Process automation system with secure interface

Abstract

The invention relates to a system (100, 200, 300, 500) for process automation of a manufacturing plant, in which the claimed system (300) for monitoring a manufacturing plant comprises:-a plurality of machines (140) of the manufacturing plant,-a plant machine database (128, 548) comprising control parameters of the machines, and comprising spatial information and / or status information of physical objects, the physical objects being the machines and / or objects processed by the machines; -an automation system (103) for automatically operating the machines in accordance with the control parameters in the factory machine database; -an update engine (160) configured to continuously receive spatial information and / or status information of the physical objects from a plurality of sensors (162) during an ongoing manufacturing process and to update the factory machine database using the received information; -a visualization database (130) comprising a subset of the data of the plant machine database; -a replication module (150) configured to continuously select data in the factory machinery database enabling generation of a digital visual representation of the one or more physical objects, whereby the selected data does not contain the control parameters, and configured to only replicate the selected data to the visualization database; a visualization engine (134) (a software program or a set of interoperable software programs) configured to generate a digital visual representation of the one or more physical objects from data in the visualization database; -a display device (154, 108) configured to display a visual representation of the one or more physical objects to a user to enable the user to monitor the manufacturing process.

Description

Technical Field

[0001] This invention relates to industrial automation systems, and more particularly to systems and methods for safely controlling automated manufacturing processes. Background Technology

[0002] To date, remote factory control has been largely prohibited due to the potential risks to proper factory automation. Tasks performed “inside” and “outside” the manufacturing plant are separated through mandatory manual operations.

[0003] For example, automation structures described by the Purdue reference model, particularly those used in legacy automation systems, have been in use for many years and have proven to operate reliably. However, these systems lack openness and flexibility—new technologies (IoT, mobile devices, cloud computing, remote control, VR and AR applications, etc.) are difficult / impossible to integrate and costly.

[0004] Integrating existing hardware-based automation technologies into a globally networked system has proven particularly problematic. Highly trained experts perform extensive setup work on the machines on-site. Incorrect setup (whether intentional or accidental) can lead to the production of substandard products, damage to individual machines, entire production plants, or even employees.

[0005] To prevent improper operation of the factory caused by external systems, users, and / or targeted hacking attacks, security measures in these systems prohibit the execution of remote control commands or make them quite complex. Therefore, these automated systems cannot be fully integrated into larger global IT systems. Summary of the Invention

[0006] The object of this invention is to provide an improved system and a corresponding method for process automation in a manufacturing plant, as specified in the independent claims. Embodiments of the invention are given in the dependent claims. These embodiments can be freely combined with each other without mutual exclusion.

[0007] In one aspect, the present invention relates to a system for process automation in a manufacturing plant. The system includes:

[0008] - Multiple machines in the manufacturing plant;

[0009] - Factory machinery database, which includes the control parameters of these machines;

[0010] - An automated system that automatically operates the machines in a manufacturing plant based on control parameters from a factory machinery database; and

[0011] - Security interface.

[0012] The safety interface is configured to: receive requests; verify requests; and, in response to determining that a request is valid, store control parameters included in or derived from the request in the factory machinery database. The automation system is configured to perform automated operation of the machines based on the stored control parameters included in or derived from valid requests.

[0013] For example, a request could be to start, stop, or modify the operation of one or more machines in a machine. Requests can be received from the client via a network (such as the Internet).

[0014] Embodiments of the present invention can provide existing and new factories with the possibility of effectively linking existing core automation systems with advanced IT systems used for monitoring, optimization and control tasks, thereby enabling client devices or users to send requests to a secure interface via a network to operate one or more machines in the factory after successful request verification.

[0015] According to some embodiments, the security interface is one-way, meaning it allows machine-related data (such as machine-related control parameters) to be transmitted from the client to the automation system via a request, but does not allow machine-related data to be returned to the client that submitted the request. This improves security because the client will not receive any information about the type or status of the machine whose operational status was modified in response to the request. The client will also not receive any information about the number of machines affected by the request, or any reason why the request could not be executed. According to some embodiments, the one-way security interface does not return any request-related feedback to the client other than information about whether the request was successfully executed.

[0016] According to an embodiment, request verification includes checking whether control parameters included in or derived from the request are reasonable. Only when this reasonableness check returns that the request is reasonable is the request considered a valid and verified request.

[0017] For example, a reasonableness check may include examining whether the operation of one or more machines in the machine group, based on control parameters, will be preserved (for the product to be produced, for the machines, and for the workers) and will likely allow the production of a product with the desired characteristics. For example, a reasonableness check may include determining whether the control parameter values ​​specified in or derived from the request are within a predefined range of permissible parameter values ​​and / or predicting (e.g., simulating) whether a process performed by one of the machines according to those control parameters will produce a product with product characteristics (e.g., product size, quantity, purity, shape, color, elasticity, viscosity, etc.) within permissible or preferred parameter value ranges. If the control parameters set the temperature of the can's heating element to a level that would damage the can's material or its internal components, the safety interface may consider the request unreasonable.

[0018] The security interface will only store the control parameters in the factory machinery database and modify the machine's operating method if the check returns a valid request.

[0019] According to an embodiment, the factory machinery database includes control parameters for one or more of these machines, wherein these control parameters are or include control parameters, and the automation system automatically operates the machines by setting the control parameters in the factory machinery database to control parameter values ​​provided with or derived from the request.

[0020] According to an embodiment, the factory machinery database includes models (e.g., structural models, such as simplified or realistic 3D models), location information, and status information of machines and / or products produced by the machines. The location information is continuously updated to reflect the actual location and status of the machines and / or products. The models, location information, and / or status information, or portions thereof, can be used to generate digital twins of the machines and / or objects manufactured or processed by the machines. For example, a digital twin of a corresponding machine can be used to graphically represent the machine and / or to simulate the operation of the machine and / or to control the machine via the machine's digital twin.

[0021] According to another advantage, the secure interface can serve as a secure and controlled access interface, supporting request-based data ingestion from the outside into the automation system without compromising integrity and plant security.

[0022] According to an embodiment, the system is used to control the operation of one or more machines in an automation system based on control parameters generated outside the automation system (e.g., generated by a client device that has already generated a request or input to that client device). These control parameters may be setpoints, i.e., parameters that can be set before and / or during machine operation and define how the machine operates.

[0023] Embodiments of the present invention can offer the following advantages: enabling remote process control of machines in an automated system without compromising safety and achieving faster and more granular process control. Typically, in the process industry, a local plant operator, spatially adjacent to the machine operation, sets control parameter values ​​for one or more machines in an automated system. For example, in a conventional process automation system, he or she may input control parameters via a local machine interface. The input control parameters may have been suggested by a customer or another human or non-human user who is not part of the automation system (and is therefore considered less trustworthy than the local operator). By manually inputting control parameters suggested by a remote advanced process control system, the local operator ensures that the automated system only accepts verified external data. However, the number of control parameters that a human operator can understand and manually input is limited, especially for complex manufacturing processes with multiple interdependencies, where even a skilled local user may not be able to consider the relevant background information.

[0024] Conversely, embodiments of the present invention can allow clients outside the automation system (e.g., clients hosting advanced process control systems or other client software not part of the automation system) to generate and submit requests including control data. Verification of these requests ensures that control parameters will not damage machines, reduce product quality, and / or harm people working near the machines. Furthermore, request verification implemented according to embodiments of the invention allows for far more complex justification checks on control parameters and allows for the processing and evaluation of requests at a high frequency, thereby providing finer-grained control over the automation process.

[0025] According to some examples, the system includes a client that is configured to generate requests and submit them to a secure interface, for example, via a network such as the Internet.

[0026] According to an embodiment, the client that has generated the request is configured to repeatedly generate and submit the request, particularly at a frequency of at least once per hour, preferably at least once per minute, preferably at least once per second, and in some embodiments at least once every 0.10 seconds. Each of these requests includes one or more control parameters for controlling the operation of one or more of these machines.

[0027] According to an embodiment, the request is automatically generated and submitted by the client software, and the control parameters specified in the request are also dynamically calculated by the client software.

[0028] According to an embodiment, the verification of the request is repeatedly performed by a security interface, specifically at a frequency of at least once per hour, preferably at least once per minute, preferably at least once per second, and in some embodiments at least once every 0.10 seconds.

[0029] The client can be configured to repeatedly predict one or more control parameter values ​​that are optimized or suitable for controlling the operation of one or more of these machines so that at least one characteristic of an automated production process performed by one or more of these machines is optimized, and is configured to automatically and repeatedly submit requests to the security interface including the predicted one or more control parameters, wherein, in particular, the prediction of the control parameter values ​​includes simulating the automated production process and the operation of one or more of the machines involved in the automated production process.

[0030] For example, client software can be configured to simulate a production process or a portion thereof and identify control parameters suitable for optimizing the production process or ensuring safety or good product quality. Possible optimization criteria could include reductions in energy or material consumption, reductions in waste, improvements in product quality or purity, the presence of desired characteristics or product properties or process parameter values ​​within a desired range.

[0031] To provide a concrete example, a manufacturing plant PA may include multiple machines and tanks configured to perform a continuous chemical synthesis workflow to continuously produce two products, A and B, whose relative proportions may depend heavily on process parameters such as the temperature of the reaction mixture. Product A may be used as a reactant in a different synthesis workflow to synthesize substance E in a different plant PE. Product B may be used as a reactant in another synthesis workflow to produce substance F in another plant PF. The demand for A or B may depend on the demand for substances E and F. Because these products are synthesized in different plants, and the machines in plants PA, PE, and PF are not part of the same automation system, the automated integration of synthesis workflows across different plants has historically been infeasible. Fine-grained control is also infeasible because human operators must manually set the reaction temperature of the synthesis workflow in plant PA to a temperature value suitable for producing the proportions of products A and B that meet the demands of the final products E and F. This is associated with significant latency and prevents real-time synchronization of industrial manufacturing processes across distributed plants. By using secure interfaces and requesting acknowledgments, it is possible to synchronize the manufacturing process, minimizing latency. Requests can be generated automatically and frequently by clients that include or belong to an advanced process control system that integrates the requirements, needs, and available resources of multiple heterogeneous distributed plants.

[0032] Therefore, the implementation can support fully automated control of one or more plants, as well as the integration of process control from one or more plants into an advanced process control system. Latency can be significantly reduced without compromising safety.

[0033] According to one embodiment, the system is configured to use a secure interface as a single point of entry into the automated system. The secure interface can be configured to receive and verify requests submitted by one or more different clients, such as an advanced process control system, an edge computing system, or a remote operator remotely controlling a manufacturing process using virtual reality glasses and / or mobile devices (e.g., a smartphone).

[0034] According to an embodiment, the system for process automation includes a multi-level system architecture. This multi-level system architecture includes at least:

[0035] - The first level includes one or more machines and optionally additional objects involved in the actual physical process (particularly those involved in sensing and manipulating physical objects during automated production workflows);

[0036] -Level 2- L2 - This Level 2 includes components for supervising, monitoring, and / or controlling the physical processes of Level 1; this process control level includes equipment for controlling the entire process within an automated system; and

[0037] -Level 3- L3 — This third level includes manufacturing operating system components that are configured to manage production workflows by supervising, monitoring, and / or controlling Level 2 components in order to produce the desired product. Level 3 is also known as the operational control level that supports production workflow management, such as a manufacturing operations management system.

[0038] The first submodule of the security interface is part of Level 3 (L3). The second submodule of the security interface is part of Level 2 (L2): it protects Level 2 components from Level 3 and higher components through at least one security device, particularly a firewall.

[0039] For example, the multi-level system architecture for process automation can be implemented based on typical automation pyramid models (such as the Purdue reference model or other similar automation pyramid models).

[0040] According to some examples, a secure interface may include one or more software programs and / or software services that act as an interface between an automation system (hence also referred to as the automation system level in the automation system pyramid—“Level L2”) and components at Level L3 of the automation system pyramid structure. Embodiments of the present invention allow for the implementation of secure interfaces on top of existing automation systems, enabling request-based (and optionally remote) control of the automation system, preferably without requiring adaptation to the existing automation system. Requests are checked and validated, and only control parameters from valid requests are forwarded to and stored in the automation system’s factory machinery database. This protects the automation system and the manufacturing plant from hacking and prevents requests that set critical control parameters to values ​​that could have negative or even harmful consequences for the machines in the factory or the entire manufacturing plant.

[0041] For example, the request could be generated by a remote client, thereby being transmitted via a network (such as the Internet) to the system according to an embodiment of the invention. A secure interface could receive the request via one or more intermediate interfaces or modules (e.g., service interfaces). In some embodiments, the request is generated by a remote user via a metaworld engine, for example, by setting one or more control parameters of the machine to control the operation of one or more machines within the machine.

[0042] According to an embodiment, the security interface is configured to enable at least these control parameters to be securely and unidirectionally transmitted to the automation system via a control communication channel, and is configured not to transmit any machine-related control parameters or status information back to the client that has submitted the request.

[0043] The first and second submodules of the security interface (which may belong to the L3 and L2 layers respectively) may each include functions that are functionally complementary and have similar or identical structures (similar or identical number and type of input and output parameters).

[0044] According to an embodiment, a request received by the security interface may be or include a call to one or more functions.

[0045] According to some examples, the second submodule of the safety interface includes machine-specific functions, each configured to control the operation of one or more machines based on one or more control parameters from a factory machinery database. The number and type of input parameters and the number and type of output control commands of the one or more machine-specific functions at least partially correspond to the control interface of the machine controlled by the corresponding machine-specific function. For example, the structure of the one or more machine-specific functions is at least partially identical to the corresponding function of the machine's control interface.

[0046] The first submodule of the security interface includes one or more generic functions. Each generic function is assigned to a corresponding machine-specific function among these machine-specific functions. Upon receiving a request, the first submodule of the interface triggers execution of at least one of the generic functions, and after the successful execution of the at least one generic function, triggers execution of one or more machine-specific functions assigned to the executed at least one generic function. For example, the structure of the one or more generic functions is at least partially the same as the machine-specific function called by the corresponding generic function.

[0047] As used in this article, a "generic function" is a function that does not include or depend on knowledge of the machine's technical characteristics (such as manufacturer, type, current state, machine orientation, etc.). For example, the generic function "Operate centrifuge (INT revolutions per minute, FLOAT temperature)" could be a generic function that expects the control parameters "revolutions per minute" and "(centrifuge) temperature" as input parameters. While a generic function may not include references to any particular type of centrifuge, calling such a generic function can trigger the execution of rules that check whether the specified revolutions per minute and temperature values ​​are reasonable, regardless of the specific characteristics of a particular centrifuge. For example, if the temperature is higher than the boiling point of the liquid to be centrifuged, that temperature could be considered unreasonable without considering any details of the centrifuge to be used. If the reasonableness check triggered by executing the generic function "Operate centrifuge" returns that the parameters are reasonable, then a machine-specific function with the same structure can be called. Machine-specific functions may include or be configured to read machine-specific characteristics, such as the maximum revolutions per minute (rpm) and maximum (or minimum) temperature supported by the centrifuge to be operated. If the specific centrifuge supports control parameters provided as parameters, the execution of the machine-specific function may involve performing a rationality check. Machine-specific functions may have the same structure as calls to general functions such as "operate centrifuge(INT rpm, FLOAT temperature)".

[0048] According to another example, the request may include control parameters instructing that the reaction mixture of the chemical reaction should be set to 120°C to trigger the formation of the desired substance. Upon receiving the request, a first submodule of the safety interface may trigger the execution of a first general function, which performs a rationality check to determine if the current energy price is below a predefined threshold. If so, the first general function returns that heating the reaction mixture to 120°C is valid and should be permitted. As a result of the successful rationality test performed by the first general function, the first submodule causes a second submodule of the safety interface to trigger the execution of a first machine-specific function assigned to the first general function. The first machine-specific function checks whether the reaction vessel containing the reaction mixture allows the chemical reaction to proceed at that temperature. For example, such a check may include verifying that the vessel's material is robust enough and that the heating element is strong enough to support a temperature of 120°C. If so, the second submodule of the safety interface will cause the vessel's heating element to heat the reaction mixture to 120°C. If the first general function returns that the current energy price is above the predefined threshold, the first submodule may return via a feedback channel that the request cannot be executed and the execution of the first machine-specific function is not triggered.

[0049] According to some examples, the first part of the request verification is executed by at least one general function, and the second part of the request verification is executed by one or more machine-specific functions assigned to the at least one general function being executed.

[0050] This can have the following advantages: it allows for reasonableness checks to be performed on criteria that can be evaluated at the L3 level, as well as on criteria related to more sensitive machines, which may relate to sensitive machine parameters and status information that should not be disclosed for security reasons. Another advantage is that the two-step implementation of request verification reduces CPU and memory consumption, as the machine-specific function is executed only if the associated first function returns a valid request. Therefore, the general and machine-specific functions assigned to each other are functionally complementary, providing functions covering both L3 and L2 aspects of the automated system, particularly reasonableness check functions.

[0051] According to some examples, the system includes a function synchronization module configured to: automatically determine a change in the number or type of input parameters required by one of the machine-specific functions or a change in the number or type of output parameters provided by one of the machine-specific functions, and automatically copy the change to one of the general functions assigned to the changed machine-specific function, such that the input and output parameters of the general function also reflect the change.

[0052] This offers the following advantages: the implementation of request verification is transparent. Machine function calls and / or function calls for L2-level components of a system implementing process automation by machine-specific functions are represented or "visible" to the client or service interface via structurally identical generic functions. Therefore, the structure of the generic functions exposed to the client or service interface (the types and number of input and / or output parameters and / or function names) is identical to that of the machine-specific functions. Implementing request verification by two different submodules using the generic and machine-specific functions described above decouples machine and L2 automation level components from L3 level components and systems outside the plant, thereby ensuring that inbound requests are forwarded only if the request is successfully verified as legitimate (and preferably only if the requesting client can be successfully authenticated at the ID-providing module).

[0053] On another beneficial side, when a machine is replaced by a different version, any modifications to the structure of machine-specific functions that may be necessary for system adaptation are automatically propagated to generic functions. This ensures that function interfaces automatically remain synchronized and avoids errors caused by incompatible function calls.

[0054] Optionally, the safety interface can be configured to receive feedback data from the automation system via a feedback communication channel, which is a communication channel separate from the control channel.

[0055] For example, a security interface may completely lack any option to receive data from an automated system and / or forward that data to a client.

[0056] In some embodiments, a separate communication channel, referred to as a feedback channel, may exist for transmitting feedback information indicating whether the request is executed or rejected.

[0057] For example, feedback information can be transmitted from the machine to a service interface (between the safety interface and the factory machine database) via a database service interface, which then forwards the feedback data to the client that submitted the request. Additionally, the safety module may include an interface for receiving feedback information from the automation system and / or may use a feedback channel to notify the client whether the request was successfully verified and executed.

[0058] Preferably, the feedback channel for transmitting feedback data from the automation system or security interface to the client is technically separate from the unidirectional control channel for forwarding requested control parameters from the client / service interface to the automation system via the security interface.

[0059] This offers the advantage that the communication channel for processing and forwarding requests, provided by the secure interface, remains unaffected even if the feedback channel is compromised by malware or hackers. Therefore, using separate communication channels for feedback data and request-based control parameters (which act as control data) ensures that typically non-critical feedback data can be easily distributed to one or more recipients via the feedback channel. The feedback channel can be a communication link with a lower level of data security and integrity than the communication channel provided by the secure interface for control parameters. This simplifies the propagation of feedback data while still maintaining a highly secure communication channel for configuration data. For example, different encryption techniques can be used for different channels to ensure the integrity of data transmitted via the respective channels.

[0060] According to the embodiments, the verification of the request is repeatedly performed by the security interface. In particular, the verification may be performed at a frequency of at least once per hour, or at least once per minute, preferably at least once per second, and in some embodiments at least once every 0.10 seconds.

[0061] This can be beneficial because it allows the security interface to provide fine-grained control over the manufacturing process, which can be adapted very quickly to changing requirements and / or changing production goals. For example, validation could include testing whether one or more control parameters provided by a request received at 12:00 are still reasonable under some environmental parameters at 12:05, 12:10...13:05, 13:10, etc. For example, a manufacturing plant could control a chemical reaction in which specific chemicals are produced, preferably occurring in a temperature range of 30°C to 60°C, whereby the purity of the product decreases with temperature. Product purity is continuously monitored. A request received at 14:00 could instruct that the chemical reaction should be performed at 45°C instead of 40% to increase the speed of the manufacturing process, while another control parameter in the request could specify that the purity of the product should be at least 80%. The service interface could assess at 14:00, upon receiving the request, whether the desired purity can be achieved in the current reaction at a reaction temperature of 45°C, and if so, the temperature could be increased accordingly. For example, after the rationality check is successfully completed, the new reaction temperature of 45°C can be stored in the plant machinery database and used by the heating elements of the reaction vessel to heat the reaction mixture to the indicated temperature. For various reasons, the purity of the ongoing reaction may have significantly deteriorated by 14:35. This can be measured by sensor devices in the reaction vessel and can be communicated to the safety interface via a feedback channel. When the safety interface repeats the verification of the request (received at 14:00) at 14:35, it can determine that, given the currently measured purity data, the desired and currently set temperature of 45°C may not provide a product with a purity of at least 80%. In this case, the safety interface can autonomously modify the control parameters provided in the request, such as reducing the temperature from 45°C to 40°C and storing the new temperature instead of the old temperature in the plant machinery database. Alternatively, the safety interface can issue a message and return it to the entity that submitted the request. This message may include notification that the requested temperature value is no longer valid and has been replaced by a different temperature value better suited to achieving optimization objectives (e.g., product purity). In other embodiments, the notification may simply include an indication that the request was rejected or that the value of the corresponding control parameter in the factory machinery database is no longer determined.

[0062] It should be noted that if some requested control parameters remain valid / acceptable in terms of process safety, product quality, cost, or other optimization criteria, it is impractical for human operators to perform continuous checks multiple times per minute or even per second. Therefore, embodiments of the present invention can allow automated systems to react immediately to changing production conditions and changing requirements, thereby reacting faster and more accurately than automated systems that rely on additional manual quality testing of the production process.

[0063] According to another embodiment, the secure interface is configured to count the number of requests received within a predefined time interval (e.g., within an hour, minutes, or seconds). If the number of requests to change a given control parameter exceeds a predefined maximum request threshold, any further requests to change that control parameter can be rejected, at least until the predefined time has elapsed. This can provide protection against denial-of-service attacks and can also protect the machine from wear and tear, since changes in some parameter values ​​can trigger movement of the machine's mechanical parts, so it may be preferable to limit the number of times machine parts move to a maximum value.

[0064] According to an embodiment, the automation system includes a programmable logic controller (PLC) configured to control one or more manufacturing processes performed by machines in the factory.

[0065] A PLC can be, for example, an industrial computer that has been ruggedized and is suitable for controlling manufacturing processes, such as assembly lines, machines, robotic equipment, or any action that requires high reliability, ease of programming, and process fault diagnosis.

[0066] A PLC operates in a program scan cycle, during which it repeatedly executes its program. The simplest scan cycle consists of three steps: reading input, executing the program, and writing output. This program follows a sequence of instructions. The processor typically requires tens of milliseconds to evaluate all instructions and update the status of all outputs.

[0067] Most PLCs lack strict access control and version control systems. This can lead to unauthorized changes to the program that may go unnoticed. Therefore, for security reasons, remote control of automation systems, especially those comprising one or more PLCs, is generally prohibited.

[0068] According to embodiments of the present invention, remote control of the automation system can be enabled in a stored manner because the security interface will verify each request and will only forward control parameters for those requests that have been verified as valid. According to a preferred embodiment, the entity submitting the request must be successfully authenticated at the system. If authentication fails, the request will not even be forwarded to the security interface. Therefore, the system according to embodiments of the present invention guarantees that only requests from authenticated, trusted entities that include control parameters that have been verified as valid and stored will be propagated to and stored in the factory machinery database, a fundamental means of controlling the operation of machines in a manufacturing plant.

[0069] According to an embodiment, verifying a request includes performing a reasonableness check. Performing the reasonableness check includes checking whether control parameters included in or derived from the request meet one or more criteria selected from the group consisting of:

[0070] - The value of the control parameter can be implemented by one or more machines that are to operate according to the stored control parameter; for example, if the control parameter is to set the pressure to be generated in a given tank to a value that cannot be reached by the corresponding pump intended to generate the desired pressure, the request will be considered invalid; and / or

[0071] - The value of the control parameter is safe for one or more machines operating according to the stored control parameters; for example, if the control parameter is to set the pressure to be generated in a given tank to a value that the corresponding pump can achieve but would pose a safety risk, such as because the value exceeds the maximum pressure limit considered safe, then the request would be considered invalid; and / or

[0072] - The values ​​of the control parameters are appropriate to provide manufactured products that meet quality standards; for example, if the control parameters are set to produce pressures in a given tank at values ​​within a range known to result in poor product quality, the request will be considered invalid.

[0073] Verification requests may include checking whether the control parameters included in the request meet two or more of the criteria mentioned above, and optionally, whether these parameters meet further criteria related to manufacturing process time, material costs, energy consumption, etc., that may be associated with the given control parameters. Verification requests may be rule-based and may include evaluating the control parameters using one or more global, machine-agnostic, and / or plant-agnostic rules and / or one or more machine-specific or plant-specific rules. Alternatively, verification of control parameters may include performing complex computational tasks. For example, predictive models (e.g., machine learning models such as support vector machines or neural networks) may be used to simulate the manufacturing process or its various steps assuming the control parameters specified in the request are used during production, and to check whether the predicted / simulated manufacturing process meets one or more criteria related to safety, efficiency, cost, and / or product quality.

[0074] According to one embodiment, the system includes a service interface. The service interface is configured to receive requests from clients and forward the requests to a security interface. The security interface is configured to receive requests only from the service interface.

[0075] This further enhances security because the secure interface does not receive requests directly from the client. Instead, it is shielded from direct contact with the client via the service interface. This ensures that the secure interface processes and validates only requests that have been processed and actively forwarded to the client interface by the service interface. On another beneficial side, this allows the service interface to be implemented as easily accessible interfaces for a variety of different clients. For example, the service interface could include multiple different web services suitable for different types of clients, such as remote users using VR glasses to submit requests to control robots or other machines in a factory, remote client applications operated by customers of a company operating a factory, or edge computing systems. Each service can be customized for optimized interaction with the corresponding type of client. For example, each service could include a REST API that allows clients to specify and submit requests for the appropriate service.

[0076] According to an embodiment, the system includes an ID provider module operatively coupled to a service interface. For example, the ID provider module may be an LDAP directory or other authentication system. The service interface is configured to receive requests from at least one client; authenticate the at least one client; and, in response to at least one client successfully authenticating at the service interface, forward the request to a security interface. If at least one client fails to be authenticated at the service interface, the service interface does not forward the request to the security interface.

[0077] This improves security because automated systems typically lack authentication mechanisms. Requiring clients to successfully authenticate with a service interface to forward their requests to a secure interface for verification significantly enhances the security of process automation systems.

[0078] According to the embodiment, the security interface is configured as follows:

[0079] - Identify one or more additional control parameters whose values ​​depend on the values ​​of one or more control parameters specified in or derived from the request; and

[0080] - Replace at least one control parameter included in or derived from the request with one or more additional control parameters identified, and / or supplement such control parameters included in or derived from the request with one or more additional control parameters identified.

[0081] One or more additional control parameters identified are stored in the factory machinery database for use in controlling the operation of one or more machines in the machine (in lieu of or as a supplement to the control parameters originally included in or derived from the request).

[0082] The steps described above can also be referred to as a "parameter mapping" process. Identifying additional parameters can include analyzing mappings, such as file or database records, or any other form of data structure that assigns one or more control parameters to one or more additional control parameters. For example, mapping can include mapping machine-agnostic (machine-independent) parameters (such as temperature) to machine-specific parameters, such as temperatures specified in a machine-specific temperature scale ranging from 0 to 5, rather than absolute temperatures specified in Kelvin or °C. The mapping process can also include more complex calculations of one or more additional control parameters. For example, the initially specified control parameter may be a desired product characteristic, and the calculation of additional control parameters may include predicting one or more additional control parameters that enable and / or require the provision of a product with the desired characteristics (see example...). Figure 4A and Figure 4B (Description).

[0083] Mapping control parameters can allow for an increase in the number of control parameters and / or mapping machine-agnostic parameters to machine-specific parameters. This can have the advantage of allowing remote clients (e.g., edge devices of customers wishing to monitor and / or control the manufacturing process of products already ordered by a customer) to control and / or monitor the production process with customer-specific control parameters without having to disclose too many details of the manufacturing plant, such as the type and number of machines used to manufacture the products. Embodiments of the present invention can enable owners of manufacturing plants to allow their customers to monitor and / or control the manufacturing process without the risk that customers may intentionally or unintentionally control the manufacturing process in a way that puts the plant and the employees working there at risk, and the plant owner does not have to disclose sensitive details of the machines included in the manufacturing plant to the customer.

[0084] According to one example, the control parameter initially specified in the request may be the desired temperature of the reaction vessel (a machine-agnostic parameter), and the other identified parameters may be the heating or cooling rate to be set on a specific heater or cooling device of the vessel to achieve the desired temperature (a machine-specific control parameter or setpoint).

[0085] According to an embodiment, the security interface is configured to verify one or more additional control parameters (also referred to as verifying "mapped" control parameters). The verification includes performing a reasonableness check on the additional control parameters, which includes checking whether the additional control parameters meet one or more criteria selected from the group consisting of:

[0086] - The values ​​of the additional control parameters identified can be implemented by one or more machines that are to be operated according to the stored additional control parameters identified; and / or

[0087] - The values ​​of the identified additional control parameters are stored for use in one or more machines to be operated according to the stored identified additional control parameters; and / or

[0088] - The values ​​of the additional control parameters identified are suitable for providing manufactured products that meet quality standards.

[0089] If one or more of the identified additional control parameters are determined to be invalid due to non-compliance with the criteria, neither the control parameters originally included in the request nor the additional identified control parameters are stored in the plant machinery database. Instead, the request is considered invalid.

[0090] According to an embodiment, the system further includes: a feedback interface configured to return request-related feedback information to the client that has submitted the request, the feedback information not containing any control parameters or status information of one or more machines, and only indicating whether the request was successfully executed.

[0091] Providing a feedback channel separate from the communication channel used for forwarding configuration data offers several advantages: increased security for controlling automated manufacturing processes (a compromised feedback channel will not affect the transmission of control parameters) and flexibility (security measures for the feedback channel can be less stringent). Additionally, it improves the accuracy of request verification performed by the security interface, as the validity and reasonableness of a request can depend on the current and changing state of one or more machines in the manufacturing plant.

[0092] According to the embodiment, the security interface is configured as follows:

[0093] - Generate an acceptance request, which is configured to prompt an entity to accept a requested modification to one or more control parameters stored in the factory machinery database; the entity may be, for example, a human user or a software program operating locally in the factory.

[0094] - Provide the entity with an acceptance request; for example, a security interface can enable software (such as a visualization engine) to generate a message that prompts the local user for approval of the requested control action via AR glasses or via the display of one of the machines;

[0095] - In response to receiving an acceptance from the instructing entity, the execution will include or derive control parameters from the request and store them in the factory machinery database.

[0096] Storing control parameters only in response to an entity's instruction to accept the proposed control parameters can have the advantage of improved security. Remote users may not have a full understanding of all processes taking place on the production line in a factory; therefore, machine reconfiguration may negatively impact products, machines, manufacturing processes, or personnel working in the factory, impacts that can or should be better perceived by local users. By requiring local users to accept control commands in the form of modified control parameters provided by the remote client, the risk of such negative impacts can be reduced.

[0097] In response to receiving a response indicating that the entity does not accept the request, the security interface executes to store the control parameters (included in or derived from the request) in the plant machinery database.

[0098] According to the embodiments, the security interface includes at least:

[0099] - The first submodule is configured to perform the first part of the validation of the request, which uses general, non-machine-specific rules and non-factory-specific rules.

[0100] - Second submodule, which is configured to perform a second part of the verification of the request, the second part of the verification using machine-specific rules and / or factory-specific rules;

[0101] The first submodule is part of level L3 of the multi-level automation pyramid, and the second submodule is part of level L2. For example, the first submodule is hosted on a computer system that hosts level L3 components, and the second submodule is part of level L2.

[0102] According to some examples, the first submodule includes a first rule engine and multiple first functions, which are configured to trigger the execution of one or more non-machine-specific rules and non-factory-specific rules by the first rule engine. The second submodule includes a second rule engine and multiple second functions, which are configured to trigger the execution of one or more machine-specific rules and / or factory-specific rules by the second rule engine.

[0103] Using a security interface and automation level that includes two distinct submodules hosted on different computer systems can offer the advantage of increased system flexibility. For example, the second submodule can be defined or customized by a factory operator who may have a better understanding of the details of the machines used in that particular factory. This simplifies the specification of factory-specific or machine-specific rules used to validate requests. The first submodule can be defined or customized by a user who may be familiar with the globally machine-agnostic and / or factory-agnostic aspects of the manufacturing workflow. Because these two submodules are instantiated and maintained separately, it is not necessary to allow factory operators to modify global, machine-independent rules, and it may not be necessary to allow L3 and higher-level operators of automation control to modify the factory-specific or machine-specific rules of the second submodule. This improves security.

[0104] According to some embodiments, the second submodule only allows the first submodule to provide control parameters, and does not accept or process control parameters provided by different software programs or requests that include such control parameters.

[0105] According to some embodiments, a request submitted by a requesting client includes one or more machine-agnostic function calls instructing steps of a manufacturing workflow to be performed. A security interface is configured to map the machine-agnostic function calls to calls that can be interpreted by the control interface of the corresponding machine in the factory. If the request is deemed valid, the security interface will forward the mapped, machine-specific function calls directly or preferably indirectly (e.g., via a database service interface) to one or more machines configured to interpret and execute the machine-specific function calls.

[0106] According to an embodiment, the acceptance request is generated by a second submodule of the security interface. The entity's response can be relayed back to the client and / or the second submodule of the security interface.

[0107] According to an embodiment, the system includes: a first virtual machine configured to host a first submodule of a security interface (and optionally also host additional components of the third level (L3) of a multilevel automation system architecture); and a second virtual machine configured to host a second submodule of a security interface (and optionally also host additional components of the second level (L2) of the multilevel automation system architecture). The first and second virtual machines are hosted by different virtual machine hosts and / or separated from each other via a firewall.

[0108] This strengthens the separation between tasks performed at the L3 level of the first submodule / multilevel automation system of the security interface and tasks performed at the L2 level of the second submodule / multilevel automation system of the security interface, thereby ensuring that any malware or other security issues that may exist at the L3 level do not propagate to the—typically more vulnerable—L2 level and automation system. For example, the only supported means of data exchange between L3 level components and L2 level components and machines in the automation system can be the data communication channels provided by the security interface, namely a one-way channel for verifying requests with control parameters and forwarding them to the automation system, and a feedback channel for returning feedback information from the automation system to the client.

[0109] According to embodiments, the secure interface is implemented as a DMZ or demilitarized zone (sometimes referred to as a perimeter network or shielded subnet). A DMZ is a physical or logical subnet that contains an organization's externally-facing services and exposes them to an untrusted, typically larger network (such as the Internet). This adds an extra layer of security to processing performed within the secure interface: external network nodes can only access what is exposed in the DMZ / secure interface, while the remaining data and software programs executing within the DMZ / secure interface are protected by a firewall. The DMZ acts as a small, isolated network situated between the external network (such as the Internet) and the private internal network of IT resources. The implementation of the firewall, particularly the firewall between the secure interface and the service interface, ensures that the secure interface is a DMZ.

[0110] According to the embodiment, the first virtual machine and the second virtual machine are respectively implemented as containers.

[0111] Using different virtual machines that can be implemented as containers ensures that L2 components (which are the only components of the machine that can control the automation system) are strictly isolated from the outside world and exchange data with the outside world, especially with L3 level components, only through defined and secure data exchange interfaces.

[0112] According to an embodiment, the request is generated by a remote client (e.g., a remote human user, a remote client device, or client software), which connects to the system via a network (e.g., the Internet). Typically, the remote client is located far from the manufacturing plant. The secure interface serves as a remote control access path from the remote client to the automation system and the machines controlled by the automation system.

[0113] This can offer the following advantages: providing a common entry point for clients (especially users) in many different remote locations via a secure interface, and enabling the integration of (existing) automation systems into new and often more complex control software. The secure interface provides a remote control access path to the automation system and the machines controlled by it.

[0114] In some embodiments, one or more machines controlled by an automation system include a local access interface to enable local users and / or local robots to directly control the machines via a second (e.g., field-based) communication channel. This provides a high degree of flexibility because both remote and local users can perform some control functions on the respective machines. In some examples, the access and control permissions for remote and local users can differ from each other. For example, only (remote) expert users may be permitted to make changes to some control parameters that could affect many machines and processes within the automation system. On the other hand, some operations (e.g., opening or closing a door, activating a press, etc.) may be permitted only to be initiated by a local user. If initiated only by a remote user, these operations could pose a safety risk, as the remote user might not be able to identify whether moving parts such as doors or presses could collide with people or damage objects standing on the ground.

[0115] According to an embodiment, the system further includes a visualization engine configured to generate graphical representations of digital twins of the factory's machines and / or products manufactured by the machines.

[0116] According to some examples, the request is submitted by a remote human user wearing virtual reality (VR) glasses operatively coupled to a visualization engine. The visualization engine visualizes at least some aspects of a machine-executed manufacturing process via the VR glasses.

[0117] For example, a visualization engine can enable a remote user wearing VR glasses to see one or more machines that he or she is currently trying to reconfigure and control.

[0118] Alternatively, the visualization engine may be configured to create augmented reality for one or more local users wearing AR glasses and operating within the factory, the augmented reality including avatars of remote users and / or virtual graphical objects that assist in the maintenance or control of one or more machines.

[0119] For example, a robot operating locally in a factory can be controlled by a remote user and act as the remote user's physical representation. When the remote user turns in a given direction, the local robot will follow that movement. The local robot may include one or more cameras, and images captured by the robot's cameras are transmitted to a visualization engine and forwarded by the visualization engine to the remote user's VR glasses. Thus, the remote user can see what the robot can see through the VR glasses. This improves safety because the remote user can now perceive objects in the vicinity of one or more machines to be controlled by the remote user. This allows the remote user to identify any obstacles or other objects or events that could indicate that a control command should not be submitted because it poses a safety risk to people or parts of the manufacturing plant, or that a control command should be submitted to avoid a safety risk. Control commands can be submitted as requests to modify one or more control parameters in the control parameters of one or more machines in the factory's machinery database.

[0120] According to some embodiments, the visualization engine supports voicemail and / or chat between a remote client acting as a remote human user and a local user at a manufacturing plant wearing AR glasses. For example, a remote user can wear VR glasses, and a local user can wear AR glasses. Both VR and AR glasses can include microphones and audio output interfaces, such as speakers. Remote and local users can exchange real-time voice messages via the microphones and speakers of their respective VR or AR glasses.

[0121] Preferably, the AR application is configured to control the volume of the audio output generated by the local user's AR glasses, such that the volume of the remote user's output voice is positively correlated with the spatial proximity of the local user and the position of the remote user's avatar in the coordinate system used by the AR glasses to display virtual objects. Alternatively, the VR application is configured to control the volume of the audio output generated by the remote user's VR glasses, such that the volume of the local user's output voice is positively correlated with the spatial proximity of the remote user and the position of the local user's avatar in the coordinate system used by the VR glasses to display virtual objects.

[0122] According to some examples, the system further includes a factory environment database and a database replication module. The factory machinery database includes models, location information, and status information of machines and / or products produced by those machines. The location information is continuously updated to reflect the actual location and status of the machines and / or products processed or produced by them. The database replication module is configured to continuously replicate only a predefined subset of the data from the factory machinery database to the factory environment database, thereby filtering out sensitive machine-related data. The factory machinery database is configured to be inaccessible by the visualization engine. The visualization engine is configured to generate visual representations of the factory's machines and / or products processed by them using only the data included in the factory environment database.

[0123] Using two different databases as described above offers the advantage of enhanced security: the visualization engine continuously generates graphical representations of digital twins of the machines and / or objects involved in the automated production process, providing human users with a continuously updated overview of the process. Filtering ensures that sensitive machine-related data (such as exact location, sensitive status parameters, or control parameters) is not exposed to Layer 3 or any other system outside the automation system. The database replication module only copies the information necessary to create a graphical representation of the machine or product, such as a model with the same or similar structure as the machine, or a highly abstract representation of the operations performed by the machine.

[0124] The graphical representation of a digital twin can be, for example, a conventional 2D representation of a machine and / or product generated for display via a computer screen or smartphone screen. According to other examples, the graphical representation is a 3D representation to be displayed via VR or AR glasses, providing a 3D representation within a 3D coordinate system.

[0125] According to an embodiment, the entity receiving the acceptance request is one of the local users.

[0126] According to an embodiment, the machine whose automatic operation is performed based on stored control parameters included in or derived from a valid request is a robot, particularly a robot controlled by a remote user via a visualization engine.

[0127] According to an embodiment, the automated operation of the machine and / or another machine in the manufacturing plant, which is executed based on stored control parameters included in or derived from a valid request, includes a local control interface that allows a local operator to access and control the machine via a separate local communication channel. For example, the local interface could be a display screen of one of the machines.

[0128] In another aspect, the present invention relates to the use of a system according to any of the embodiments described herein for automating processes in a manufacturing plant.

[0129] In another aspect, the present invention relates to a system for monitoring a manufacturing plant. The system includes:

[0130] - Multiple machines (140) in the manufacturing plant.

[0131] - Factory machinery database (128,548), which includes control parameters for these machines and spatial and / or status information of physical objects that are these machines and / or objects processed by these machines;

[0132] - An automation system (103) is used to automatically operate these machines according to these control parameters in the factory's machinery database;

[0133] - An update engine (160) is configured to continuously receive spatial and / or status information of these physical objects from multiple sensors (162) during the ongoing manufacturing process and update the plant machinery database with the received information;

[0134] - A visualization database (130) comprising a subset of the data in the factory machinery database;

[0135] - Copy module (150), which is configured to continuously select data in the factory machinery database that enables the generation of digital visual representations of one or more physical objects, wherein the selected data does not contain these control parameters, and is configured to copy only the selected data to the visualization database;

[0136] - A visualization engine (134) (a software program or a set of interoperable software programs) configured to generate a digital visual representation of the one or more physical objects based on data in the visualization database;

[0137] - Display device (154, 108) configured to display a visual representation of the one or more physical objects to a user so that the user can monitor the manufacturing process.

[0138] In another aspect, the present invention relates to a computer-implemented method for monitoring a manufacturing plant. The method includes:

[0139] - Provide a system for monitoring a manufacturing plant, the system comprising:

[0140] ○ Multiple machines (140) in the manufacturing plant.

[0141] ○ Factory machinery database (128, 548), which includes the control parameters of these machines and the spatial and / or status information of physical objects that are these machines and / or objects processed by these machines;

[0142] ○Automation system (103), which is used to automatically operate these machines according to these control parameters in the factory's machinery database;

[0143] ○Update engine (160);

[0144] ○ A visualization database (130) comprising a subset of the data in the factory machinery database;

[0145] ○ Copy module (150);

[0146] ○ Visualization engine (134); and

[0147] ○ Display devices;

[0148] - The update engine continuously receives spatial and / or status information of these physical objects from multiple sensors (162) during the ongoing manufacturing process and uses the received information to update the factory's machinery database;

[0149] - The copy module continuously selects data from the factory machinery database that enables the generation of digital visual representations of one or more physical objects, whereby the selected data does not contain these control parameters, and only the selected data is copied to the visualization database;

[0150] - The visualization engine (134) generates a digital visual representation of the one or more physical objects based on the data in the visualization database;

[0151] - A visual representation of the one or more physical objects is displayed to the user via the display device (154, 108) so that the user can monitor the manufacturing process.

[0152] For example, the factory's machinery database could contain continuously updated, precise location information about the machines used in the manufacturing process, the quantity and type of machines and physical objects involved in the manufacturing process at any given time during the process, and all control parameters such as temperature, humidity, pH, reactant concentration, agitator speed, etc. This information can be sensitive, not only because it may allow for the identification and manipulation of individual machines, but also because it may reveal sensitive knowledge, such as formulations used for compound synthesis or knowledge about how to properly or optimally operate a group of machines.

[0153] The system architecture described above may offer the advantage of providing secure monitoring procedures, ensuring that users only see data from ongoing production processes that they should explicitly be able to see. Instead of directly operating on a database containing sensitive control parameters and complete details about the status and location of individual machines and processed objects, the visualization engine operates on a second mirror database containing only the information necessary for visualization within the relevant application environment. This significantly enhances security. Since the visualization database no longer contains any truly sensitive data, particularly sensitive control data, the severity of unauthorized access to this database is reduced. In particular, embodiments of the invention may be advantageous when users, for various reasons, are granted limited access to sensitive internal processes and plant data and are able to monitor ongoing manufacturing processes. For example, a customer ordering product manufacturing from an operator of an automated manufacturing system can remotely monitor the manufacturing process via a display device to determine if the process is progressing smoothly and when it is expected to be completed. For security reasons, no sensitive system parameters should be transmitted to customers and / or users dialing in via insecure external internet connections, as this could allow for targeted manipulation of machines. Using the system architecture described above, these risks have been eliminated or significantly reduced.

[0154] According to some embodiments, the system includes a security interface (142) configured to receive requests from clients (e.g., remote client devices or remote users) for controlling one or more of these machines. The security interface is configured to: validate the request; and, in response to determining that the request is valid, store control parameters included in or derived from the request in a factory machinery database. The automation system operates these machines based on the stored control parameters included in or derived from the valid request.

[0155] The advantage of this approach is that it ensures the client cannot simply set the control parameters to arbitrary values. Instead, the control parameters provided in the request will only take effect if the security interface performs a reasonableness check and determines that the control parameters are safe and reasonable and will not cause damage to the machine or harm to a human operator.

[0156] According to an embodiment, at least one of these machines is a robot, and the request is a robot control request for remote control of the robot by a remote user. A visualization engine is configured to generate a meta-universe including a digital twin of the robot, thereby configuring the automation system to control the robot's movement according to robot control commands, such that the robot's orientation and / or movement reflects the orientation and / or movement of the remote user. The visualization engine is configured to generate a digital visual representation of the one or more physical objects, allowing the remote user to see other machines in the factory from the perspective of the robot, which acts as the remote user's physical representation in the factory. In this case, the display device could be VR glasses worn by the remote user who has submitted the robot control request.

[0157] Because the factory machinery database and visualization database are continuously updated, remote users can visually monitor the ongoing manufacturing process from the robot's perspective and intuitively control the robot's movement, for example, via VR glasses. Therefore, remote users and the visualization database cannot access the factory machinery database. Consequently, the system only supports unidirectional transmission of sensitive control parameters from the client to the machine via a secure interface, but prevents the transmission of control parameters (such as sensitive configuration parameters) from the machine / automation system back to the remote user or visualization engine.

[0158] According to one embodiment, the system includes an ID provider computer system. The ID provider computer system is configured to authenticate clients that have submitted requests. If authentication fails (e.g., the client fails to authenticate as a client authorized to control the robot), the security interface will not store the control parameters in the factory machinery database, and the user will not be allowed to control the robot, such as move and rotate it.

[0159] According to one embodiment, the system includes a VR system that enables a remote user to submit a robot control request using the VR system and VR glasses, and allows the remote user to control the robot only after successful authentication. For example, the VR system may be software that is part of or interoperable with a visualization engine, and is configured to receive user motion signals sensed by one or more sensors on the user's VR glasses.

[0160] According to the embodiment, the automation system and the factory machinery database are implemented at the process control level (L2), and the visualization engine is implemented at the operation control level (L3), whereby the safety interface is the only interface that allows control parameters to be communicated from L3 level system components to L2 level system components.

[0161] According to an embodiment, verification of the request includes performing a reasonableness check on the control parameters on the ID provider computer system and / or authenticating the client that has submitted the request. The control parameters, including those in or derived from the request, are stored in the factory machinery database only if the client is successfully authenticated at the ID provider computer system and the control parameters are determined to be reasonable.

[0162] According to an embodiment, control parameters included in or derived from a request are mapped to additional control parameters included in a factory machinery database to expand the control parameters and also perform a rationality check on the additional control parameters.

[0163] For example, the safety interface can perform rule-based mapping to determine that the requested 190°C reaction temperature is permitted only if the reaction is carried out in a specific type of vessel that supports such a high temperature. Therefore, the expanded set of control parameters can additionally include the ID of a specific vessel suitable for supporting 190°C synthesis. According to another example, the safety interface can determine that the requested 190°C reaction temperature must be accompanied by a stirrer speed of at least 20 revolutions per minute, otherwise the reaction mixture may agglomerate on the vessel walls. In this case, the control parameter 190°C will be supplemented by the minimum stirrer speed mentioned above.

[0164] According to an embodiment, the security interface further includes a feedback channel configured to notify the client that has submitted the request whether the request is accepted and processed or rejected. Thus, the subset of data in the visualization database used by the visualization engine to generate digital visual representations of these physical objects is the sole data communication link for the remote client to receive status data of the factory's machines and / or physical objects.

[0165] The advantage of this approach is that neither the data returned to the client via the feedback channel nor the visual representation generated by the visualization engine reveals any sensitive information to the client: the feedback channel only indicates whether the request has been accepted and processed. It does not include sensitive state information about the machine, such as control parameters or other sets of configuration parameters. The visualization engine can implicitly provide some feedback and state information to the user because it can generate virtual objects representing digital twins of the machine and / or physical objects processed by the machine. However, these visual representations may only be coarse-grained, predefined 2D or 3D models that may selectively include some state data (e.g., the fill level of a tank). The replication module and the visualization engine act as filters to ensure that sensitive machine-related data is filtered out before generating visual representations of the machine and / or objects processed by the machine.

[0166] According to one embodiment, the system includes a user registry containing user accounts and predefined user role assignments. The visualization engine is configured to identify the role assigned to the user to whom the visual representation is to be displayed, and to generate these visual representations based on the user's identity and / or the role assigned to that user. For example, for a user assigned the role of "customer," the visualization engine might generate a visual representation of one or more machines to provide a very coarse-grained overview of the manufacturing process. This allows the customer to determine whether their ordered products will be available on time. However, for a user playing the role of an "experienced internal operator," the visual representation might be more detailed, more accurately reflecting the actual size, location, and / or orientation of machines or products in the factory, and / or possibly including more detailed data such as the number and type of machines used in the ongoing production process. However, even an "experienced internal operator" might not be able to see all the details of the production process status that could be displayed to a local user accessing the factory's machinery database via a local communication channel, as remote access might be considered less secure.

[0167] The display device can be a computer monitor, such as an LCD, LED, or OLED display, a smartphone display, etc. In this case, the visual representation of the machine and / or other physical object can include a 2D representation. In other examples, the display device can be VR glasses or AR glasses, and the visual representation can be a digital twin of the visual representation of the machine or object suitable for display via VR or AR glasses.

[0168] Systems for monitoring manufacturing plants can be implemented as part of systems for automating manufacturing plant processes, and vice versa. The modules and software architecture elements described in the examples and embodiments of systems for monitoring manufacturing plants can be freely combined with those described in the examples and embodiments of systems for automating manufacturing plant processes. For example, a security interface may include two distinct sub-modules, which may use a rules engine and functions with synchronization structures.

[0169] Based on the system described above, combining AR and VR visualization technologies to ensure the safe operation of industrial production processes can be beneficial, as it can significantly improve operational safety. Equipment and processes are increasingly being remotely controlled. However, this introduces significant safety risks, especially in the context of controlling industrial manufacturing processes: intentional or accidental input of incorrect or inappropriate control parameters can lead to poor product quality, significant waste, machine malfunctions, and even personal injury in the worst-case scenario. Remote users often have limited knowledge of the processes currently occurring inside or on the machine. For example, a remote user may not realize that a container is almost full and may add more material, causing an overflow. While VR glasses can improve the overview, the details of the digital twin of the machine displayed to the remote user via VR glasses may be reduced. Furthermore, not all aspects important for assessing the overall situation (such as whether there are people or hazardous materials near the machine for maintenance purposes) can be fully captured by the factory's sensor systems and then displayed in the VR world by the visualization engine. However, local users typically have this overview. By providing a secure interface to automatically prompt local users to approve all or at least potentially safety-critical control commands from remote users before execution, damage to products, machinery, and personnel can be prevented. Remote control of production processes has been significantly improved and made safer, especially with the help of VR glasses.

[0170] Remote users may be located in a different location from the factory, such as in different cities or countries. The visualization engine can be configured to create a VR world containing visible digital twins of one or more machines within the factory or the entire factory. The digital twin can be a 2D or 3D representation of the machine and / or a physical object processed by the machine, such as a hologram, and can represent the current state of the factory. Typically, the visible digital twin is only a coarse-grained visual representation of real-world objects.

[0171] According to an embodiment, the security interface is configured to verify requests, for example, by performing a reasonableness check to determine whether the control parameters included in and / or derived from the request are reasonable. The security interface is configured to store the control parameters included in and / or derived from the received request in the factory machinery database only if the request is successfully verified as a valid (e.g., reasonable) request.

[0172] This can further enhance the security of remote process control: if the safety interface determines that setting, for example, the temperature of the reaction mixture to a certain value might damage the tank wall, the safety interface can treat the request as invalid. For example, request verification can be implemented based on configurable rules and / or a combination of actions based on the first and second submodules of the safety interface, as described herein with reference to various embodiments and examples.

[0173] According to some embodiments, the request is created by an action of a remote user, which is recognized as a control command by the VR glasses worn by the remote user.

[0174] For example, a visualization engine can display virtual objects next to a visible digital twin representing one of the machines, in the form of a control panel. A remote user can move a control handle and press buttons on the handle to select items in the control panel. This selection (e.g., a virtual button or menu element) may trigger the generation of requests to operate the machine represented by the visible digital twin. For example, the request could instruct the machine to start or stop operating, or to open or close a door, etc.

[0175] According to an embodiment, the security interface will only generate an accept request if the request is successfully verified as valid.

[0176] This reduces the CPU resources consumed in processing requests and also reduces network traffic, as the generation of virtual objects (such as windows prompting the user to accept a requested action) and the rendering of objects in the metaverse typically require significant CPU resources. Furthermore, prompting local users to accept inherently unreasonable or risky requests can unnecessarily distract them from their normal work.

[0177] According to one embodiment, the system includes an ID provider computer system. The ID provider computer system is configured to authenticate clients that have submitted requests. If authentication fails (e.g., the client fails to authenticate as a client authorized to control a robot), the security interface will not store the control parameters in the factory machinery database, and the request will be rejected.

[0178] According to an embodiment, the request is for operating a robot located in a factory.

[0179] According to one embodiment, the system includes a VR system that enables a remote user to submit requests using the VR system and VR glasses, and allows the remote user to control at least one of the machines, such as a robot, only after successful authentication. This can have the advantage of providing a fully immersive metaverse, allowing the remote user to monitor an ongoing production process and control the process by submitting requests to the automation system to operate one or more of the machines using VR glasses and / or controllers or handles interoperable with the VR glasses.

[0180] According to an embodiment, the visualization system is configured to generate a visual representation of a remote user in the form of an avatar and display the avatar to the local user through AR glasses worn by the local user. Preferably, the visualization engine also supports the exchange of voice and text messages between the remote user and the local user. This can have the advantage that if the local user needs more information to decide whether to accept a request, the visualization engine provides communication options for both users. Therefore, when the avatar is displayed as an overlay of a real-world factory environment via AR glasses, the local user can have the feeling of talking to a real person. The local user wearing AR glasses can observe the VR user's avatar moving around the factory, thus allowing the VR user to collaborate, assist, guide, and / or teach the AR user about processes in the factory (e.g., production or maintenance processes).

[0181] According to an embodiment, the system includes an update engine (160), a visualization database (130), and a replication module (150). The visualization database (130) includes a subset of data from a factory machinery database.

[0182] The update engine is software configured to continuously receive spatial and / or status information of physical objects (machines and / or objects processed by machines) from multiple sensors (162) during the ongoing manufacturing process and to continuously update the factory machinery database using the received information.

[0183] The copy module is software configured to continuously select data from the factory machinery database that enables the generation of digital visual representations of one or more physical objects, whereby the selected data does not contain the control parameters. The copy module is further configured to copy only the selected data to the visualization database. The visualization engine is configured to generate digital visual representations of the one or more physical objects based on the data in the visualization database. The visualization software is configured to display the visual representations of one or more physical objects to one or more users via display devices (154, 108) to enable users to monitor the manufacturing process.

[0184] According to the embodiment, the automation system and the factory machinery database are implemented at the process control level (L2), and the visualization engine is implemented at the operation control level (L3), whereby the safety interface is the only interface that allows control parameters to be communicated from L3 level system components to L2 level system components.

[0185] According to an embodiment, verification of the request includes performing a reasonableness check on the control parameters on the ID provider computer system and / or authenticating the client that has submitted the request. Control parameters, including those in or derived from the request, are stored in the factory machinery database only if the remote user is successfully authenticated at the ID provider computer system and the control parameters are determined to be reasonable.

[0186] According to an embodiment, control parameters included in or derived from a request are mapped to additional control parameters included in a factory machinery database to expand the control parameters and also perform a rationality check on the additional control parameters.

[0187] In another aspect, the present invention relates to a computer-implemented method for automating processes in a manufacturing plant, the method comprising:

[0188] - Provides systems (100, 200, 300, 500), which include:

[0189] ○ Multiple machines in the manufacturing plant (140, 536).

[0190] ○ Factory Machinery Database (128, 548), which includes the control parameters of the machine;

[0191] ○Automation system (103), which is used to automatically operate the machines in the manufacturing plant according to these control parameters in the plant's machinery database;

[0192] ○ User registry, which includes user profiles for the following users.

[0193] ■ Multiple remote users not located in the manufacturing plant, and

[0194] ■ Multiple local users located at the manufacturing plant,

[0195] ○ A visualization engine configured to create augmented reality for local users and virtual reality, including digital twins of factories, for remote users;

[0196] ○ Security interface (142).

[0197] - The security interface receives a request from one of the remote users (108) for operating at least one of these machines.

[0198] - The security interface enables the visualization engine to generate an acceptance request, which is a signal prompting one of the local users (146) to accept the requested operation on at least one of the machines via augmented reality glasses worn by that local user.

[0199] - Control parameters (402-408) included in and / or derived from the received request are stored in the factory machinery database only when a local user accepts the request.

[0200] Systems for monitoring manufacturing plants can be implemented as part of systems for automating manufacturing plant processes, and vice versa. The modules and software architecture elements described in the examples and embodiments of systems for monitoring manufacturing plants can be freely combined with the modules and software architecture elements described in the examples and embodiments of systems for automating manufacturing plant processes, and vice versa.

[0201] As used in this article, an “interface” is a boundary based on software and / or hardware across which two or more separate components of a data processing system exchange information.

[0202] As used herein, a "service interface" is an interface through which two or more clients exchange information with a system used to automate processes in a manufacturing plant. Specifically, a client can be a remote client connected to the service interface via a network such as the Internet. Clients can be users, client devices, client software programs, edge computing systems, or combinations thereof.

[0203] As used in this article, a “security interface” is an interface that communicates requests, particularly requests to change the configuration of manufacturing plant machines, to an automation system.

[0204] As used herein, “machine” refers to any physical entity involved in the manufacture and / or processing of a product manufactured in a factory. For example, a machine can be an apparatus powered by electrical, mechanical, thermal, chemical, or other forms of energy to perform one or more operations. A machine can also be equipment or equipment components, apparatus, robotic arms, conveyors, robots, extruders, rollers, ovens, or any other type of physical component that can perform one or more operations in a manufacturing workflow. The nature and location of machines in a factory may depend on the type of product to be manufactured.

[0205] As used herein, "systems for process automation" refers to a distributed, networked system comprising automation systems, including multiple machines in one or more plants and one or more additional system components (e.g., L3 and / or L4 components of a process automation pyramid), for automatically controlling the operation of the respective plants' machines to execute workflows. This system is used and / or configured for process automation, particularly process automation of processes in one or more manufacturing plants.

[0206] As used herein, an "automation system" (also known as a "process automation system (PAS)") is a system used to automatically control processes in a plant, such as a chemical plant, oil refinery, paper mill, or pulp mill. PASs typically use networks to interconnect sensors, controllers, operator terminals, and actuators. A PAS, as used herein, can be based on open standards, but it can also be based on and / or include proprietary standards, in which case it is also referred to as a DCS (Distributed Control System). Automation systems can be associated with SCADA systems. Automation systems can use established, possibly plant-specific, protocols or technologies. According to embodiments, an automation system includes one or more machines in the plant, PLC (Process Logic Control) interfaces for these machines, and / or PCS (Process Control System) interfaces. Optionally, it may also include a plant machinery database containing control parameters for the machines.

[0207] As used herein, the terms "Level 3" or "Level 3 IT Infrastructure System" refer to IT system components included at the manufacturing operations level. This level is referred to as "Level 3" or "Level 3" in the Purdue model of multi-level automation systems; however, the terms "Level 3" or "Level 3 IT Infrastructure System" are also used herein to refer to IT system components included at the manufacturing operations level, which may have different names in other models of multi-level automation systems. Level 3 components perform control functions at a higher level than those in the core process control system.

[0208] As used herein, the terms “L2 level” or “L2 IT infrastructure system” refer to the IT system components included in the core process control level. This level is referred to as “L2” or “Level 2” in the Purdue model of multi-level automation systems, but the terms “L2 level” or “L2 IT infrastructure system” are also used herein to refer to the IT system components included in the core process control level, which may have different names in other models of multi-level automation systems.

[0209] As used in this article, "database" refers to any data structure that allows for the temporary or permanent storage of data. For example, a database can be a data store managed by a database management system (DBMS), a file directory, a group of one or more files, a single file (such as a spreadsheet), etc. A database can also be a data structure suitable for storing data in digital form, such as electronic or optical storage media.

[0210] As used herein, a “factory machinery database” is a database that includes data related to one or more machines in a manufacturing plant. For example, the database may include control parameters for one or more machines and / or data describing one or more machines, such as machine models, machine status data, machine configuration data, and / or other machine-related data that allows the generation of digital twins of the machines and / or data that allows the simulation of machine operation or measurement data obtained by one of the machines. A factory machinery database may also include location and / or status information of objects (e.g., reactants or products) processed or generated by the machines in the plant.

[0211] As used herein, the “metaverse” is a virtual representation of a world customized to be displayed preferably via virtual reality and / or augmented reality glasses. A metaverse can be implemented as a spatially merged network of 3D virtual worlds, such as a 3D world as a digital twin of a factory and its machines, and a 3D world for one or more remote and / or local users wearing VR and AR glasses.

[0212] As used in this article, a “digital twin” is a digital representation of a real-world physical object or process that serves as a digital counterpart of the real-world physical object or process for practical purposes such as visualization, simulation, integration, testing, monitoring, or maintenance.

[0213] As used herein, a “factory” (also known as a “manufacturing plant” or “manufacturing factory”) is an industrial facility, typically a complex of buildings housing machinery in which workers and / or machines manufacture articles or process each article into another. A manufacturing plant can be, for example, a plant for producing vehicles or vehicle parts, a plant for producing consumer electronics, or a plant for synthesizing or processing chemical substances.

[0214] As used herein, a "factory environment database" is a database that includes data related to a factory or factory environment. A factory environment database may include a copy of a portion of data, such as from a factory machinery database. Preferably, sensitive machine-related data (e.g., status parameters, location, configuration parameters, etc.) is not included in the factory environment database.

[0215] According to some examples, the data portion of the factory machinery database, which includes the data in the factory environment database, includes data used during reasonableness checks performed by the L3 submodule of the safety interface. This data may include, for example, reasonableness criteria, thresholds, and reference parameter values ​​related to the factory or its environment but not to individual machines. For instance, the data may include what are considered acceptable price thresholds for energy, weather data, information about ongoing manufacturing processes in other factories and their corresponding demands, and quality specifications required by different customers for the products to be manufactured.

[0216] As a supplement or alternative to the data used for requesting verification, the data portion of the factory machinery database, which includes the factory environment database, includes data that enables the visualization engine to generate digital visual representations of one or more machines included in the factory machinery database and / or data that enables the generation of digital visual representations of objects processed or produced by said machines.

[0217] As used herein, a "visualization database" is a database that includes data that enables software (e.g., a visualization engine) to generate digital visual representations of one or more physical objects. For example, a visualization database may include 2D or 3D models of physical objects, such as realistic or simplified images or holograms of the objects. A visualization database may include spatial information about the objects, such as orientation of the objects or their position within a virtual coordinate system. Preferably, the visualization database does not indicate the exact geographical location of the objects. For example, a visualization database may include its control data, including digital models and / or general status information of one or more machines in a factory machinery database, and / or digital models and / or general status information of objects processed or produced by said machines.

[0218] According to some example implementations, the factory environment database is used as a visualization database, and vice versa.

[0219] As used herein, an "edge computing system" is a computer system installed spatially near the machines in a factory and configured to process data generated by those machines. This data may specifically include real-time data. Although edge computing systems, according to some examples, have spatial proximity, they are not part of the factory's automation system. For example, an edge computing system may not be part of the L1, L2, or L3 level of a factory's multi-level automation architecture. Edge computing systems can be configured to continuously receive, store, and evaluate data provided by machines during the manufacturing process, such as machine status data, product status data, process parameter values, product characteristics, etc. Due to their spatial proximity to the data source, edge computing systems can react very quickly to events occurring during the manufacturing process with very low latency. However, for security reasons and due to a lack of suitable interfaces, edge computing systems have not been integrated into process automation systems until now. By enabling edge computing systems to generate requests for controlling one or more machines and submit them to a secure interface, embodiments of the present invention can allow the integration of edge computing systems into systems for automated process control. For example, an edge computing system can be configured to continuously analyze status information received from one or more machines in a factory and, upon determining that an undesirable event has occurred or is expected to occur during the production workflow, submit a request to a safety interface. This request includes control parameters suitable for preventing or mitigating the impact of the undesirable event. Undesirable events could be, for example, consumable shortages, conveyor belt blockages, or machine temperatures exceeding thresholds.

[0220] As used herein, “control parameters” are parameters that affect the state and / or operating mode of a machine. For example, control parameters can be configuration parameters, function parameters used to invoke the machine’s PLC interface, commands, or a combination of two or more of the foregoing.

[0221] As used in this article, a “request” is a message sent between objects. For example, a request can be sent from a client to a system used for process automation via a network. There, the request can be processed, optionally modified or supplemented, and forwarded by multiple interfaces until it reaches its destination or until the forwarding of the request is rejected.

[0222] As used herein, a “visualization engine” is monolithic or distributed software configured to generate visual representations of physical objects. The visual representation can be, for example, a 2D representation to be displayed via a computer or smartphone screen, and / or a 2D or 3D representation to be displayed via VR glasses and / or AR glasses. In the latter case, the visualization engine (also referred to as a “metaverse engine”) interoperates with an AR application to enable AR glasses controlled by the AR application to display virtual object representations to a user wearing the AR glasses. Alternatively, the visualization engine is configured to interoperate with a VR application to enable VR glasses controlled by the VR application to display streaming state information to a user wearing the VR glasses. Where the visualization engine is operatively coupled to multiple users wearing AR glasses, VR glasses, or a mixture of VR and AR glasses via one or more AR and / or VR applications, the visualization engine can be configured to globally align virtual objects (their characteristics, size, orientation, and position) with the coordinate system used by the VR and AR glasses to display the virtual objects. As a result of this global alignment of virtual objects, multiple users wearing VR and / or AR glasses can at least partially share a common virtual object world, which may include multiple machines in a factory, one or more production lines in a factory, and / or digital twins of the factory or users operating in the factory.

[0223] As used herein, a "client" is computer hardware or software that accesses a service provided by a server via a computer network (whereby the service is accessed specifically as part of a client-server model of the computer network). The server is typically (but not always) on another computer system, in which case the client accesses the service via a network (e.g., the Internet). Client software can be software that translates user actions into requests and other actions of the client software; therefore, the term "client" can also refer to a user who uses hardware or software to access a service via a network. The term "client" can also be applied to the computer or device running client software.

[0224] For example, a client can be a computer program that, as part of its operation, relies on sending requests to another program or computer hardware or software to access services provided by a server (which may or may not be located on another computer). For example, a web browser can be used as a client to connect to a web server and retrieve web pages for display.

[0225] As used herein, "computer system" refers to a machine or group of machines that can be instructed to automatically perform sequences of arithmetic or logical operations via computer programming. Modern computers have the ability to follow a broad set of operations referred to as "programs," "software programs," or "software applications." These programs enable computers to perform a wide range of tasks. According to some embodiments, a computer system includes hardware (specifically, one or more CPUs and memory), an operating system (main software), and additional software programs and / or peripheral devices. A computer system can also be a group of computers connected together and working together, particularly a computer network or computer cluster, such as a cloud computing system. Therefore, as used herein, "computer system" can refer to a standalone standard computer system, such as a single server computer, or a computer network, such as a cloud computing system. In other words, one or more computerized devices, computer systems, controllers, or processors can be programmed and / or configured to operate as explained herein to perform different embodiments of the invention.

[0226] The embodiments and examples described herein should be understood as illustrative examples of the invention. Further embodiments of the invention are envisioned. Although specific combinations and distributions of software programs and computer systems have been described by way of example, it should be understood that any feature described with respect to any embodiment may be used alone, in combination with other described features, or in combination with one or more features of any other embodiment or any combination of any other embodiment, provided that these features are not mutually exclusive.

[0227] Therefore, some embodiments of this application relate to a computer program product. Other embodiments of this application include corresponding computer-implemented methods and software programs to perform any of the steps and operations of the method embodiments summarized above and disclosed in detail below.

[0228] Any software program described herein can be implemented as a single software application or a distributed, multi-module software application. One or more software programs described herein can be carried by one or more carriers. Carriers can be signals, communication channels, non-transitory media, computer-readable media, and other examples. Computer-readable media can be: magnetic tape; optical discs, such as CDs or DVDs; hard disks; electronic storage; or any other suitable data storage medium. Electronic storage can be ROM, RAM, flash memory, or any other suitable electronic storage device, whether volatile or non-volatile.

[0229] Each of the different features, technologies, configurations, etc. discussed in this article can be executed independently or in combination, and via a single software process or in a combination of processes, such as in a client / server configuration.

[0230] It should be understood that the computer systems and / or computer-implemented method embodiments described herein can be strictly implemented as software programs or applications, software and hardware, or implemented as hardware alone, such as within a processor, or within an operating system, or within a software application.

[0231] The operation of the flowchart is described with reference to the system / apparatus shown in the block diagram. However, it should be understood that the operation of the flowchart can be performed by embodiments of systems and apparatus other than those discussed in the block diagram, and the embodiments discussed with reference to the system / apparatus can perform operations different from those discussed in the flowchart.

[0232] Given the various arrangements of the embodiments described herein, this detailed description is intended to be illustrative only and should not be considered as limiting the scope of the invention. Therefore, all such modifications that may fall within the scope of the following claims and their equivalents are claimed by the invention. Thus, this specification and drawings should be considered illustrative rather than restrictive. Attached Figure Description

[0233] The embodiments of the invention are explained in more detail below with reference to the accompanying drawings, which are illustrated by way of example only.

[0234] Figure 1 A high-level block diagram of a system for process automation is shown;

[0235] Figure 2 A block diagram of another system for process automation is shown;

[0236] Figure 2 A block diagram of a system for safety visualization of components in an automated system is shown;

[0237] Figure 4A An example of a GUI that enables local users to monitor the status of manufacturing process steps is shown;

[0238] Figure 4B Another example is shown, illustrating a GUI that enables local users to monitor the status of manufacturing process steps;

[0239] Figure 5 A distributed system for controlling manufacturing processes in multiple factories is shown;

[0240] Figure 6 The system was demonstrated and configured to display various virtual objects to "operator" users;

[0241] Figure 7 The system was demonstrated to display various virtual objects to "maintenance worker" users;

[0242] Figure 8It showcases the avatar of the remote user;

[0243] Figure 9 This demonstrates the coordinate system used to represent real-world machines and local user avatars in the virtual metaverse for remote operation; and

[0244] Figure 10 This is a flowchart of a method for achieving secure remote control of automated manufacturing processes. Detailed Implementation

[0245] Figure 1 A block diagram of a process automation system 100 for use in a manufacturing plant is shown. The plant may be, for example, a plant for synthesizing chemical compositions, or a plant for manufacturing vehicles, computers or consumer products, furniture, or food.

[0246] The factory comprises multiple machines 140 for manufacturing and / or processing one or more physical objects. The type of machine depends on the type of product to be manufactured and / or the machine manufacturer selected by the factory owner. For example, machines may be electronic equipment, fixtures, robotic arms, conveyors, robots, extruders, rollers, ovens, etc.

[0247] The system further includes a factory machinery database 128, which can be part of the factory's Level 2 IT infrastructure. For example, the machine database can be a file directory, a single file, a combination of files, a database managed by a database management system (DBMS), or a graph database (GDB) such as Neo4J, or a combination thereof.

[0248] The factory machinery database 128 includes control parameters, such as machine configuration parameters, location information, and / or structural or functional models and / or processed digital objects and / or data used to generate one or more machines 140 of a manufacturing plant and / or digital twins of physical objects processed in the plant. For example, control parameters could be the temperature of a reaction vessel for a chemical reaction, the temperature of an oven, the rotational speed of a stirrer, the speed of a pump, the pressure in a pressurized gas tank, the amount of a specific substance to be added to the reaction vessel, the desired pH value in the reaction vessel, and the desired CO2 in the gas tank. 2 Concentration, etc. Control parameters may include target parameter values, i.e., parameter values ​​indicating the state of the machine to be achieved or the state of the product to be manufactured to be achieved. Data used to generate the digital twin may include, for example, continuously updated location information of the machine and / or physical object, digital 2D or 3D models of the corresponding machine in the factory, and may further include data indicating the dynamic behavior of the machine, wherein the dynamic behavior is a function of environmental parameters, control parameters, or other parameters.

[0249] System 100 includes an automation system 102 for automatically operating the machines 140 of a manufacturing plant based on control parameters from a plant machinery database. For example, the automation system may include one or more programmable logic controllers (PLCs) 125 configured to control one or more manufacturing processes performed by the factory's machines 140. A safety interface may be configured to control one or more machines directly or via the PLC / PCS interface 125.

[0250] A PLC can execute a program cyclically. In each cycle, the program reads one or more control parameters from the current measurement parameters provided by the machine and the control parameters stored in the factory machinery database 128 as inputs, processes the inputs, and writes output parameters. The output parameters are forwarded to one or more machines and control the actions performed by those machines. Therefore, these output parameters, along with the control parameters upon which they depend, can act as control commands, as they determine the machine's behavior and thus the manufacturing process. The processors (multiple) in an automation system typically require a time span of tens of milliseconds to evaluate all instructions and update the status of all outputs. For example, the SIMATIC S7 can be used as a PLC in an automation system.

[0251] System 100 further includes system components at the manufacturing operation level (Level 3 in the Purdue model) 104, hereinafter referred to as "L3 components". L3 components perform control functions at a higher level than those in the core process control system (Level 2 in the Purdue model, hereinafter "L2 components") 102. For example, at least some of the control functions performed by L3 components may be machine-agnostic. L3 system components are preferably hosted on one or more monolithic or distributed computer systems 104 operating separately from L2 system components 102.

[0252] System 100 includes a security interface 142, which includes a first submodule 122 as part of the L3-level IT infrastructure of system 100 and a second submodule 124 as part of the L2-level IT infrastructure. These two submodules implement different parts of the request authentication process.

[0253] Security interface 142 is configured to receive requests from one or more clients 106, 107, 108, 110, such as requests for manufacturing a specific product and / or for modifying product manufacturing. Clients can be mobile clients, such as smartphones, laptops, or VR glasses, or fixed clients, such as desktop computer systems or edge computing systems.

[0254] For example, edge computing system 110 may be a computer system located near one or more machines in machine 140 of a factory, but may not be fully integrated into the IT environment of system 110. The edge computing system may be configured to collect log data and / or status data from one or more machines in machine 140 during the ongoing manufacturing process, analyze the data, and automatically determine control parameter values ​​(e.g., temperature, amount of added substances, pH, etc.) deemed suitable for improving the quality of the automated manufacturing process and / or the resulting product. In determining these control parameters, the edge computing system creates and submits a request to forward the control parameters to machine 140 via a secure interface.

[0255] The client computer system 106 can be any type of computer system, such as a desktop computer, laptop computer, tablet computer, notebook computer, or mobile phone.

[0256] Client 108 can be a remote user wearing VR glasses. The remote user can use the VR glasses to monitor one or more machines during the manufacturing process or maintenance intervals. The remote user can use the VR glasses to specify requests including corresponding control commands and submit those requests to a secure interface. Instead of implementing advanced IT equipment (such as VR glasses) into core process control (L2), embodiments of the present invention can allow direct control of such machines to be restricted to the L2 level and provide remote clients with security options for securely transmitting control information to the machines via an access-protected one-way secure interface 142.

[0257] Advanced process control client 107 can be a client that includes advanced process control software to integrate the requirements, needs, and available resources of one or more plants. It can integrate multiple heterogeneous distributed plants. Advanced process control software includes model-based software for guiding process operations and is often referred to as multivariate predictive control (MPC) or model predictive control. These applications require the creation of process models that accurately represent process dynamics.

[0258] The secure interface is configured to receive requests from clients. Preferably, the requests are not received directly from the client, but rather via... Figure 2 The request is received by one or more service interfaces shown in the diagram. The request is verified by the security module. If the security module determines that the request is valid, the security module stores the control parameters included in the request or (for example, during mapping and / or normalization operations) derived from it in the factory machinery database 128. If the request verification returns an invalid request, the control parameters are not stored in the factory machinery database.

[0259] Optionally, the security interface returns a response message to the entity that submitted the request to indicate that the request was not executed. Preferably, the security interface prompts the local operator 146 or the software application to approve the storage of verified control parameters and / or approve machine operations triggered by the control parameters, thereby storing the control parameters only in database 128 if the security interface receives an acceptance message.

[0260] The automation system is configured to repeatedly read control parameters stored in the factory's machinery database and control machine operation based on the currently stored control parameters. A remote operator 108 can continuously monitor at least some aspects of the manufacturing process via VR glasses and a visualization engine 134.

[0261] Figure 2 A system 200 for process automation according to another embodiment is shown. It includes components already referenced... Figure 1 The components and subsystems described.

[0262] According to the depicted example, each submodule 122, 124 of the security interface 142 includes task engines 144, 141. Task engine 144 is configured to process incoming requests by applying a configurable rule set 132. Rule 132 may include rules that are not specific to the characteristics of machine 140 but may involve more general parameters, such as requirements or settings provided by the client (e.g., customer), cost-related reference parameters and thresholds, required product characteristics, reactant availability, environmental parameters (e.g., ambient temperature), etc. For example, the task engine may be implemented using proprietary or open-source solutions such as Node Red or Drools.

[0263] Task engines 144 and 141 can be implemented as event-handling software with a low-code / no-code interface (e.g., GUI 133 and GUI 123), enabling users to create and maintain rules 132 and 137 without programming skills. The rule set representation allows task engines 144 and 141 to inspect inbound requests, particularly checking the reasonableness of the inbound request. Thus, rule 132 can perform machine-agnostic checks, while at least some of rules 137 can perform machine-specific checks, such as checking whether control parameters (e.g., temperature or RPM values) are supported by and safe for the machine to operate according to those control parameters. Rule execution by the task engines can include comparing control parameters included in or derived from the request with reference values, the history of corresponding control parameters previously used by the corresponding machine(s), predefined syntax, or predefined fixed or dynamic value ranges.

[0264] The reference values ​​and thresholds used by the first security interface submodule 120 to verify the request can be stored in and read from the factory environment database 130, and the reference values ​​and thresholds used by the second security interface module 124 can be stored in and read from the factory machinery database 128.

[0265] As a supplement to or alternative to the rules, task engines 144, 141 train machine learning models (e.g., neural networks) to examine control parameters. For example, the trained machine learning model may have been trained on a training dataset that includes at least some of the control parameter values ​​previously used to operate the machine, and may have learned to correlate these control parameter values ​​with information about product characteristics and / or the safety of the manufacturing process.

[0266] According to some examples, submodule 122 of the safety interface includes first functions (F1', F2'), and second submodule 124 includes second functions F1, F2, whereby the structures of the first and second functions (i.e., the number and type of input parameters and the number and type of output parameters) are continuously synchronized between the first and second submodules, such that any changes in the structure of the second functions (F1, F2) in the second submodule 124 are propagated to the first functions F1', F2' in submodule 122. The names and / or structures of the second functions F1, F2 may reflect the names and structures of the corresponding functions of the PLC / PCS interface 125 that directly control one or more machines in machine 140. Client requests may be or include calls to one or more functions. The automatic synchronization function structure offers the following advantages: it makes calls to PLC / PCS interface functions transparent to the client, without granting the client direct and unrestricted access to interface 125, because the client can only trigger function execution after successful authentication and request verification, and because only a subset of functions of PLC / PCS interface 125 can be accessed via functions F1, F2 / F1', F2' of the security interface. Synchronizing the structure of functions F1, F2 of the second submodule 124 with the structure of functions F1', F2' of the first submodule 122 of the security interface 142, or with the corresponding functions of multiple first security interface submodules of multiple different L3-level IT infrastructure systems, allows for the transparent integration of L2-level IT infrastructure into two or more different L3-level IT systems. Therefore, functions F1, F2 can also be used and called by two or more different security interface submodules 122 and the corresponding L3-level IT systems.

[0267] Any requests submitted by remote user 108 or another client for controlling and / or reconfiguring the machine are not submitted directly to secure interface 124, but rather via service interface 120, which may be part of the system's L3-level IT infrastructure. For example, service interface 120 may include web service interfaces tailored to each of several different client types (e.g., edge computing system 110, remote users submitting requests using VR glasses and / or VR applications, or client applications from customers attempting to order and initiate the production of a product). Each of these services can be accessed via a REST API (Representational State Transfer Application Interface). Using a REST API ensures the system's flexibility and scalability. It shields the secure interface from untrusted clients, allows for client authentication procedures, and enforces that requests from only authorized clients be forwarded to the secure interface.

[0268] When the first submodule 122 successfully verifies the request, the first submodule or the task engine included therein can forward the request, or the control parameters included therein or derived therefrom, to the second submodule 124 by calling one of the functions F1 and F2 of the second submodule via the service interface 121.

[0269] According to the example described, both service interfaces 120 and 121 can be implemented as network services using an industry-standard web server, whereby the first function F1' and F2' are exposed via the REST API of interface 120 and the functions F1 and F2 are exposed via the REST API of interface 121.

[0270] The system comprises multiple firewalls 114 and 116, which shield the automation system 103, security interfaces, and other components from unauthorized access. Any attacker intending to modify the factory's machinery database must breach these multiple firewalls. Each firewall acts as a network security system, monitoring and controlling incoming and outgoing network traffic based on predefined security rules. It establishes a barrier between trusted and untrusted networks or subsystems.

[0271] Some embodiments may include a log database, and the security interface 142 may be configured to log all requests and the results of request validation in the log database. This can simplify error analysis and fraud detection. In some examples, the factory environment database 130 is used as the log database.

[0272] According to some examples, a system (e.g., the system's L3 IT infrastructure) may include a visualization engine 134 configured to enable a remote user 108 to submit requests to a secure interface via VR glasses. The visualization engine may support collaboration between the remote user 108 and one or more local operators 146 working in the factory via shared virtual reality (remote user) or augmented reality (local user, not shown). For example, the visualization engine 134 may be operatively coupled to a database 130 that includes data objects as digital twins of objects in the factory (specifically, machine 140). The database may also include objects (specifically avatars) as digital representations of the remote users 108, whereby the coordinate system of these objects in database 130 is continuously updated with the current position of the respective object and the user, wherein the positions of these objects and the user in a shared metaverse coordinate system are continuously mapped to the factory's real-world coordinate system.

[0273] The system may further include an identity provider 135, such as a corporate ID provider like Active Directory, Azure AD, or any LDAP service. Any client can be authenticated by the identity provider 135. Depending on the requesting system, authentication can use personal or functional / machine identities. Service interface 120 can support different authentication workflows for different types of clients. Similarly, corporate authentication standards can be applied to the system and authentication process, such as single-factor or multi-factor authentication, credentials, certificates, etc. The ID provider 135 can be configured to check the client's authorization based on the requesting client's group and group members.

[0274] In some embodiments, the security interface 142 does not directly store the control parameters provided in the verified request in the factory machinery database. Instead, the security interface invokes a database service interface to cause the database service interface to store the control parameters in the factory machinery database. The factory machinery database can be configured to grant write access only to the database service interface and optionally several other trusted entities. This can further enhance security and protect the automated system from unauthorized manipulation.

[0275] If possible Figure 2 It is inferred that system 100 implements a one-way, highly secure communication channel for transmitting control parameters included in requests from clients 108, 106, and 110 to machines in the factory. Before the parameters are ultimately stored in database 128 to make them accessible to the machines, the requests and / or control parameters must successfully pass through multiple firewalls, request verification steps, and preferably additional security checks, such as authentication at service interface 120 via ID provider 135.

[0276] The system (particularly its L3 IT infrastructure) may include a communication module, which includes a key manager module. The communication module may establish an encrypted one-way communication channel between service interface 120 and security interface 142. The communication module may also establish encrypted communication channels between the service interface and a first sub-module of the security interface, and between the first and second sub-modules of the security interface. For example, an encrypted communication channel, as used herein, may mean that only the first sub-module of the security interface is allowed to receive data from and access service interface 120. In some embodiments, the communication module may further include a user registry, user-specific keys, and other user-related data. The user registry may include registered local users, registered remote users, and other clients.

[0277] According to some embodiments, system 100 includes a feedback channel 143, which is separate from the communication channel used to transmit control parameters to a factory machinery database. For example, a first submodule and a second submodule of the safety interface may each include functionality for reporting whether a processed request has been accepted or rejected. Preferably, reasons for rejection (e.g., failure to authenticate, unreasonable control parameters, etc.) and / or machine status information are not communicated to the client.

[0278] According to some embodiments, a first submodule of the security interface and optionally additional components of the system's L3 IT infrastructure, and a second submodule of the security interface and optionally additional components of the IT infrastructure system's L2 level, are instantiated within different virtual machines operated by different virtual machine hosts. The virtual machines can be containers, such as Docker containers operated by different container management systems. This improves the system's security and robustness because the sensitive L2 layer is isolated from and protected from the L3 level, as well as from any untrusted entities that have managed to penetrate the L3 level.

[0279] According to a preferred embodiment, the system is configured to process requests in a predefined sequence of processing steps: the system accepts requests from untrusted sources such as remote clients 106, 107, 108, 110, etc.

[0280] First, the client that has submitted the request must successfully authenticate at service interface 120, for example by providing one or more credentials to ID provider 135, such as a signing certificate, a password shared with the security interface, biometric data, a password, appearance on a whitelist, or a combination thereof. Only when the client is able to authenticate itself as a trusted entity at the ID provider will the service interface forward the request to the security interface, in which case it will be forwarded to the first submodule 122 of security interface 142. According to an embodiment, entity authentication at the service interface includes checking the integrity of the request, for example by means of signature verification, checksum verification, etc.

[0281] A security interface (e.g., security interface submodule 122) verifies a request, for example, by performing various reasonableness and / or security checks on the control parameters included in the request, whereby these checks are preferably based on global rather than machine-specific (machine-agnostic) rules. For example, some rules may analyze whether the control parameters are acceptable given current weather conditions (e.g., ambient temperature or humidity). Request verification may include checking whether the parameter value of a given control parameter is specified with the correct data type (e.g., integer, string, boolean, etc.). Verification may include checking whether the frequency of receiving requests to modify a specific control parameter does not exceed the maximum allowed frequency, for example, to protect the system from denial-of-service attacks. Submodule 122 forwards the control parameters to the automation system-side submodule 124 of security interface 142 only if the verification returns a valid request (that the control parameters are reasonable and safe). Alternatively, the security interface may check whether the combination of the request with a predefined number of previously received requests has modified the specific control parameter to the point that it exceeds the maximum acceptable variation threshold. If the variation is too large, it may indicate that the entity that submitted the request is unfamiliar with the relevant machine, or that multiple users are attempting to guide the manufacturing process in different directions.

[0282] According to some embodiments, the verification of security interface requests also includes checking whether the client that submitted the request has the necessary permission to modify a specific control parameter. For example, if remote user 148 is not permitted to modify the temperature of a specific tank, then the user's request to modify the tank temperature will be considered invalid. Alternatively, the verification request may include a simulation of the future state of one or more machines that will be affected by changes in control parameters. If the simulated future state violates constraints, such as being associated with low-quality products or a production process deemed unsafe, then the request is considered invalid.

[0283] Submodule 124 verifies the forwarded control parameters, for example, by performing various further rationality and / or safety checks, whereby these checks preferably include the execution of machine-specific rules and / or plant-specific rules. Only if the verification return request is valid (the control parameters are rational and safe) does submodule 124 forward the control parameters to a database service interface configured to store the control parameters included in the request in the plant machinery database 128.

[0284] According to an embodiment, request verification performed by the safety interface can be used to determine whether the control parameters specified in the request are reasonable, achievable, acceptable, and safe for the plant and its machines. Verification requires the safety interface to have at least a coarse-grained understanding of the processes performed by the machines during the manufacturing process. For example, if the request specifies a 10°K reduction in the temperature of a reaction vessel, the safety interface must examine how this change affects specific machines and control signals, and whether the temperature reduction would cause any safety parameters to be exceeded.

[0285] According to some embodiments, the safety interface is further configured to perform a mapping of control parameters specified in the request. Specifically, if the safety interface is a distributed safety interface, the control system portion of the safety interface can implement the mapping process. During mapping, the safety interface determines how changes in the specified parameters affect other control signal thresholds and machine settings, which may also be represented and controlled by corresponding control parameters in a plant machinery database. For example, to achieve a 10°K temperature reduction in the tank, it may be necessary to reduce the activity of the heating element and / or increase the activity of the cooling element. It may also be necessary to increase the stirring speed to compensate for the increased viscosity of the fluid contained in the tank. During mapping, one or more additional control parameters are determined, the values ​​of which depend on the value of one of the control parameters specified in the request. Furthermore, the parameter values ​​of additional control parameters (e.g., desired stirring speed, cooling rate, and / or heating intensity) that are expected to be achieved after a change in the value of one control parameter are determined.

[0286] Preferably, additional control parameters identified during the mapping step are further verified, i.e., their feasibility, rationality, and / or safety are checked. If the mapped parameters fail verification, the entire request can be rejected, and the control parameters in the request will not be stored in database 128.

[0287] After the control parameters have been successfully verified and mapped, and the mapped parameters have also been successfully verified, the mapped parameters, together with the control parameters originally included in the request, are passed to the database service interface 126 and ultimately stored in the factory machinery database 128.

[0288] After the mapping step is completed, the control parameters in the request and the additional control parameters identified during the mapping are stored in the factory machinery database.

[0289] According to a preferred embodiment, the security interface is configured to generate an acceptance request after a request has been successfully validated. The acceptance request is configured to prompt a user 146 operating locally at the plant, or software included in the security interface (not shown), to accept a requested change to one or more control parameters stored in a plant machinery database. For example, the acceptance request may be displayed to the local user 146 via a local operating user interface (such as a display included in or coupled to one of the machines 140 at the plant) or otherwise output to the local user 146. An acceptance check may be the final step in request validation performed by the security interface. For example, if the security interface is a distributed interface, the acceptance check may be performed by a security interface submodule 124. The local user / software sends an acceptance message to the security module only if the local user 146 or the software included in the security interface accepts the proposed control parameter setting. The request is considered successfully validated (valid) only if the local user or software accepts the proposed change. Otherwise, the request is considered invalid and the control parameters it contains are not stored. For example, a request from remote user 108 to lower the temperature in a reaction vessel could trigger the creation of an acceptance request, which is displayed to local operator 146 via the reaction vessel's display. The local operator may have a better understanding of the vessel's entire manufacturing process and / or critical status parameters than the remote user. For safety, local operator 146 must confirm the new control parameters, for example, by clicking an "OK" button displayed on screen 125. If the operator does not accept the proposed parameter change, the safety interface will not forward the control parameters to the mechanical database 126. For example, if no acceptance message is received from local operator 146 within a predefined timeout interval, the safety interface can determine that the request is invalid.

[0290] If local user 146 confirms a valid request, the security interface submodule stores the corresponding control parameters in the factory machinery database.

[0291] In other embodiments, the security interface may not be implemented as a multi-module, distributed system, and may be entirely part of L2 or L3 level IT infrastructure (and corresponding virtual machines).

[0292] Figure 3 A block diagram of a system 300 for monitoring a manufacturing plant is shown. This system includes an automation system 103 comprising multiple machines 140 of the manufacturing plant and a plant machinery database 128. The plant machinery database includes control parameters for the machines and spatial and / or status information of physical objects (machines and / or objects processed by the machines).

[0293] The automation system is configured to automatically operate the machines based on control parameters in a factory machinery database. For example, the automation system may include PLC and / or PCS interfaces 125, which enable local operators and / or safety interfaces 142 to operate the machines via these interfaces 142.

[0294] The system further includes an update engine 160. The update engine is software configured to continuously (e.g., at least once per hour, at least once per minute, or at least once per second) receive spatial and / or status information of physical objects from multiple sensors 162 during the ongoing manufacturing process and update the mechanical database 128 with the received information. For example, sensors may include temperature sensors, humidity sensors, pH meters, and internal mechanical sensors configured to determine the operating state or mode of the machine (e.g., the rotational speed of a centrifuge or agitator, the speed of a conveyor belt, the opening and closing status of doors and other openings, etc.).

[0295] The system further includes a visualization database 130, which comprises a subset of data from a factory machinery database.

[0296] System 300 further includes a copy module 150. The copy module is software configured to continuously (e.g., at least once per hour, or at least once per minute, or at least once per second) select data that enables the generation of digital visual representations of one or more physical objects based on data from a factory machinery database (thereby selecting data without control parameters), and copy only the selected data to the visualization database. Therefore, the copy module can be considered as filtering the data content of the factory machinery database such that only a selected subset of the data is copied to the visualization database 130. For example, the visualization database may include 2D or 3D models of machines and / or objects processed by machines. The models may be static or dynamic models, which can be used to visualize the state of the machines or the state of a manufacturing workflow. Additionally, the visualization database may include spatial information about the objects, such as the current orientation of robots and other machines or machine parts, the location of reactants or products within the production line, etc. Preferably, the spatial information does not include information that would allow identification of the exact geographical location of the corresponding physical object. The 2D or 3D models of at least some of these machines are not drawn to scale and / or are coarse-grained abstractions of these machines. This allows for the protection of skills and other sensitive information related to the structural design of a machine, such as the total / maximum production capacity of a plant, machine, or production line.

[0297] The system further compresses the visualization engine 134. This visualization engine is a software program (e.g., a monolithic software application) or a set of interoperable software programs configured to generate digital visual representations of one or more physical objects based on data in a visualization database. Preferably, the visualization engine does not access the factory machinery database, but instead uses a subset of data copied to the visualization database by the replication module as the basis for generating visual representations of one or more physical objects involved in the factory's manufacturing process (particularly the machines involved in the process and / or objects processed by the machines).

[0298] In some examples, replication module 150 can use a streaming protocol to continuously stream database updates from factory machinery database 128 to visualization database 130. For example, Apache Kafka can be used to create a continuous stream of measurements stored in the factory machinery database and pass it to the visualization database. The measured parameter values ​​can indicate the orientation or status of one or more machines in the machine and / or are the result of previously executed control commands that requested new configuration data. By streaming the measured parameter values ​​to the visualization database, the visualization engine can access these measured parameter values.

[0299] The visualization engine is interoperable with one or more client software programs running on corresponding client devices, including display devices 154 and 108. The client software receives visual representations of physical objects from the visualization engine and causes the corresponding display devices to display these representations to the user. This allows the user to monitor the manufacturing process without disclosing sensitive control parameters or other sensitive data and knowledge.

[0300] For example, client software that interacts with the visualization engine can be software configured to display visual representations on a 2D screen (such as the screen of a smartphone, laptop, or desktop computer). This allows remote users to monitor production processes via standard equipment without requiring users to use specialized equipment such as VR glasses.

[0301] According to another example, the client software that interoperates with the visualization engine can be VR software (virtual reality software) that is configured to display a visual representation via the user's VR glasses, thereby giving the user an immersive impression of being in the vicinity of the physical object represented by the visual representation, even though the user may be far away from the factory.

[0302] According to another example, the client software interoperating with the visualization engine can be AR (Augmented Reality) software configured to display visual representations via AR glasses worn by a local user 146 operating in the factory, thereby providing the user with additional information that can be used to operate or maintain the machines in the factory. For example, system 300 may further include a security interface 142 configured to receive and verify requests from remote clients 106, 107, 108 for operating one or more of the machines. The security interface may be configured to prompt the local user 146 to accept the requested operation via a visual object generated by the visualization engine and displayed via the local user's AR glasses. For example, the visual object may be a menu describing the requested action and / or the identity or role of the requesting user, whereby the menu includes one or more optional items, such as buttons, allowing the local user to accept or reject the requested operation. Alternatively or concurrently, the visualization engine interoperating with the AR software may allow the AR glasses to display menus, text, video, or other types of data related to the machines or manufacturing processes. For example, the data may include text or video instructions on how to operate or maintain the machines, may include a GUI that allows the local user to locally input configuration data, or may include alarms or error messages.

[0303] The remote user wearing VR glasses for remotely monitoring the manufacturing process can be the user who has already submitted the request. However, the request may also have been submitted by another remote user or remote client software, and the user 108 wearing the VR glasses may only monitor that process.

[0304] According to an embodiment, the visualization database 130 includes two or more different user role-specific models for at least one of the machines. The visualization engine is configured to identify the role of a remote user wearing VR glasses, identify one of the models assigned to that role, and use the identified model to generate a visual representation of the machine. The different models may differ from each other in the degree of structural detail or state information exposed in the models. This allows for flexible and fine-grained control over the level of detail that the remote user can see.

[0305] The safety interface 142 and its interoperability with the client, PLC / PCS interface 125, and machine 140 can be implemented as described herein with respect to other embodiments and examples. However, the safety interface is optional, and the factory machinery database 128, visualization database 130, visualization engine 134, update engine 160, and replication module 150 can also be used in a computer system that does not include these optional components for monitoring and / or operating the manufacturing process. Using the database replication mechanism as described herein in conjunction with the safety interface can have the advantage of providing a highly secure system for remote monitoring and control of automated manufacturing processes: there is only a one-way communication channel for transferring control parameters from the remote client to the machine, and another one-way path for providing visual feedback to the remote user. This ensures that the remote user cannot access or see sensitive control parameters or knowledge, as he or she can only see a predefined and typically simplified visual representation of a digital twin of a real-world object.

[0306] Figure 4A Example 400 of GUI 144 is shown, which enables user 146 (e.g., a local user) to monitor and / or control the status of the manufacturing process. Because status information may reveal sensitive data about the manufacturing process, GUI 400 can only be accessed from within the automation system / plant and not by remote users.

[0307] In the example shown, a remote user or edge computing system may have requested that the "target bulk density" control parameter 402 be set to a value of 115,000 g / L. During the mapping operation performed by the security interface, the security interface may have calculated additional control parameter values ​​for temperature parameter 408 and pressure parameter 406. For example, the manufacturing process may be chemical synthesis, and the security interface may include a predictive model configured to predict temperature and pressure values ​​that may provide (at least close to) the desired bulk density. The predicted bulk density 404 of the corresponding reaction vessel, along with the predicted temperature and pressure, can be calculated during the parameter mapping step and transmitted via the security interface to a database service interface and stored in the plant machinery database. One or more machines in the plant's 140 (e.g., a local computer) may be configured to read the parameters from the plant machinery database and generate a GUI displaying the parameter values ​​(the target bulk density specified by the requesting entity and the bulk density, temperature, and pressure predicted by the service interface).

[0308] Local users can choose whether machine parameters, pressure, and temperature should be set manually or automatically to achieve a given target bulk density of the material to be produced by the manufacturing plant. When machine control values ​​are set as follows... Figure 4AIn the "automatic mode" shown, control parameters predicted by the safety interface are automatically set and used as the basis for controlling the synthesis process and process conditions. Prediction is preferably performed at the L2 level of the safety interface. Therefore, automatically calculated parameter values ​​(e.g., 8.48 bar and 37°C) are automatically set and can be continuously updated during the ongoing manufacturing process.

[0309] According to some embodiments, the local operator 146 must select either "automatic mode" or "manual mode" at least once to begin the synthesis process. By selecting "automatic mode," the local operator sends an acceptance message to the safety interface, indicating that the local operator considers the specified control parameters (particularly temperature and pressure) to be safe and appropriate.

[0310] Figure 4B Another example 410 of a GUI 144 is shown, enabling local users to monitor and / or control the manufacturing process. (The example corresponds to...) Figure 4A In GUI 410 of the illustrated GUI 400, the machine control values ​​have been set to "Manual" by the local user. Therefore, the local user can edit the values ​​calculated by the safety interface, thereby overriding any control parameters deemed unsafe, unfeasible, or otherwise problematic.

[0311] Figure 5 A distributed system 500 for controlling manufacturing processes in multiple factories is shown.

[0312] A user 108, who may work at factory A and is therefore far from factory B, can wear VR glasses. Through the VR glasses, user 108 can see video and / or images captured by cameras placed in factory B. For example, the cameras can be attached to a mobile robot 510, the movement and / or position of which can be controlled by a remote operator 108. Thus, the remote operator sees through their VR glasses what the robot 510 sees as it moves through factory B. The image and / or video data can be transmitted via, for example... Figure 3The database replication module and visualization engine shown are transmitted from robot 510 to a remote user. At least some of the machines or physical objects processed by the machines are graphically presented to the remote user as part of a "virtual reality" via VR glasses in the form of visual digital twins. When a user attempts to monitor the operation of one of the machines 140 in the factory (e.g., wants to turn robot 510 left), user 108 can simply turn their body to the left. Sensors in the VR glasses will recognize the change in position and / or orientation and send a left-turn command in the form of a request for the new position and orientation and / or a request to control the robot to turn left, causing the robot to turn left. Requests for moving the robot are passed to the robot via security interface 142 as described herein with respect to embodiments and examples. For example, forwarding a request from L3 to L2 may involve authenticating remote user 108, verifying the request, mapping control parameters, verifying the mapped control parameters, and storing the new position or movement specification in database 128. Robot 510 and other machines 140 are configured to repeatedly read control parameters from database 128 and adjust their position and / or actions performed accordingly.

[0313] The current position and / or orientation of one or more of the machines 140, including the robot, can be continuously sensed and stored in the factory machinery database 128, and the acquired position data can be used to continuously update the database 128. At least some of the data indicating the robot's position and / or orientation is copied to the factory environment database 130, which serves as the data basis for a visualization engine to generate continuously updated visual representations of the robot and / or other machines 140 in the factory and display them to remote users.

[0314] In some embodiments as depicted, the visualization engine 134 may be configured to create an avatar 505 as a virtual representation (or "twin") of a remote user 108. The avatar may be displayed to one or more local operators 146 operating at factory B and wearing AR glasses. Thus, a local operator 504 sees the digital twin of the remote user through his or her AR glasses.

[0315] User 146 can wear AR glasses, meaning that user 146 can still see the real machines 140 in factory B. However, some virtual objects, including avatar 505, are displayed in the AR glasses as an overlay of the "real world" still visible through the AR glasses. Therefore, user 146 has the realistic impression that remote user 108 is actually present in the location of factory B because he sees the avatar moving and / or hears the avatar speaking through the AR glasses. The impression of the avatar and other virtual objects through user 146's AR glasses can be generated by augmented reality application 504 locally installed in the IT infrastructure of factory B. In addition, the IT infrastructure of factory B can include virtual reality application 506, which is configured to interoperate with virtual reality application 524 locally installed in the IT infrastructure of other factories (e.g., factory A) via visualization engine 134. Operators from different factories can share a common virtual reality, which can be useful for users operating in different countries who want to discuss manufacturing-related issues without meeting in person.

[0316] The visualization engine can be configured to align virtual objects (such as avatars, virtual user menus, instruction manuals, or videos) with both the virtual reality coordinate system and the "real world" coordinate system. The visualization engine has access to the global object representation layer, so any virtual object (such as a machine's instruction manual) can be seen by all users wearing VR or AR glasses and registered with the visualization engine.

[0317] Remote user 108 can remotely control not only some manufacturing tasks at factory B, but also some manufacturing tasks at factory A. For example, user 108 may typically be a local operator at factory A, but may wish to remotely control tasks from home. In this case, user 108 is also a remote user of the system used to control manufacturing at factory A.

[0318] User 108 can remotely control one or more machines 526, 528, 530, 532 and / or 534 via security interface submodules 542, 544 as already shown in other figures (e.g. Figure 1 , Figure 2 and / or Figure 3 Implement it as described. Service interfaces 540 and 120 can be based on REST APIs, can involve streaming applications such as Apache Kafka, and can use MQTT or WebSocket protocols to forward requests.

[0319] At Level 3, security interface submodules 542 and 122 include or can access rules and / or object representations that are typically machine-agnostic and relate to objects at the manufacturing site, cluster, or plant level. These rules and object representations can be used to validate Level 3 requests.

[0320] At the L2 level (automation system level), security interface submodules 544 and 124 include or have access to rules and / or object representations related to objects at the plant, production line, or machine level. These rules and object representations can be used to validate requests from the automation system / L2 layer.

[0321] Embodiments of the present invention enable a remote user 108 to control machines in multiple factories without posing a security risk to the factories.

[0322] Figure 6 System 600 was demonstrated, configured to display various virtual objects in a location-dependent manner to a user wearing AR glasses and having an "operator" role. For example, an operator can wear AR glasses and view real physical objects, such as machines in a factory or objects being processed by machines. Task instructions A1-A6 are displayed via the AR glasses at predefined x / y / z coordinates in an augmented reality coordinate system aligned with the real-world coordinate system. For example, the AR glasses can use the x / y coordinates of a machine (such as a dispensing unit, transport and heating unit, or packaging unit) to display a corresponding instruction manual or video at a predefined distance relative to the real-world location of the real-world object.

[0323] For example, a user wearing glasses may have a registered user account in the user database of the visualization engine and / or ID provider 135, and his or her user ID may be associated with one or more user roles (in this case, the "operator" role). Alternatively or additionally, each user role may optionally include one or more user permissions.

[0324] Therefore, the visualization engine is configured to select the content of the received data to be displayed based on one or more user roles and / or one or more user permissions associated with a user ID (e.g., "filtering" the content of received task instructions). For example, by way of a non-limiting exemplary embodiment only, one or more user roles include operator roles, maintenance roles, engineering roles, management roles, and visitor roles. One or more user permissions and / or roles restrict and determine which virtual objects / information will be displayed through the AR glasses. For example, the user permissions for the engineering role can define which machines in the factory a user associated with a user ID who has the engineer role can access, specifically, by displaying the corresponding task instructions to view data corresponding to those machines. A user associated with a user ID can have more than one role and more than one user permission.

[0325] exist Figure 6In the illustrated example, the user wearing the AR glasses has been assigned the role of "operator." Therefore, the executable program logic causes the AR glasses to display view 600, in which the user sees instruction manual A1 on how to clean the filter when approaching the dispensing unit, and can further see additional task instructions and corresponding instruction videos A2 and A3. When the user approaches the transport and heating unit, he or she will see task instruction A7 via the AR glasses. Similarly, when approaching the packaging machine, he or she will see task instructions A4-A6. Tasks A1-A7 pertain to standard tasks that must be performed under normal operating conditions in an industrial plant.

[0326] Figure 7 System 700 was demonstrated, configured to display various virtual objects in a location-dependent manner to a user already assigned the role of a "maintenance worker." When the maintenance worker wears the AR glasses and views the actual machine, he or she will see maintenance-related task instructions rather than operational tasks. For example, when the user approaches the dispensing unit, they will see task instruction B1 for replacing a defective pressure sensor 1234, and / or when approaching the transport and heating unit, they will see instruction B2 on how to inspect the heater.

[0327] Figure 8 The system 800, which utilizes spatial anchors, is shown as a remote user 108 in the factory to be controlled.

[0328] Remote human operator 108 may be an expert for maintaining one or more machines (e.g., complex machine 808) in a plant. Both the machine and local operator 146 are located at industrial plant B in country B. Remote user 108 is located in a different location, such as plant A in country A. Remote user 108 wears VR glasses operatively coupled to virtual reality application 524 (“VR application”). VR application is interoperable with AR application 504 operatively coupled to AR glasses worn by local operator 146. VR application 524 and AR application 504 may be interconnected via a visualization engine configured to spatially align virtual objects in virtual reality and virtual objects in augmented reality. AR application enables remote user to support local colleague 146 in performing various operational and / or maintenance tasks performed on or locally at machine 808. AR application is configured for remote user to create avatars 505 and position the avatars at defined locations, such as proximity to machine 808 requiring user 108's support.

[0329] According to a preferred embodiment, VR application 524 is configured to generate virtual reality for remote user 108, enabling the remote user to see local user 146 and / or other real-world objects in the industrial plant (e.g., machine 808), as if they were perceived from the perspective of avatar 505. For example, the remote user can see live views of the production line and machines through a robot equipped with cameras and / or additional sensors positioned and oriented in the same location and orientation as their avatar 505. For example, the robot could be a reference... Figure 5 Robot 510 is described. In some examples, factories A and B and their corresponding IT infrastructure can be referenced as follows. Figure 5 Operate as described.

[0330] In some embodiments, the robot is remotely controlled by a remote user 108, enabling the remote user to perform defined operations by the robot. The avatar has a defined position in a 3D environment generated by the AR application 504 and displayed to a local user 146 via AR glasses. Furthermore, the local human user 146 (AR user) and the machine 808 have defined positions within the 3D environment, which serves as a coordinate system for augmented reality (“mixed reality”).

[0331] The AR application 504, which interoperates with the visualization engine, is configured to ensure that the VR coordinate system seen by the remote user and the AR coordinate system seen by the local user 146 via AR glasses have the same coordinate system as the basis for locating virtual objects (avatars, holograms, GUIs, etc.). Both the AR application 504 and the VR application 524 receive positional information of the virtual objects to be displayed in the augmented / virtual reality from the same global object representation layer 503. According to some embodiments, the VR application 524 of the remote user 108 generates a virtual reality (“manufacturing metaverse”) in which the avatar of the local human operator 146 is shown in a defined optical representation (e.g., name only, or even a 3D avatar shape), allowing the remote user to see the local user (not shown) within the VR application. Conversely, the local user (AR user) 146 can see the avatar 505 of the remote user 108 within the “manufacturing metaverse,” which is presented to the local user 146 as a hologram (e.g., name only or a 3D avatar shape) via AR glasses 804 in augmented reality.

[0332] According to an embodiment, AR glasses 804 include a microphone 810 and an audio output interface 812, such as a speaker providing a user interface to a local user. Similarly, VR application 524 may include a user interface containing a microphone and an audio output interface to enable remote user 108 to interact with the VR application. AR application 504, operatively coupled to the AR glasses of a local user, interoperates with the VR application, enabling remote user 108 and local user 146 to converse with each other. Preferably, the AR application uses position information of the avatars of the local and remote users in a shared coordinate system to control the volume of the audio output interface of the AR glasses: the closer the local user 146 is to the avatar 505, the louder the volume. Similarly, the sensitivity of the microphone can be adapted based on the distance between the two users in the shared coordinate system: the greater the distance, the lower the microphone sensitivity.

[0333] Therefore, the AR system according to the depicted embodiment, including AR and VR applications, allows two users to collaborate using a shared coordinate system (also known as the "manufacturing metaverse"). The manufacturing metaverse consists of a virtual coordinate system shared by all users and AR objects within the metaverse, whereby the virtual coordinate system is mapped onto and overlaid with real-world objects 808 of the industrial plant. This enables experienced remote users to experience the same or similar visual contexts as guided local users.

[0334] In the first scenario, thermoplastic polyurethane (TPU) production is underway at plant B. The production line has been modified to accommodate a new product that has never been produced on the line before. A remote operator, an expert in this production, resides at location A (country A, plant A). The remote operator will guide the local operator on when and which valves should be inspected. The remote operator will also inform the local operator of important matters requiring attention to ensure normal and smooth production. Furthermore, the remote operator can guide the local operator through the appropriate operating procedures at the right time and under the right circumstances.

[0335] In the second scenario, TPU production is already underway at location B. During the night shift, the night shift coordinator falls ill. An experienced human operator at a remote location A (country A, factory A, other time zone) can support production at location B during the day. He will use his avatar to collaborate directly with one or more local human operators. The remote user can coordinate the work of local workers by creating processes / tasks that can be executed by the local user (AR user).

[0336] According to the third scenario, autonomous TPU production is underway at factory B. Under normal / standard conditions, the production line can operate fully autonomously. Manual operation is only required in the event of unforeseen circumstances. This supervision will be conducted remotely via a VR application through the manufacturing metaverse. A remote human operator coordinates and triggers one or more robots by creating / using the correct processes / tasks for (multiple) robots. When the remote human operator needs to see realistic images and / or video streams of the local situation, the remote user can move to the machine of interest via the VR application and an AR application associated with the robot's control program. The robot is equipped with a camera and is controlled to adopt the same position and orientation as the remote user's avatar. When the robot reaches that position, its camera captures images and / or videos of the machine in front of the avatar / robot and transmits the images or videos to the VR application. The remote user will see the images and / or videos via virtual reality created by the VR application. When the robot is controlled to capture images and / or videos in the industrial plant from the same position and orientation as the remote user's avatar in a mixed reality coordinate system, the photos and images will be displayed from the same perspective that the local human operator has at that position and orientation, showing the machine of interest.

[0337] Embodiments of the present invention can be applied to many other scenarios and industries. For example, embodiments of the present invention can be used in the automotive manufacturing industry, and allow experienced engineers to support colleagues working in other locations within the automotive manufacturing company.

[0338] Similarly, systems used for automated production control and / or for graphically representing ongoing manufacturing processes via VR glasses, AR glasses, or other display types using visualization engines can be used in the chemical industry or any other type of industry that processes physical objects to manufacture one or more products.

[0339] In some use cases, robots are used not only to acquire images or videos, but also to solve problems under the control of a remote user. For example, robots can be used to perform maintenance tasks in locations that are dangerous to human operators, such as in the context of chemical synthesis involving toxic chemicals, or in environments contaminated or at risk of contamination by radioactive materials or toxic chemicals.

[0340] According to some embodiments, spatial anchors are used to position and orient virtual objects relative to a defined location and orientation relative to a real-world object (such as machine 808). For example, it might be desirable to display a GUI hologram that allows a user to monitor and control machine 808 from a distance of approximately 40 cm in front of the machine.

[0341] To ensure that local user 146 always sees the GUI hologram at the defined location in augmented reality regardless of user 108's current location, the AR application generates and displays the GUI hologram at a spatial anchor point or at a defined distance relative to the spatial anchor point. According to some embodiments, the spatial anchor points (i.e., at least anchor point IDs and anchor point coordinates) are stored in a database system, making them accessible to VR application 524. The VR application is configured to read the stored spatial anchor points and generate and display the same virtual object (e.g., the GUI hologram of machine 708) at the spatial anchor point or at the defined distance relative to the spatial anchor point.

[0342] According to some embodiments, spatial anchors are defined and created by placing machine-readable codes (e.g., QR codes 811, 813, 814) at various locations within an industrial plant. The AR glasses may include a camera that acquires a digital image of the machine-readable code, extracts the anchor ID encoded therein, creates anchors with the coordinates of the machine-readable code in a real-world coordinate system, and stores these anchors in a database system. Alternatively, user 146 can create spatial anchors by performing an anchor-creation gesture at a desired location in the real world. This gesture is captured by the AR glasses' camera, and the visualization engine creates and stores spatial anchors in a similar manner. Anchor IDs can be automatically created when spatial anchors are created.

[0343] Figure 9 A coordinate system 900 is shown, which can be used by a visualization engine and VR application 524 to represent real-world objects and local user avatars to a remote operator 108 in a virtual metaverse. VR application 524 generates virtual representations 908 of real-world machines 808 in an industrial plant and displays these virtual representations to the remote user 108 via virtual reality display technology. This virtual reality coordinate system 900 can further include virtual representations 904 (e.g., avatars) of the local user 146 operating spatially adjacent to the real-world object 808. The distance between the virtual representation 908 of machine 808 and the virtual representation 904 of local user 146 within coordinate system 900 corresponds to and reflects the actual distance to the real-world objects. Coordinate system 900 can include a spatial grid aligned with "real-world" objects (such as machine 808 and local user 146 in the industrial plant). The grid can also be aligned with the corresponding virtual representations 908, 904 (digital twins) of the real-world objects. Additionally, remote user 108 can be represented as a virtual entity in coordinate system 900, such as avatar 505 that can be seen by local user 146 via AR glasses 804. Figure 9The coordinate system shared by the virtual reality generated by the VR application and the AR reality generated by the AR application is shown, but preferably, the remote user 108 sees the virtual objects representing real objects and other users in the coordinate system 900 from the perspective (position and orientation) of his avatar 505.

[0344] Figure 10 A flowchart illustrating a method for automating processes in a manufacturing plant is provided. The method includes providing 602 systems 100, 200, 300, and 500 for process automation in a manufacturing plant as described herein with respect to various exemplary embodiments. The system may include: a plurality of machines 140 and 536 in the manufacturing plant; a factory machinery database 128 and 548 including control parameters for the machines; an automation system 103 for automatically operating the machines in the manufacturing plant based on the control parameters in the factory machinery database; and a security interface 142. The method further includes receiving 604 a request from a client via a network and verifying 604 the request by the security interface. If the security interface determines the request is valid, the security interface stores 608 control parameters 402 to 408, included in or derived from the request, in the factory machinery database. The automation system automatically operates 610 the machines based on the stored control parameters included in or derived from the valid request. If the security interface determines the request is invalid, the security interface returns 612 a message to the client via a feedback channel that the request was not executed.

[0345] This document further discloses a system and method for monitoring a manufacturing plant, as described in the following clauses:

[0346] List of reference numerals

[0347] 100 Systems for Process Automation

[0348] 102 Automation System (L2)

[0349] 103 Automation System

[0350] 104 Control System (L3)

[0351] 106 Client: Computer System

[0352] 107 Client: Advanced Process Control Software

[0353] 108 Client: Remote users with VR glasses

[0354] 110 Client: Edge Computing System

[0355] 114 Firewall

[0356] 116 Firewall

[0357] 120 service interface

[0358] 121 Service Interface

[0359] 122 Security Interface Submodule

[0360] Configuration GUI for Rule 123 and Rule 137

[0361] 124 Security Interface Submodule

[0362] 125 PLC / PCS interface for the machine

[0363] 128 Factory Machinery Database

[0364] 130 Factory Environmental Database

[0365] Rule 132

[0366] GUI configuration for rule 133 and rule 132

[0367] 134 Visualization Engine

[0368] Rule 137

[0369] 135ID Provider

[0370] Manufacturing assets of 140 entities (such as plants, production lines or units, machines, and equipment).

[0371] 141 Task Engine

[0372] 142 security interface

[0373] 143 Feedback Channel

[0374] 144 Task Engine

[0375] 146 local users

[0376] 150 Copy Module

[0377] 154 2D / 3D representations of physical objects / machines

[0378] 200 Systems for Process Automation

[0379] 202 Administrator

[0380] 214 Local Operators

[0381] 400GUI

[0382] 402 Control Parameter "Target Bulk Density"

[0383] 404 Calculation of other control parameters

[0384] 406 Calculation of other control parameters

[0385] 408 calculates other control parameters

[0386] 410GUI

[0387] 500 system

[0388] 501L3 IT Infrastructure System

[0389] 502 Global Object Presentation Layer

[0390] 503L2 IT Infrastructure System

[0391] Local AR application of Factory B, 504

[0392] 505 Incarnation

[0393] Local VR application in Factory B, 506

[0394] Local network applications in Factory B, 508

[0395] 510 Robots controlled by remote users

[0396] 512-518 Machines / Equipment

[0397] Local network applications of Factory A, 520

[0398] Local AR application in Factory A, 522

[0399] Local VR application of Factory A, 524

[0400] 540 service interface

[0401] 542 Security Interface Submodule

[0402] 544 Security Interface Submodule

[0403] 546 Database Service Interface

[0404] 548 Configure Database

[0405] 526 Robot

[0406] 528-534 Machines / Equipment

[0407] 552L2 IT Infrastructure System

[0408] 554L3 IT Infrastructure System

[0409] 600 system

[0410] Steps 602-612

[0411] 700 system

[0412] 800 system

[0413] 804AR Glasses

[0414] 808 Machines / Equipment

[0415] 810 microphone

[0416] 811QR code

[0417] 812 audio output interface

[0418] 813QR code

[0419] 814QR code

[0420] 900 coordinate system

[0421] 908 machine 808 digital twin

[0422] 904 users' digital twins

Claims

1. A system (300) for monitoring a manufacturing plant, comprising: - Multiple machines (140) in the manufacturing plant. - Factory machinery database (128,548), which includes control parameters for these machines and spatial and / or status information of physical objects that are these machines and / or objects processed by these machines; - An automation system (103) is used to automatically operate these machines according to these control parameters in the factory's machinery database; - An update engine (160) is configured to continuously receive spatial and / or status information of these physical objects from multiple sensors (162) during the ongoing manufacturing process and update the plant machinery database with the received information; - A visualization database (130) comprising a subset of the data in the factory machinery database; - Copy module (150), which is configured to continuously select data in the factory machinery database that enables the generation of digital visual representations of one or more physical objects, wherein the selected data does not contain these control parameters, and is configured to copy only the selected data to the visualization database; - A visualization engine (134) (a software program or a set of interoperable software programs) configured to generate a digital visual representation of the one or more physical objects based on data in the visualization database; - Display device (154, 108) configured to display a visual representation of the one or more physical objects to a user so that the user can monitor the manufacturing process.

2. The system as described in Clause 1 further includes a security interface (142) configured to: - Receive requests from clients for control of one or more of these machines; - Verify the request; - In response to determining that the request is valid, the control parameters included in or derived from the request are stored in the factory's machinery database; -The automation system is configured to operate these machines according to stored control parameters included in or derived from the valid request.

3. The system as described in any of the foregoing clauses, -in, At least one of these machines is a robot, and the request is a robot control request for remote control of the robot by a remote user. -The visualization engine is configured to generate a metaverse that includes the robot's digital twin. -The automation system is configured to control the movement of the robot according to robot control commands, such that the orientation and / or movement of the robot reflects the orientation and / or movement of the remote user.

4. The system as described in Clause 3, wherein, The visualization engine is configured to generate a digital visual representation of the one or more physical objects, enabling the remote user to see other machines in the factory from the perspective of a robot that acts as the remote user's physical representation in the factory, and wherein the display device is VR glasses worn by the remote user who has submitted the robot control request.

5. The system as described in any of the preceding clauses, further comprising an ID provider computer system (135) configured to authenticate the client that has submitted the request, wherein, The safety interface is configured to not store these control parameters in the factory's machinery database in response to determining that the authentication has failed, and to disallow the user from controlling the robot, for example, moving and rotating it.

6. The system as described in any of the preceding clauses, wherein, The automation system and the factory machinery database are implemented at the process control level (L2), and the visualization engine is implemented at the operation control level (L3).

7. The system as described in combination of Clause 6 and Clause 2, wherein, This safety interface is the only interface that allows control parameters to be communicated from L3 level system components to L2 level system components.

8. The system as described in any one of Clauses 2 to 7, wherein, The verification of the request includes performing a reasonableness check, which includes determining whether the control parameters included in or derived from the request are safe for the machines and human operators, wherein if at least one of the control parameters is determined to be unreasonable, the request is considered invalid.

9. The system as described in any one of Clauses 2 to 8, wherein, The safety interface is configured to map the control parameters included in or derived from the request to additional control parameters included in the factory machinery database to extend these control parameters. The safety interface is also configured to perform a reasonableness check on these additional control parameters, which includes determining whether these additional control parameters are safe for the machines and human operators. Furthermore, if at least one of these additional control parameters is determined to be unsafe (and therefore unreasonable), the request is considered invalid.

10. The system as described in any one of Clauses 2 to 9, wherein the security interface further includes a feedback channel configured to notify the client that has submitted the request whether the request is accepted and processed or rejected, thereby making the subset of data in the visualization database used by the visualization engine to generate digital visual representations of these physical objects the sole data communication link for the remote client to receive status data of the machines and / or physical objects of the plant.

11. The system as described in any of the preceding clauses further includes a user registry, which includes user accounts and the assignment of predefined user roles, wherein, The visualization engine is configured to identify the role assigned to the user to whom the visual representation is to be displayed, and to generate these visual representations based on the user's identity and / or the role assigned to the user.

12. The system as described in Clause 11, wherein, The display device is VR or AR glasses worn by the user, and the visualization database includes multiple different 2D or 3D models of at least one of these machines, each assigned to a different user role. The visualization engine is configured to identify a model of the user role assigned to the user wearing the display device from among these 2D or 3D models, and to use the identified 2D or 3D model to generate a visual representation of the at least one machine displayed via the display device.

13. The system as described in any of the preceding clauses, wherein the display device is selected from the group consisting of: computer monitors, displays of mobile communication devices, VR glasses, or AR glasses.

14. A computer-implemented method for monitoring a manufacturing plant, comprising: - Provides a system (300) for monitoring a manufacturing plant, the system comprising: ○ Multiple machines (140) in the manufacturing plant. ○ Factory machinery database (128, 548), which includes the control parameters of these machines and the spatial and / or status information of physical objects that are these machines and / or objects processed by these machines; ○Automation system (103), which is used to automatically operate these machines according to these control parameters in the factory's machinery database; ○Update engine (160); ○ A visualization database (130) comprising a subset of the data in the factory machinery database; ○ Copy module (150); ○ Visualization engine (134); and ○ Display devices; - The update engine continuously receives spatial and / or status information of these physical objects from multiple sensors (162) during the ongoing manufacturing process and uses the received information to update the factory's machinery database; - The copy module continuously selects data from the factory machinery database that enables the generation of digital visual representations of one or more physical objects, whereby the selected data does not contain these control parameters, and only the selected data is copied to the visualization database; - The visualization engine (134) generates a digital visual representation of the one or more physical objects based on the data in the visualization database; - A visual representation of the one or more physical objects is displayed to the user via the display device (154, 108) so that the user can monitor the manufacturing process.

Images