Imagine, if you will, a series of custom built modules (building size). Each module is setup with standardized control/automation equipment (PLC's, VFDs, HMIs etc.) which communicate to each other, within the module, via an Ethernet based industrial protocol (e.g. EthernetIP, Modbus TCP). As each module uses a standardized configuration for the control/automation equipment, PLC X in Module A will have the same IP address configuration as PLC X in Module B.
Now we install several of these modules at a site and wish to connect them to a centralized monitoring station (control room) with site-wide SCADA HMI and Historian. Since each module has the same configuration (utilizes same IP addresses) simply connecting them to a common network is problematic due to conflicting IP addresses, also configuring unique IP addresses for each Ethernet connected component across all modules is undesirable due to the extra effort, loss of configuration standardization and risk of human error (for example, don't want the PLC in module A accidentally controlling one of the 20 or so VFDs in Module B).
This the part I want feedback on (below)…
It seems to me that a solution is to equip each module with a NAPT (Network Address Port Translation) capable device (e.g. router or NAT/PAT capable switch), we'll call it a router. The router is configured with a unique IP address on the interface attached to the common network and a standardized IP address configured on the interface attached the module network. NAT/PAT rules will be added to the router configuration to allow the common SCADA system to access module equipment (e.g. module PLC).
Can anyone suggest improvements (or point out flows) on this implementation. I'm interested to know if there is more appropriate network technology for this use case (bridges, gateways etc.).
Also, I want to implement VLANs which extend into the module to allow separation of controls network (described above), data network (for variable computing equipment within the module), and business network.