.g., organizationally, hierarchically, and / or content-wise) that is useful and / or readily utilized by external systems 8 that are consumers of the presented process plant-related data. For example, at least some of the interest lists 315 may be named to reflect specific plant equipment and / or devices (e.g., "diesel hydrotreater 1," "alkylation unit 3," etc.), and may be defined using parameters from several different modules, nodes, diagnostics, alarms, etc., obtained from multiple different configurations defined in the process plant 5 and associated with the specific plant equipment / devices. For example, the field data content ingestor 320 can utilize the specific interest list 315 to extract specific field content data (e.g., control data, I / O data, diagnostic data, equipment data, etc.), which are collectively identified by the specific interest list 315 as representing specific named entities (e.g., "diesel hydrotreater 1", "alkylation unit 3", etc.), and the extracted data corresponding to the specific named entity can be stored in the cache 322, for example, as is and / or in a reorganized manner (such as by using the presentable data type system 310A), so that the extracted data corresponding to the specific named entity of the specific interest list 315 is presented to the external system 8 via the edge-facing component 12.

[0058] For example, a "Spray Tower 2" interest list may be defined to refer to a specific spray tower in a process plant 5, and may include all parameters associated with "Spray Tower 2" that are included in a field configuration of an asset management system, process control system, safety instrumented system, diagnostic tool, historian, software defined network, virtual network such as a virtual private network, VLAN and / or VXLAN, etc. For example, a "Spray Tower 2" interest list may include parameters indicating the area in which the spray tower 2 is located; parameters indicating pipes, pumps and other vessels, pipelines and other physical component equipment included in the spray tower 2 (e.g., which may be referenced within the field configuration by device tags and other types of physical component tags or identifiers); parameters indicating logical process elements, such as control loops and modules, control parameters and / or variables (e.g., set points, measurements, control signals, other signals, etc.), alarms, events, operating states or conditions, equipment or device states or conditions, timestamps, and other logical and / or data components included in and / or utilized by the spray tower 2 (e.g., which may be referenced within the field configuration by control tags, equipment signal tags, or other types of logical component tags or identifiers), etc. Furthermore, the "Spray Tower 2" interest list may indicate other characteristics and / or aspects of the parameter, such as corresponding units of measurement, corresponding ranges, corresponding target values ​​or set points, corresponding control routines or other applications utilizing the parameter; corresponding uses, corresponding diagnostic parameters and / or other corresponding characteristics and / or associated information.

[0059] In some embodiments, based on generating the interest list 315, the interest manager 308 can determine one or more changes to one or more field configurations stored in the process plant 5, and can transmit the determined changes to the configuration application 172A or other process plant-related configuration applications via the process plant network 305, as shown by reference numeral 318.

[0060] Returning now to the field data receiver 302, in addition to the field configuration, the field data receiver 302 also obtains field content data from the process plant 5 via the process plant network 305, the field content data including data generated by the process plant 5 when operating to control the industrial process, and other data related to the operation of the process plant 5 to control the industrial process. In general, the field content data may include any type of data generated by the process plant 5, such as data generated by a process control system, a configuration system, an analysis system, a communication / network system, an asset management system, a diagnostic and / or test tool and / or system, a debugging tool and / or system, a user device and / or an operator interface, a historian system, a batch system, a software defined network, a virtual network such as a virtual private network, a VLAN and / or a VXLAN, and other systems, networks, applications and / or devices associated with the process plant. For example, the field content data may include runtime process data, continuous process data, batch process data, batch history data, event data, alarm data, analysis data, diagnostic data, environmental data, user interface data, performance data and / or other types of payload data generated by the data source 30. The field data receiver 302 may receive field content data via the process plant network 305 in any protocol used by the process plant network 305, such as Ethernet, WirelessHART, HART-IP, and / or other packet protocols, streaming protocols, and the like.

[0061] The live content data ingestor 320 ingests the obtained live data content based on the interest list 315, may perform processing on at least a portion of the ingested live data content, and store the ingested live data content in a cache or other type of memory 322 of the live-facing component 300 for final transmission to its corresponding edge-facing component (e.g., the edge-facing component 12). The live content data ingestor 320, together with the live data receiver 302, may obtain live content data for ingestion in one or more different ways. For example, for live content data published by the corresponding source 30 and included on the interest list 315, the live content data ingestor 320 may enable the live data receiver 302, for example, on behalf of the live-facing component 300, to subscribe to the publication of such live content data. In another example, for some live content data included on the interest list 315, the live content data ingestor 320 may, for example, initiate a query of the live content data by the corresponding data source 30 for the live content data according to at least some of the configured or defined interest lists 312, for example, via polling and / or via a request / response mechanism. In yet another example, for some live content data included on the interest list 315, the live content data ingestor 320 may discard or filter out any live content data obtained at the live-facing component 300 via the live data receiver 302 and not indicated on the interest list 302. In yet another embodiment, some interest lists 315 may define or indicate which types of live content data are to be excluded from being presented to the external source 8, rather than defining or indicating the live content data to be presented to the external source 8. If and when such non-presentable live content data is received at the live-facing component 300, the live content data ingestor 320 may discard or filter out such live content data, so that the excluded live content data is not stored in the cache 322 and is prevented from being transmitted to the end-facing component.

[0062] In some embodiments, the interest list 315 may indicate interesting presentable field content data that is not generated by the process plant-related data source 30, but is derived or generated from the field content data generated by the process plant-related data source 30. Such second-order field content data may be determined or generated by one or more computation engines 325 invoked by the field content data ingestor 320. In general, the computation engine 325 operates on the first-order field content data obtained via the process plant network 308 to generate one or more outputs, wherein the output of the computation engine 325 is defined as presentable field content data on one or more interest lists 315. The output of the computation engine 325 may be stored in the cache 322 with other first-order field content data for ultimate transmission to edge-oriented components. The computation engine 325 may perform computational functions, such as input stream data aggregation and / or processing (e.g., average, maximum, minimum, etc.). The computation engine 325 may perform more complex computations or algorithms, such as principal component analysis (PCA), partial least squares (PLS) prediction, and / or other types of statistical computations or analysis. The computation engines 325 may perform process control specific computations, such as function blocks, shadow blocks, and / or control module operations. At least some of the computation engines 325 may be defined and / or configured by scripts and / or via a web-based user interface or other type of computation engine configuration application provided by the field-oriented component 300, and at least some of the computation engines 325 may be defined and / or configured using containers (such as Docker containers and / or other suitable types of containers) accessible by and / or installed at the field-oriented component 300.

[0063] In addition to the calculation engine 325, the field content data ingestor 320 may call a data classifier 328 to transform at least a portion of the obtained presentable field content data into a corresponding presentable data type according to the presentable data type system 310. That is, the data classifier 328 represents the presentable field content data using the name, structure, grouping, value, arrangement, etc. defined by the presentable data type system 310. The field content data ingestor 320 stores the classified field content data in a data cache 322 as presentable field content data related to the process plant 5 so as to be transmitted to the edge-oriented components.

[0064] The presentation data provider 330 of the field-oriented component 300 provides the presentable data configuration and the presentation data content to the edge-oriented component corresponding to the field-oriented component 300, for example, via the data diode 15 or via some other suitable data transmission mechanism. For example, the presentation data provider 330 can, for example, send the presentable data configuration of the presentable data type system 310 to the edge-oriented component on behalf of the field-oriented component 300, so that the edge-oriented component can interpret the presentation data content sent by the field-oriented component 300. Subsequently, the presentation data provider 330 can retrieve the stored presentation field data content stored in the cache 322 and send the retrieved data to the edge-oriented component. The presentation data provider 330 can send the presentable data configuration and the presentation data content using a streaming protocol and / or a public or commonly used data exchange format (such as JSON or some other standardized and / or open source data exchange format). For example, the field-oriented component 300 can provide a streaming service, and the presentation data provider 330 uses the streaming service to stream data to its corresponding edge-oriented component, for example, via a corresponding unidirectional data diode 15. In an embodiment, the show data provider 330 packages the show data configuration and the show data content with a streaming protocol implemented using a public or commonly used data exchange format. In some embodiments, the show data provider 330 sends the show data configuration and the show data content to the edge-facing component using a dedicated or proprietary protocol, which may be a dedicated or proprietary streaming protocol. In some embodiments, the show data provider 330 encrypts the show data configuration and the show data content before transmitting them to the edge-facing component.

[0065] In an embodiment, the presentation data provider 330 publishes the presentable data configuration and the presentation data content, for example, through the data diode 15. The edge-oriented component subscribes to the information published by the presentation data provider 330 of the field-oriented component 300, thereby obtaining the presentable data configuration and the presentation data content, and the presentable data configuration and the presentation data content can be made available to the external data consumption system 8 at the edge-oriented component, as described in more detail in other parts of the present disclosure.

[0066] Note that Figure 3 In the embodiment, although the field data receiver 302, the interest manager 308, the field content data ingestor 320, the data classifier 328 and the presentation data provider 330 are shown as different components of the field-oriented component 300, this is only for the sake of discussion clarity and not for the purpose of limitation. In fact, if desired, any two or more of the components 302, 308, 320, 328 and 330 can be implemented as an integrated component of the field-oriented component 300.

[0067] Edge-facing components

[0068] Figure 5A-5B A block diagram of an edge-oriented component 400 that may be included in an edge gateway system, such as an Figure 1 Edge Gateway System 1 or Figure 2 The edge gateway system 102. For example, the edge-facing component 400 may be Figure 1 The edge-facing component 12 shown in FIG. 1 and / or may be communicatively connected to the field-facing component 10 or 300, for example, via a data diode 15 or another connection link, network or medium. For ease of illustration and not for limitation, reference is made to Figure 1-3 To describe Figure 5A and 5B , but it should be understood that the edge-facing component 400 can be included in an edge gateway system other than the edge gateway system 1 or 102, and can be in communication connection with a field-facing component other than the field-facing component 10 or 300.

[0069] like Figure 5A As shown, the display data receiver 402 of the edge-oriented component 400 can be connected to the field-oriented component, which in turn is connected to the process plant such as the process plant 5 or 102, and optionally connected to other systems, devices and / or applications that support the process plant and / or are associated with the process plant in its runtime operation, such as process control systems, safety instrumented systems, configuration systems, analysis systems, communication / network systems, asset management systems, diagnostic and / or test tools and / or systems, debugging tools and / or systems, user equipment and / or operator interfaces, historical library systems, batch systems, software-defined networks, virtual networks such as virtual private networks, VLANs and / or VXLANs, and other systems, networks, applications and / or devices associated with the process plant. In general, the process plant and its supporting systems to which the field-oriented component corresponding to the edge-oriented component 400 is connected to operate at security levels 0-2 of the Purdue model (or similar security hierarchical structure).

[0070] The display data receiver 402 of the edge-facing component 400 is communicatively connected to the edge-facing component 400 and the corresponding field-facing component via one or more links, communication networks and / or data networks. In a preferred embodiment, the display data receiver 402 is connected to the edge-facing component 400 via a data diode, such as Figure 1, the unidirectional data diode 15 shown in the figure, communicatively connects the edge-facing component 400 to the corresponding field-facing component. For ease of discussion, and not for limitation, the edge-facing component 400 is described below as being communicatively connected to the field-facing component via the data diode 15, but it should be understood that other communication connections besides the data diode 15 can interconnect the edge-facing component 400 and the field-facing component. For example, in some embodiments, the edge-facing component 400 and the field-facing component can be included in an integrated system or device.

[0071] The display data receiver 402 can receive display data configuration and display data content from the on-site component. Display data configuration and display data content can be received via a streaming protocol and / or via a public or commonly used data exchange format (such as JSON or some other standardized and / or open source data exchange format). In some embodiments, display data configuration and display data content can be packaged in a streaming protocol at the on-site component end, and the display data receiver 402 unpacks or extracts display data configuration and display data content from the data stream. In some embodiments, display data configuration and display data content can be encrypted at the on-site component end, and the display data receiver 402 decrypts the information received via the data stream. In some embodiments, the on-site component, for example, publishes display data configuration and display data content through a data diode 15. The edge-oriented component 400 subscribes to the information published by the on-site component, thereby obtaining display data configuration and display data content from the on-site component.

[0072] The presentable data configurations received at the presentation data receiver 402 collectively define a presentable data type system (e.g., presentable data type system 24A or 310) that has been generated by the field-oriented component based on the process plant-related configuration (e.g., in the manner described above). The presentation data receiver 402 stores the received presentable data configuration locally in one or more memories as a local copy 24B of at least a portion of the presentable data type system 24A of the field-oriented component.

[0073] The presentation data content received at the presentation data receiver 402 is represented using corresponding data types included in the presentable data type system 24B. The received presentation data content may include field content data generated by the process plant 5, such as data generated by a process control system, a configuration system, an analysis system, a communication / network system, an asset management system, a diagnostic and / or test tool and / or system, a debugging tool and / or system, a user device and / or an operator interface, a historian system, a batch system, a software defined network, a virtual network such as a virtual private network, a VLAN, a VXLAN, etc., and other systems, networks, applications, and / or devices associated with the process plant. For example, the field content data may include runtime process data, continuous process data, batch process data, batch history data, event data, alarm data, analysis data, diagnostic data, environmental data, user interface data, performance data, and / or other types of payload data generated by the data source 30. In addition, the received presentation data content may include data that has been derived or generated from the field content data by a field-oriented component corresponding to the edge-oriented component 400, such as derived or generated by one or more computing engines 325 of the field-oriented component. The presentation data receiver 402 provides the received presentation data content to the presentation data ingestor 405 of the edge-facing component 400 for interpretation, possible additional processing, and storage so that the presentation data content (and possible additional content) can be used by data consuming applications and / or systems. Figure 5B 422.

[0074] Specifically, the display data ingestor 405 utilizes a local copy of the display data type system 24B to interpret the display data content received from the field-oriented component. In this way, the display data ingestor 405 and the edge-oriented component 400 do not need (and do not actually) know any internal or local data definitions and / or configurations of the process plant 5. That is, the edge-oriented component 400 interprets the received display data content based on the received display data configuration stored in the display data type system 24A corresponding to the field-oriented component, and the edge-oriented component 400 does not need to send any communication to the field-oriented component to obtain and / or coordinate the data configuration. This technology protects the process plant 5 from possible security breaches because it is not necessary to send any management and / or control messages from the edge-oriented component to the field-oriented component that is communicatively connected to the process plant 5, thereby eliminating possible entry points for malicious actors. In addition, if necessary, the technology allows configuration changes in the process plant 5 to be transmitted to the edge-oriented component 400 online, in real time, and incrementally. Further, the technique allows a single edge-facing component 400 to service multiple different field-facing components utilizing different presentable data type systems.

[0075] In some embodiments, the display data ingestor 405 of the edge-oriented component 400 can derive and / or generate additional data from the received display data content. For example, the display data receiver 402 can call one or more computing engines 408 to operate on at least some of the received display data content to generate additional data content that can be used for data consuming applications and / or systems 422. The computing engine 408 can be stored at the edge-oriented component 400 and can perform computing functions on the payload values ​​of the data, such as instruction stream data aggregation and / or processing (e.g., average, maximum, minimum, etc.). Some computing engines 408 can be configured to perform more complex calculations or algorithms, such as principal component analysis (PCA), partial least squares (PLS) prediction and / or other types of statistical calculations or analysis, calculation of key performance indicators (KPIs), etc., and some computing engines 408 can be configured to drive events. At least some of the compute engines 408 may be defined and / or configured by scripts and / or via a web-based user interface or other type of compute engine configuration application provided by the edge-facing component 400, and / or at least some of the compute engines 408 may be defined and / or configured through the use of containers accessible by and / or installed at the edge-facing component 400. Indeed, some of the compute engines 408 may be made available for use by data-consuming applications and / or systems 422, such as in a manner such as described elsewhere within this disclosure.

[0076] The presentation data ingestor 405 stores the received presentation data content and any output generated by the computation engine 408 in a data lake 410, which may be, for example, Figure 1 The data lake 40 is a data lake 40 of the process plant 5. Because the data lake 40 stores field content data received from the field-oriented components, the data lake 40 reflects at least a portion of the total data related to the process plant 5 (e.g., runtime data, configuration data, event data, historical data, and other types of data generated by and related to the process plant 5), wherein the process plant-related data stored in the data lake 40 can be exposed to (e.g., made available for use by) external data consuming systems 8. In some process plants, all data generated by the process plant 5 is reflected at the edge-oriented components 400 and exposed to the external systems 8, while in other process plants, only a subset of all data generated by the process plant 5 is reflected at the edge-oriented components 400 and exposed to the data consuming applications and / or systems 8, wherein the subset is defined by a common set of interest lists 22, 315 residing on a set of field-oriented components of the process plant 5.

[0077] As previously described, in some embodiments, in addition to the reflected process plant related data, the data lake 40 also stores related computational data generated by the computation engine 408 at the edge-facing component 400 based on the presentation content data received from the process plant 5. In addition, in some embodiments, the data lake 410 also stores data from other external data providing systems (e.g., systems outside the process plant 5 that generate data that can be interpreted and / or analyzed in conjunction with the process plant related data) via one or more external data ingestors 412. Figure 5A The external data ingestor 412 may be configured to receive content data received from an external data providing system (not shown in the figure), which is generally at a higher security level than the process plant 5. Such external data providing systems may include, for example, enterprise-level systems such as email systems, intranet systems, site business planning and logistics systems, scheduling systems, supply chain management systems, financial systems, accounting systems, inventory management systems, other company systems, other IT systems, etc., and / or may include systems provided by third parties, such as weather forecast systems, stock market feeds, OPC servers provided by third parties, etc. The external data ingestor 412 may convert, modify, translate and / or otherwise transform the external data received from the external data providing system into consistency with the displayable data type system 24B. In addition, in some embodiments, the external data ingestor 412 may call one or more computing engines 408 to operate on the obtained external data to generate additional data stored in the data lake 410. In some embodiments, the external data ingestor 412 can communicate with the enterprise and / or third-party systems to obtain and / or coordinate corresponding data configurations, and in some embodiments, the external data ingestor 412 can update the displayable data type system 24B to include data types corresponding to the data types utilized by the enterprise and / or third-party systems. However, even though the edge-facing component 400 can engage in bidirectional communication with the external data providing system, the process plant 5 is still protected from possible security breaches entering via external systems because the edge-facing component 400 still does not send (and, in fact, can be physically blocked from sending) any communications to the field-facing components that are communicatively connected to the process plant 5.

[0078] Regardless, the data lake 410 stores content data that has been generated by and received from the process plant 5 via field-facing components, and in some embodiments, content data that has been generated by and received from one or more external data providing systems. In some embodiments, the data lake 410 may store additional data that is calculated and / or derived from received content data (whether process plant related and / or externally generated) by one or more computation engines 408. The data stored in the data lake 410 may be stored in accordance with the displayable data type system 24B so that the data content may be easily consumed by applications and / or systems 422.

[0079] The edge-oriented component 400 includes a contextual knowledge miner 415 that operates on the contents of the data lake 410 to discover relationships and associations between various different data points of the data lake 410. That is, the contextual knowledge miner 415 discovers corresponding contexts of the data points of the data lake 410. For example, the contextual knowledge miner 415 can discover that a certain type of alarm is generated for a similar set of operating states of field devices of various different suppliers of a given age and located in the same area of ​​the process plant, or the contextual knowledge miner 415 can discover that the key performance indicator of a specific line within the plant corresponds to the rate of change of a specific valve relative to the rate of change of another specific valve. In any case, the contextual knowledge miner 415 stores the discovered contexts and relationships along with the contents of the data lake 415 (collectively referred to as "knowledge" herein) in a contextualized plant knowledge base 420, for example, in a connection domain. For example, the contextualized process plant knowledge base 420 can be implemented using a graph database or other appropriate model in which content data and its corresponding interconnections are stored. For example, graph database nodes may correspond to names or labels included in data lake 410, attributes stored at nodes may include corresponding parameters, values, states, etc., and connectors between nodes and other nodes may represent interrelationships discovered by contextual knowledge miner 415. In general, information stored in contextualized process plant knowledge base 420 may be exposed to (e.g., available for consumption by) data consumer applications and / or systems 422.

[0080] Note that Figure 5A In the embodiment, although the display data receiver 402, the display data ingestor 405 and the contextual knowledge miner 415 are shown as different components of the edge-oriented component 400, this is only for the clarity of discussion and not for limitation. In fact, if desired, any two or more of the components 402, 405 and 415 can be implemented as an integrated component of the edge-oriented component 400.

[0081] continue Figure 5B4, and the edge-oriented components 400 provide a set of one or more access mechanisms 425 via which various types of data consuming applications and / or systems 422 can access information stored in the contextual knowledge base 420, either directly or via other applications and access mechanisms. The data consuming applications and / or systems 422 that can utilize the access mechanisms 425 provided by the edge-oriented components 400 can include, for example, external applications and / or systems 8, such as enterprise applications and / or systems 422a associated with an enterprise that owns, operates, and / or is otherwise associated with the process plant 5 and at a higher security level than the process plant 5 (e.g., email, intranet, site business planning and logistics, scheduling, supply chain management, finance, accounting, inventory management, corporate and / or other IT applications and / or systems), and third-party applications and / or systems 422b that consume process plant-related knowledge (e.g., cloud computing applications / systems, external OPC servers, IoT applications / systems, IIoT applications / systems, etc.). In some arrangements, the data consuming applications and / or systems 422 may include plant-related applications and / or systems 422c, which may be at a similar security level as the process plant 5, or may even be systems within the process plant 5, such as a process control system, an analytical system, etc. For example, at least some of the one or more access mechanisms 425 may be used by one or more applications dedicated to the process plant 5, such as a monitoring application, an analytical application, an optimization application, a virtualized device application, a process control application, an alarm management application, a device management application, a scheduling application, a low-cost sensor application, a simulation application, an operator training application, a redundancy or backup application, a recovery application, a safety instrumented system application, a vibration monitoring application, an engineering application, an asset management application, a user interface application, or an application executed on a personal electronic device. Figure 5B As shown, data consumption applications and / or systems 422 can be communicatively connected to edge-oriented components 400 via one or more networks 423, which can be public networks, private networks, wired networks, and / or wireless networks. Additionally or alternatively, at least some of the data consumption applications 422, whether factories, enterprises, or third parties, can be installed at edge-oriented components 400, as described in more detail below.

[0082] like Figure 5BAs shown, the access mechanism 425 provided by the edge-oriented component 400 includes one or more APIs 428, which are used as direct access mechanisms to information stored in the context knowledge base 420. One or more direct access APIs 428 can be implemented according to, for example, a REST (representational state transfer) architecture, GraphQL or other suitable query languages, and / or other standardized, open source, interoperable data syntax, format, and / or architecture for APIs. For example, API 428 can be docked with C, C++ and / or C# applications, Python applications, Node.JS applications, and / or other types of applications (whose languages, protocols, platforms, and frameworks are supported or provided by the edge-oriented component 400), so that the corresponding binding access API 428 can be used. Other more advanced or more removed access mechanisms can utilize one or more direct access APIs 428 to access the knowledge and information stored in the context knowledge base 420.

[0083] Other access mechanisms 425 provided by the edge-oriented component 400 include, for example, utilities 430, servers 432, services 435, and applications 438, to name a few. In general, the access mechanisms 425 collectively support various types of access to process plant-related knowledge stored in the contextual knowledge base 420, such as request / response, publish / subscribe, event-driven access, etc. Each access mechanism 425 can utilize one or more direct access APIs 422 to access information stored in the contextual knowledge base 420. Some access mechanisms 425 can be exposed to external applications and / or servers 422, some access mechanisms can be exposed only to process plants 5 and associated other systems at a lower security level (e.g., OT level), and / or some access mechanisms can be exposed to the edge-oriented component 400 itself. For example, at least one access mechanism 425 can include one or more replication mechanisms, via which the data lake 410 and / or the contextual knowledge base 420 can be replicated, for example, for fault tolerance, backup, and / or redundancy purposes.

[0084] Utilities 430 that may be provided by edge-facing component 400 include, for example, query and / or search engines, natural language processors, and / or other types of contextual utilities. Additionally or alternatively, utilities 430 may include computational utilities, such as calculations, parsing, analysis, scripts, etc. Utilities 430 may be implemented at edge-facing component 400 using, for example, functions, algorithms, applications, etc.

[0085] The servers 432 that may be provided by the edge-oriented component 400 include, for example, OPC UA servers that expose process plant-related knowledge to data consuming applications / systems 422 through the OPC UA data model, such as via corresponding subscriptions; web servers that host one or more websites and / or web applications, via which data consuming applications and / or systems 422 can interface with the edge-oriented component 400 to access process plant-related knowledge stored in the contextual knowledge base 420; and other types of servers. In some embodiments, one or more servers 432 are not exposed to external applications and systems 422, but are provided for use by the process plant 5 and / or lower security level systems associated with the process plant 5. For example, the edge-oriented component 400 may provide an I / O server that sends data between various components of the process plant 5.

[0086] Services 435 that may be provided by edge-oriented component 400 include, for example, AMQP (Advanced Message Queuing Protocol) queuing services (e.g., publishing knowledge in JSON format); MQTT (Message Queuing Telemetry Transport) publish and subscribe services; and / or other similar purpose services, systems, and / or protocols that support the transmission of process plant-related information to cloud computing applications and / or systems, IoT and / or IIoT applications and / or systems, event hubs, and / or other data consuming applications and / or systems 422 (e.g., via publish / subscribe mechanisms and / or peer-to-peer mechanisms). For example, service 435 may include an OPC runtime service that may provide a corresponding data source for each external OPC server (which may be a factory, enterprise, or third-party OPC server) that is a consumer of process plant-related knowledge. In addition, services 435 may include other types of services, such as authentication and / or authorization services for authenticating and / or data-consuming applications and / or systems 422 (e.g., by utilizing OAuth2 or some other suitable standard), services for interacting with mobile devices, web services, knowledge or information subscription managers, and / or any other type of service that can be exposed to and / or utilized by at least some data-consuming applications and / or systems 422.

[0087] In addition, the edge-oriented component 400 can provide one or more applications 438 that access information stored in the context knowledge base 420 and operate on the accessed information. For example, some of the utilities 430 can be implemented using the application 438, and some web services can be implemented using the application 438. At least some of the applications 438 can be provided by the enterprise, such as query engines and search engines. Some of the applications 438 can be provided by third parties and can be exposed to and / or utilized by at least some of the data consumption applications and / or systems 422.

[0088] In practice, the edge-facing component 400 may support or provide a number of architectural constructs, platforms, and frameworks that enable the edge-facing component 400 to support or provide utilities 430, servers 432, services 435, and / or applications 438 generated by an enterprise associated with the process plant 5 and generated by third parties. In some configurations, both enterprise-provided and third-party-provided utilities 430, services 432, and / or applications 438 may be installed at the edge-facing component 400. For example, the edge-facing component may support Docker, Linux, or other types of containers, wherein OPC UA servers, AMQP gateways, and various enterprise-provided access mechanisms 425 may be implemented at the edge-facing component 400, and third-party-provided applications may be implemented therethrough at the edge-facing component 400. For example, Docker and / or other types of containers may utilize direct access APIs 428 to access information stored in the contextual knowledge base 420.

[0089] Additionally or alternatively, the edge-facing component 400 can provide a Node.JS framework that supports web applications and services provided by the enterprise and / or third parties and installed at the edge-facing component 400. The Node.JS framework can utilize a direct access API 428 to access information stored in the contextual knowledge base 420 and / or the Node.JS framework can call various utilities 430 (e.g., query, search, language processing, etc.) to access, obtain and / or operate on the information stored in the contextual knowledge base 420.

[0090] Thus, in view of the above discussion, embodiments of the edge gateway system 1 securely connect the process plant 5 and associated networks with applications executed on the plant building as well as remotely executed applications (e.g., those hosted in the cloud and / or remote networks). Applications and / or systems that consume the data generated by the process plant 5 and the relationships discovered and / or knowledge included therein can securely access and obtain the displayed contextual process plant knowledge with minimal or even no risk to the process plant 5 itself. In addition, the edge gateway system 1 can operate continuously in environments with permanent intranet connections (e.g., at security levels 3 and 4) as well as in environments with public Internet connections. Various security mechanisms and features of the edge gateway system 5 (e.g., physical separation of OT and IT networks and physical blocking of data flows entering the process plant 5, secure boot and update, signed firmware and packet execution, encryption, customized displayable data type systems, etc.) protect the process plant 5 and its data and provide protection against data theft and security breaches. Additionally, in an embodiment, the edge gateway system 1 and / or components thereof utilize or incorporate one or more security techniques described in commonly owned U.S. patent application No. 15 / 332,622; commonly owned U.S. patent application No. 15 / 332,690; and commonly owned U.S. patent application No. 15 / 332,751, the disclosures of which are incorporated herein by reference in their entireties, to further protect the process plant 5 and its data and provide further protection against data theft and security breaches.

[0091] When implemented in software, any of the applications, services, and engines described herein may be stored in any physical non-transitory computer-readable memory, such as on a disk, a laser disk, a solid-state memory device, a molecular memory storage device, or other storage medium, in the RAM or ROM of a computer or processor, etc. Although the example systems disclosed herein are disclosed as including software and / or firmware and other components executed on hardware, it should be noted that such systems are merely illustrative and should not be considered restrictive. For example, it is contemplated that any or all of these hardware, software, and firmware components may be implemented exclusively in hardware, exclusively in software, or in any combination of hardware and software. Therefore, although the example systems described herein are described as being implemented in software executed on a processor of one or more computer devices, it will be readily understood by those of ordinary skill in the art that the examples provided are not the only way to implement such a system.

[0092] Therefore, although the present invention has been described with reference to specific examples, these examples are only intended to illustrate rather than limit the present invention, and it will be apparent to those skilled in the art that changes, additions or deletions may be made to the disclosed embodiments without departing from the spirit and scope of the present invention.

Claims

1. A method of securely transmitting knowledge associated with a process plant from a process plant via an edge gateway system for consumption by one or more external systems, the method comprising: receiving, at an edge-facing component of the edge gateway system from a field-facing component of the edge gateway system, content data generated by the process plant while operating to control an industrial process; storing the content data in a data lake in one or more memories of the edge-facing component; mining the data lake by the edge-facing component to discover one or more relationships between different data points included in the content data; storing the content data and indications of the discovered relationships in a contextualized process plant knowledge base by the edge-facing component; And one or more access mechanisms are provided by the edge-facing component to access the contextualized process plant knowledge base, so that information stored in the contextualized process plant knowledge base is available to the one or more external systems via the edge-facing component.

2. The method according to claim 1, wherein: Receiving the content data from the field-facing component includes receiving the content data via a data diode interconnecting the field-facing component and the edge-facing component, wherein the data diode is a unidirectional data diode configured to prevent any flow of both signaling and payload data from the edge-facing component to the field-facing component.

3. A method according to any one of the preceding claims, wherein: Receiving the content data at the edge-facing component from the field-facing component includes receiving, at the edge-facing component, a data stream provided by the field-facing component, the data stream including the content data.

4. The method according to any one of claims 1 to 2, wherein: Receiving the content data at the edge-facing component from the field-facing component includes receiving, at the edge-facing component, publications of the content data published by the field-facing component and subscribed to by the edge-facing component.

5. The method according to any one of claims 1 to 2 further includes receiving, by the edge-oriented component, a set of data types represented in a common data exchange format, the set of data types being determined by the field-oriented component based on one or more configurations of the process plant; storing the content data in the data lake comprises storing the content data in the data lake according to the set of data types; and storing the content data and the indication of the discovered relationship in the contextualized process plant knowledge base comprises storing the content data and the indication of the discovered relationship in the contextualized process plant knowledge base according to the set of data types.

6. The method according to claim 5, wherein: The set of data types includes at least one of: a floating point data type, a floating point data type with status, a signed integer type, an unsigned integer type, a pattern data type, an enumerated data type, or a function block data type.

7. The method according to any one of claims 1 to 2, further comprising: operating, by the edge-facing component, on at least some of the content data using one or more computing engines to generate corresponding outputs; And storing the corresponding output of the computing engine as additional data in the data lake.

8. The method according to claim 7, wherein: The one or more computational engines include at least one of: an analytical, functional, algorithmic, computational, driver, or another type of computational engine.

9. The method according to any one of claims 1 to 2, wherein: Storing the content data and corresponding contexts of the content data in the data lake includes storing the content data and corresponding contexts of the content data in the data lake at a rate of at least 90,000 parameters per second.

10. The method according to any one of claims 1 to 2, wherein: Storing the content data and the indications of the discovered relationships in the contextualized process plant knowledge base includes storing at least a portion of the content data and the indications of the discovered relationships in one or more graph databases.

11. The method according to any one of claims 1 to 2, wherein: Providing the one or more access mechanisms to access the contextualized process plant knowledge base includes providing at least one of: one or more application programming interfaces (APIs); one or more queuing services; one or more data transfer services; one or more query engines; one or more containers; one or more streaming services; one or more runtime services; one or more request / response access mechanisms; one or more publish / subscribe access mechanisms; one or more event-driven access mechanisms; Data lake replication mechanism; or situational process factory knowledge base replication mechanism.

12. The method according to claim 11, wherein: The one or more APIs include at least one of: a RESTful (Representational State Transfer) API, another type of system interoperable API, a GraphQL API, or another type of open source API.

13. The method according to claim 11, wherein: The one or more access mechanisms utilize at least one of: JSON (JavaScript Object Notation); AMQP (Advanced Message Queuing Protocol); MQTT (Message Queuing Telemetry Transport); OPC-UA (OPC Unified Architecture); another type of standardized protocol or format, or another type of open source protocol or format.

14. The method according to any one of claims 1 to 2, further comprising providing one or more platforms supporting the one or more access mechanisms at the edge-facing component, the one or more platforms comprising at least one of the following: a container platform or a Node.JS framework.

15. The method according to any one of claims 1 to 2, wherein: The one or more access mechanisms are accessible via a plurality of binding types.

16. The method according to claim 15, wherein: The multiple binding types include C#, JavaScript, and Python.

17. The method according to any one of claims 1 to 2, wherein: Providing the one or more access mechanisms includes providing the one or more access mechanisms to one or more applications, the one or more applications including at least one of the following: a cloud application, an application executed on the one or more external systems, an application embedded in the process control system of the process plant, a web application, an IoT (Internet of Things) application, an IIoT (Industrial Internet of Things) application, an application configured to perform a search of the contextualized process plant knowledge base, or an application configured to query the contextualized process plant knowledge base.

18. The method according to any one of claims 1 to 2, wherein: Providing the one or more access mechanisms includes providing the one or more access mechanisms to one or more applications specific to the process plant, the one or more plant-specific applications including at least one of: a monitoring application, an analysis application, an optimization application, a virtualized device application, a process control application, an alarm management application, an equipment management application, a scheduling application, a low-cost sensor application, a simulation application, a diagnostic application, an operator training application, a redundancy or backup application, a recovery application, a safety instrumented system application, a vibration monitoring application, an engineering application, an asset management application, a user interface application, or an application executed on a personal electronic device.

19. The method according to any one of claims 1 to 2, wherein: Providing the one or more access mechanisms includes providing the one or more access mechanisms to one or more applications specific to an enterprise of which the process plant is a part, the one or more enterprise applications including at least one of: an email application, an intranet application, a site business planning and logistics application, an inventory management application, a scheduling application, a supply chain application, a financial or accounting application, an IT (information technology) application, or another type of enterprise application.

20. The method according to any one of claims 1 to 2, wherein: Receiving the content data generated by the process plant when operating to control the industrial process includes receiving at least one of: runtime process data, continuous process data, batch process data, batch history data, history record data, event data, alarm data, analytical data, diagnostic data, environmental data, user interface data, configuration data, performance data, or another type of data generated by one or more devices of the process plant.

21. The method according to any one of claims 1 to 2, wherein: The field-facing component is included in a plurality of field-facing components of the process plant, and each of the plurality of field-facing components is communicatively connected to the edge-facing component via a corresponding unidirectional data diode.

22. The method of claim 21, wherein: When the process plant operates to control an industrial process, each field-facing component sends corresponding content data to the edge-facing component via a corresponding unidirectional data diode; the corresponding content data sent by each field-facing component to the edge-facing component is defined by one or more corresponding interest lists specific to each field-facing component to be presentable to the one or more external systems; and the method also includes receiving, at the edge-facing component, the corresponding content data sent by each of the multiple field-facing components, and storing the received corresponding content data sent by each of the multiple field-facing components in the data lake.

23. The method according to any one of claims 1 or 22, wherein: Receiving the content data generated by the process plant includes receiving at least one of: an identification and / or description of a first device, module, or entity included in one or more process plant networks of the process plant and being a source of at least a first portion of the content data; an identification and / or description of a second device, module or entity included in one or more process plant networks and being a recipient of at least a second portion of the content data; an identification and / or description of a third device, module or entity included in one or more process plant networks and being associated with at least a third portion of the content data; an identification and / or description of a corresponding process plant network including the first device, the second device or the third device; an identification and / or description of a process plant unit in which at least a fourth portion of the content data is generated and / or received; an identification and / or description of a device corresponding to at least a fifth portion of the content data; or an identification and / or description of another physical component or area of ​​the process plant associated with at least a sixth portion of the content data.

24. The method according to any one of claims 1 or 22, wherein: Receiving the content data generated by the process plant includes receiving at least one of: a type of at least a first portion of the data included in the content data; a unit of measurement of at least a second portion of the data included in the content data; a range of at least a third portion of the data included in the content data; a target value of at least a fourth portion of the data included in the content data; a control routine utilizing at least a fifth portion of the data included in the content data; a parameter indicating a characteristic of at least a sixth portion of the data included in the content data; a parameter indicating a use of at least a seventh portion of the data included in the content data; or a diagnostic parameter.

25. The method according to any one of claims 1 to 2, wherein: The one or more external systems include at least one of a cloud computing system, a public computing system, or a private computing system.

26. An edge-facing component configured to perform a method according to any preceding claim.

27. An edge gateway system comprising the edge-facing component of claim 26, a field-facing component, and a data diode interconnecting the field-facing component and the edge-facing component.

28. An edge gateway system for securely transmitting knowledge associated with a process plant from a process plant for consumption by one or more external applications and / or systems, the edge gateway system comprising: an edge-facing component communicatively connected to a field-facing component of the edge gateway system, the field-facing component communicatively connected to the process plant, and the edge-facing component includes one or more processors and one or more non-transitory memories, the one or more non-transitory memories storing: a presentable data type system corresponding to the process plant, the presentable data type system generated by the field-facing component; a contextual knowledge base corresponding to the presentable data type system, the contextual knowledge base storing content data provided by the process plant and indications of relationships between the content data; and one or more access mechanisms to the contextual knowledge base, at least one of the one or more access mechanisms being exposed to the one or more external applications and / or systems.

29. The edge gateway system according to claim 28, wherein: The one or more non-transitory memories of the edge-facing component further store: a presentation data receiver via which the edge-facing component receives the presentable data type system and the content data from the field-facing component; a data lake storing the content data received from the field-facing component according to the presentable data type system; and a contextual knowledge miner configured to discover relationships between data stored in the data lake.

30. The edge gateway system according to claim 29, wherein: The data lake also stores data received from one or more systems having a higher security level than the process plant.

31. The edge gateway system according to any one of claims 29 to 30, wherein: The edge-facing component also includes one or more computing engines that operate on the content data received from the field-facing component, and wherein corresponding outputs of the one or more computing engines are stored in the data lake.

32. The edge gateway system according to any one of claims 28 to 30, wherein: The contextual knowledge base is implemented using one or more graph databases.

33. The edge gateway system according to any one of claims 28 to 30, wherein: The one or more access mechanisms include one or more application programming interfaces (APIs) having direct access to the contextual knowledge base, and wherein at least one of the one or more access mechanisms exposed to the one or more external applications and / or systems utilizes one or more direct access APIs to access the contextual knowledge base.

34. The edge gateway system according to claim 33, wherein: The one or more access mechanisms include one or more other applications, services, servers, or utilities that utilize the one or more direct access APIs to access the contextual knowledge base.

35. The edge gateway system according to any one of claims 28 to 30, wherein: The one or more access mechanisms include at least one of a search application or a query application for the contextual knowledge base, and wherein at least one of the one or more access mechanisms exposed to the one or more external systems includes at least one of the search application or the query application.

36. The edge gateway system according to any one of claims 28 to 30, wherein: The one or more access mechanisms to the contextual knowledge base include at least one of an application, a service, a server, or a utility.

37. The edge gateway system according to claim 36, wherein: The edge-facing component also includes one or more platforms supporting at least one of the application, the service, the server, or the utility; and wherein the one or more platforms include at least one of a standardized platform or an open source platform.

38. The edge gateway system according to claim 37, wherein: The one or more platforms include at least one of a container platform or a Node.JS platform.

39. The edge gateway system according to any one of claims 28 to 30, wherein: The one or more access mechanisms include at least one of: an OPC UA server; a web server; an AMQP service; a publish and / or subscribe manager; an MQTT service; one or more OPC runtime services; an authentication and / or authorization service; a service exposed to a mobile device; or an application, service or server exposed to one or more applications and / or systems of the process plant.

40. The edge gateway system according to any one of claims 28 to 30, wherein: The one or more access mechanisms include an access mechanism generated by a third party and installed at the edge-facing component of the edge gateway system.

41. The edge gateway system according to any one of claims 28 to 30, wherein: At least some of the one or more external applications and / or systems are implemented in a cloud computing system, a system communicatively connected to the edge gateway system via a public network, or a system communicatively connected to the edge gateway system via a private network.

42. The edge gateway system according to any one of claims 28 to 30 further comprises one or more additional access mechanisms, wherein the one or more additional access mechanisms are exposed to the applications and / or systems of the process plant and are not exposed to the one or more external applications and / or systems.

43. The edge gateway system of any one of claims 28 to 30, further comprising a unidirectional data diode interconnecting the field-facing component and the edge-facing component.

44. An edge gateway system according to any one of claims 28 to 30, configured to perform a method according to any one of claims 1 to 25.

Images