Fisher-Rosemount Systems, Inc

Sean Hernandez

Narayanan Doraiswamy

Antonio Ubach

Sireesha Dakoju

Krishna Joshi

Matthew Villarrubia

Mark J Nixon

Aaron C Jones

Brian Lamothe

An enterprise engineering and configuration system includes a common configuration database and support services stored in and executed in a compute fabric of an enterprise. The configuration database and support services use and implement a common configuration data schema to support the configuration of hardware and software in the compute fabric and at multiple different sites or physical locations of the enterprise even when different control and automation systems are used at these different sites or physical locations. The configuration system enables implementing hardware or software configuration changes to various different sites or locations of an enterprise either centrally from a configuration device connected directly to the compute fabric of the enterprise or locally from any physical location or site of the enterprise, while maintaining a single integrated enterprise configuration database that stores configuration data for each of the multiple sites of the enterprise. This configuration system is flexible as it enables engineering and configuration changes to be made by users anywhere in the enterprise for any of the sites of the enterprise and across different sites of the enterprise.

Enterprise engineering and configuration framework for advanced process control and monitoring systems

An architecture supporting a process control or automation system may include an authentication service which determines whether an entity (e.g., a human, automated, virtual, or physical entity) is the party that/who the entity claims to be, and an authorization service which determines whether a request of the entity to access a resource is allowed or denied. The authentication service provides unique identities of entities and respective security credentials, which may include tokens utilized during authorization. The authorization service authorizes an entity to access a requested resource based on role-based permissions of a role to which the entity is assigned and resource access permissions protecting the requested resource. The role-based permissions and/or the resource access permissions may be respectively scoped to limit or restrict actions, activities, operations, and/or resource access based on specified criteria. Each entity may be authenticated, and each request of an authenticated entity may be respectively authorized.

Authentication/authorization framework for a process control or automation system

A process plant and industrial control system architecture includes a generalized compute fabric that is agnostic or indifferent to the physical location at which the compute fabric is implemented, includes one or more physical control or field devices located at one or more specific sites at which a product or process is being manufactured and further includes a transport network that securely provides communications between the compute fabric and the pool of physical devices. The compute fabric includes an application layer that includes configured containers or containerized software modules that perform various control, monitoring and configuration activities with respect to one or more devices, control strategies and control loops, sites, plants, or facilities at which control is performed, and includes a physical layer including computer processing and data storage equipment that can be located at any desired location, including at or near a site, plant, or facility at which control is being performed, at a dedicated location away from the location at which control is being performed, in re-assignable computer equipment provided in the cloud, or any combination thereof. This control architecture enables significant amounts of both computer processing and IT infrastructure that is used to support a process plant, an industrial control facility or other automation facility to be implemented in a shared, in an offsite and/or in a virtualized manner that alleviates many of the communications and security issues present in current process and industrial control systems that attempt to implement control with shared or virtualized computing resources set up according to the well-known Purdue model. The industrial control system architecture is protected via more secure and customizable techniques as compared to those used in Purdue model-based control systems. For example, communications between any (and in some cases, all) endpoints of the system may be protected via one or more virtual private networks to which authenticated endpoints must be authorized to access. Endpoints may include, for example, containerized components, physical components, devices, sites or locations, the compute fabric, and the like, and the VPNs may include mutually-exclusive and/or nested VPNs. External applications and services, whether automated or executing under the purview of a person, may access information and services provided by the system via only APIs, and different sets of APIs may be exposed to different users that have been authenticated and authorized to access respective sets of APIs. A configuration system operates within the compute fabric to enable a user to easily make configuration changes to the compute fabric as the user does not generally need to specify the computer hardware within the compute fabric to use to make the configuration changes, making it possible for the user to deploy new configuration elements with simple programming steps, and in some cases with the push of a button.

Securing access of a process control or automation system

Growing community of inventors

Round Rock, TX, United States of America

Sean Hernandez