JP2005084843A - Unit and programmable controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a CPU unit reducing the possibility of erroneously rewriting of data when receiving a write system message from other node connected to a network, and preferably being capable of specifying the cause later even though the data have been rewritten. <P>SOLUTION: This CPU unit comprises a write protect function implementing a flowchart in an MPU. The function is to determine whether or not a message is a write system when receiving the message and to store in an IO memory the information regarding the message as history information when the message is determined to be the write system. When the message is one from the other node connected via network that is not allowed to write, the unit does not perform writing and replies a response of the contents of "impossible" to execute for write protection. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a unit and a programmable controller. More specifically, the present invention relates to an improvement in processing for a write-type message sent from another node connected to a network.

  A programmable controller (PLC) is used as a control device for factory automation (FA) installed in a production factory (manufacturing site). This PLC is composed of a plurality of units. That is, a power supply unit of a power supply source, a CPU unit that controls the entire PLC, an output unit that inputs a switch or sensor signal attached to an appropriate place in an FA production device or facility device, an output that outputs a control output Various units such as a unit and a communication unit for connecting to a communication network are appropriately combined.

  The control in the PLC (CPU unit) takes a signal input from the input unit into the I / O memory of the CPU unit (IN refresh) and performs a logical operation based on a user program written in a pre-registered ladder language (calculation) Execution), the operation execution result is written in the I / O memory, sent to the output unit (OUT refresh), and then the so-called peripheral processing is cyclically repeated.

  By the way, when the system is actually constructed and the PLC is operated, the CPU unit receives a predetermined command from the outside by message communication and executes a predetermined process in accordance with the command. The contents of the message include, for example, reading from and writing to the IO memory of the CPU unit.

  Therefore, during execution of the system, the external monitoring system issues a data read request message to the CPU unit, and the CPU unit that receives the message monitors the data stored in the IO memory as a response to the message. Remote monitoring can be performed by returning to.

  In addition, although the well-known literature which showed the above-mentioned prior art was not found, as a technique which provides a restriction | limiting when reading and writing the user program stored in the PLC main body from an external apparatus, patent document 1, 2 etc. There is an invention disclosed in. In order to realize these known technologies, the restriction information is set in a predetermined memory of the PLC main body using a user program development support tool, or the restriction information is added as a part of the user program when the user program is created. It has become.

In any known technique, the target to be read or written from an external device is a user program, and it is not possible to set access restrictions on data in the I / O memory targeted by the present invention. Furthermore, since a user program development support tool is assumed as an external device for reading and writing the user program of the PLC main body, access from other applications cannot be restricted.
JP 10-124308 A JP-A-8-194504

  By the way, in the conventional CPU unit described above, when a message is received, processing according to the received message is performed. Therefore, when the received message is a writing system, for example, data stored in the IO memory is rewritten. It will be. Therefore, when a write-related message is issued from another node on the network due to a user operation error or a bug in the application program that issues the message, the control target held by the CPU unit Data related to the operation of the mechanical device may be destroyed, leading to an unintended operation of the mechanical device.

  In particular, recently, devices from different manufacturers may be connected to the network. In the above case, the manufacturer of the PLC (CPU unit) is different from the manufacturer of the monitoring system (monitoring application installed in the personal computer). Then, a message command corresponding to the PLC (CPU unit) of another company is created, but it is natural that the command cannot be created compared to that of its own product, and a command for reading data is created. There is a risk that the write command will be erroneously written, and the probability of occurrence of the above-mentioned trouble increases.

  And when such a trouble occurs, it can be restored to the correct data by rewriting it with normal data saved in advance, but it is possible to identify what cause the trouble has occurred Have difficulty. Therefore, there is a possibility that such trouble will recur.

  Therefore, in order to respond to the read request while preventing the occurrence of inadvertent data destruction and the like, conventionally, a system as shown in FIG. 1 was constructed. That is, the data disclosure PLC 2 is connected to the original device control PLC 1 for the production system, and the data stored in the device control PLC 1 is transferred to the data disclosure PLC 2. The external monitoring system 3 communicates with the data disclosure PLC 2 via the network 4 and indirectly monitors the state of the device control PLC 1 by reading the data stored in the data disclosure PLC 2. It was.

  With this configuration, even if the data in the data disclosure PLC2 is accidentally rewritten and destroyed by performing one-way data transfer from the device control PLC1 to the data disclosure PLC2, the device control PLC1 It can be made unaffected. However, if such a system configuration is taken, a PLC for data disclosure is required, and there is a problem that the system becomes large and costs increase. Furthermore, there is a risk of a data transfer time lag from the device control PLC 1 to the data disclosure PLC 2 and a transfer error, and the latest data may not necessarily be obtained.

  The present invention reduces the possibility that data is erroneously rewritten when a write message is received from another node connected to the network, and preferably, even if the data is rewritten, It is an object to provide a unit and a programmable controller that can identify the cause later.

  The unit according to the present invention is a unit that constitutes a programmable controller, and when receiving a message from another node connected via a network, a determination to determine whether the message is a writing system or not And a function of preventing writing based on a predetermined message determined to be a writing system by the determining means.

  In this way, when a write message is received, even if the write message is mistakenly transmitted by blocking writing based on a predetermined message, the unit side does not write. This prevents the data from being rewritten accidentally. Since the read message can be processed according to the content of the message, for example, the monitoring system can read and monitor the data.

  Then, it recognizes the address of the node that sent the write-related message, and in the case of a write-related message from a node that is allowed to write, it has a function of permitting writing according to the message. Good. In this way, since writing can be performed from a specific node, for example, maintenance accompanying data update from a remote place and rewrite requests from other systems can be handled. Whether or not the node is permitted to be written is determined by storing and holding the address of the permitted node and allowing the writing when the corresponding address exists, or rejecting the writing. The address of the node may be stored and retained, and writing may be permitted when the corresponding address does not exist.

  Of course, in the present invention, writing from all other nodes may be prevented. That is, the predetermined message referred to in the present invention may be all messages determined to be a writing system, or may be a part of messages that satisfy a certain condition.

  Further, when the message is a writing system from at least a node that is permitted to write, it is more preferable to provide a storage means for storing and holding history information of the message. In addition, when the message is at least a writing system, a storage unit that stores and holds history information of the message may be provided. By storing and holding history information in this way, it is possible to specify which message is used to rewrite data.

  Furthermore, the unit of the present invention can be a CPU unit or a communication unit. In the case of the CPU unit, as a function of preventing writing, literally, when a corresponding writing message is received, writing is not performed. Further, the function of preventing writing in the case of the communication unit can be realized by not transferring the message. Of course, other methods can be used.

  In particular, when the unit is a CPU unit, and in the case of a PLC having a plurality of communication units, it is possible to write to the message communication via the network to which the communication unit is connected by simply setting the CPU unit. The data protection function is enabled, and data is not accidentally destroyed from other nodes on the network. Therefore, troubles due to this factor are completely eliminated by the user. Furthermore, since this function is enabled only by setting the CPU unit, other mechanical devices including the communication unit can be used as they are, and can be implemented on existing devices at low cost.

  Moreover, the programmable controller concerning this invention is a programmable controller provided with the function to perform message communication between the other nodes connected to the network, Comprising: It is comprised including the above-mentioned various units.

  In the present invention, since a write message can be rejected, the possibility that data is erroneously rewritten when a write message is received from another node connected to the network can be reduced. Further, when history information is stored, even if the history information is rewritten, the cause can be specified later.

  FIG. 2 shows the entire system for realizing a preferred embodiment of the present invention. As shown in FIG. 2, the PLC 10 is connected to the control target device 21 via the control network 20, and an FA system installed at the production site is constructed. The PLC 10 is connected to a monitoring system 25 including an external dedicated device or a personal computer via an information network 22 such as Ethernet (registered trademark).

  The PLC 10 is composed of a plurality of units. That is, a power supply unit of a power supply source, a CPU unit that controls the entire PLC, an output unit that inputs a switch or sensor signal attached to an appropriate place in an FA production device or facility device, an output that outputs a control output Various units such as a unit and a communication unit for connecting to a communication network are appropriately combined. Each unit is composed of a box and is electrically and mechanically connected via a connector formed on the side surface. A bus is connected to this connector, whereby each unit is connected by bus, and data can be transmitted and received directly between units and / or indirectly via a CPU unit.

  The internal structure of the CPU unit 11 constituting the PLC 10 is configured as shown in FIG. That is, the system program is stored in the system ROM 11a, and the system program is called by the MPU 11b. The MPU 11b executes a predetermined process according to the program while appropriately using the system RAM 11c as a work memory. . During operation, a user program that is one of user data is stored in the user memory 11d. Then, each instruction constituting the user program stored in the user memory 11d is sequentially called by the ASIC 11e, and the instruction is executed there. Note that instructions that cannot be executed by the ASIC 11e are executed by the MPU 11b. Also. The ASIC 11e has a function of performing a refresh process, a bus interface, and a memory arbitration in addition to the user program (instruction) execution process. Furthermore, I / O data that is read and written in accordance with the execution of the user program and various parameters are stored in the IO memory 11f. That is, the IO memory 11f includes an external I / O allocation memory and a data memory used by a user program, and stores data read / written by message communication.

  In relation to the present invention, when a message is acquired via the communication unit, the MPU 11b executes a predetermined process according to the content of the message and returns a response. The frame structure of message communication is as shown in FIG. That is, as the frame configuration of the received command, the header portion includes the destination address and the source address, and the command content includes the command type and specific data. The MPU 11b processes only the destination address addressed to itself (addressed to the CPU unit). The command type stores, for example, code information for identifying data writing or reading. The data stores an address of data to be accessed and data to be written in the case of writing.

  In addition, as a response frame issued by the MPU 11b, the header part includes a destination address and a source address. The destination address stores the source address of the received message command, and the source address stores its own address. When the received message command is read, the data stored at the corresponding address is stored and returned as the response content. In addition, when the message command is writing, if writing is permitted as will be described later, the specified writing is performed, and the response content is completed and returned, and writing is prohibited. If it is, a predetermined error message is returned as the response content.

  That is, in the present embodiment, when the command type of the received message is read, the process is executed according to the content of the acquired message as in the conventional case, and a response is returned, but when the command type is write, The request for the message was rejected and the writing process was not performed. As a result, by enabling the write protection function in the CPU unit 11, even if an unintended message is issued from a previous node (such as the monitoring system 25) connected by the information system network 22, the data is destroyed. It will not be.

  Furthermore, in this embodiment, not all write messages are rejected, but rejected nodes or allowed nodes are registered, and writing from some nodes is permitted. Of course, all writing messages may be rejected.

  Further, in the present embodiment, a history of message communication is recorded. Specifically, as shown in FIG. 5, the sender address, the command type, and the date / time information when the message is received are associated and registered, and the history information is stored in the IO memory 11f. . As history information, all messages may be stored, or only a predetermined writing system may be stored.

  By collecting history information in this way, even if data is accidentally rewritten by a message from a node that allowed writing, and the data is destroyed, it is confirmed by which message it was rewritten later. be able to. As a result, by identifying the cause, for example, a program part that issues a message that is a bug in the monitoring program implemented in the monitoring system 25 is found, and by deleting or correcting it, issuing a wrong message Can be stopped and reoccurrence of data destruction can be prevented.

  In addition, even if the writing system is a device that is allowed to issue a message, when writing is permitted only in a specific area, the actual data destruction has occurred in a case other than the specific area. Can be recognized as a mistake in operation. In addition, since the node that issued the write message is known, it is possible to estimate (narrow down) the node / operator that has made the operation mistake from the date / time information on which the message was issued. If it is possible to identify and estimate that an operation error has been made in this way, it is possible to prevent a recurrence by calling attention to the operator who made the operation error.

  The MPU 11b performs the processing for the message and the history information storage processing. Specifically, the flowchart shown in FIG. 6 is implemented. That is, first, the MPU 11b determines whether or not the received message is a writing system (ST1). This can be determined by recognizing the command type of the command content of the received message.

  If the received message is a read-out message, the branch determination is No, and the process jumps to step 7 to perform normal response processing. In other words, in this case, the data stored at the address requested by the read request is read and sent to the message sender as a response. Return it.

  On the other hand, if the received message is a writing type, it is determined whether or not the source of the message is another node (ST2). That is, the message acquired by the CPU unit 11 may be sent from a device / equipment outside the PLC 10 that the CPU unit 11 constitutes, or may be sent from another unit that constitutes the same PLC 10. And the write message sent from the other unit which comprises the same PLC10 exists as normal operation | movement, and may be performed as it is. Therefore, in the case of a message from such another unit, since it is the own node, the branch determination at Step 2 is No, and the routine jumps to Step 7 to perform normal response processing. That is, a write process for a predetermined address in the IO memory 11f is performed.

  If the received message is from another node, the process jumps to step 3 to store the message communication history (ST3). That is, predetermined information is extracted from the received message and stored in the IO memory 11f in a data structure as shown in FIG.

  Thereafter, it is determined whether there is a read-only (write protect) setting (ST4). That is, in the present embodiment, both the specification that allows the previous writing and the specification that prohibits the writing can be supported. If there is no call-only setting and a specification that allows unconditional writing is selected, the branch determination in step 4 is No, and normal response processing is performed in step 7. In the normal response processing here, since there is no read-only setting, writing to the address specified by the received message is performed, and a completion notification is returned as a response.

  If there is a read-only setting, the process jumps to step 5 to determine whether or not the source address of the received message is set to be out of protection (ST5). In other words, in this embodiment, writing from all other nodes is not prohibited, but writing from a pre-registered node is executed without protection, so the source address of the message is confirmed and protected. If there is an out-of-target setting, the process jumps to step 7 to perform normal response processing. In the normal response processing here, since there is no read-only setting, writing to the address specified by the received message is performed, and a completion notification is returned as a response. Note that the setting of the node that is not to be protected is registered in advance in the IO memory 11f of the CPU unit 11 using a tool or the like.

  If the source address of the received message is a node that is not set to be unprotected, the branch determination in step 5 is No, and the process jumps to step 6 to execute response processing during write protection (ST6). Specifically, the write process requested by the message received this time is not performed, and a response “cannot be executed because the write protection is in progress” is returned.

  If the specification is such that all write messages from other nodes are rejected, steps 4 and 5 need not be provided. Further, if it is not necessary to provide a specification that executes all when a write message is received from another node as in the prior art, the branch determination in step 4 may not be provided. Further, the read-only setting may be set mechanically by a setting switch provided in the CPU unit 11 in addition to the setting using a tool, and various methods can be employed. Furthermore, it is not always necessary to record history information.

  As described above, according to the present embodiment, the write protection function is effective for message communication via the network only by making settings for the CPU unit 11, and from other nodes on the network. Data is not accidentally destroyed based on a write message. Therefore, troubles due to this factor are completely eliminated by the user.

  Further, by providing the CPU unit 11 with a write protection function as in the present embodiment, other mechanical devices including the communication unit can be used. In other words, when the communication unit receives a message from another node, even if the message is sent to the CPU unit 11 regardless of the command type, the CPU unit 11 can refuse writing, and inadvertent data destruction Can be prevented in advance. Therefore, it can be implemented at low cost for existing equipment.

  Furthermore, in this embodiment, by registering nodes that are not write-protected in advance, it is possible to select valid / invalid by the address of each node on the network, so a system can be constructed at a low cost with only one network. .

  The function that keeps the history of message communication is operated regardless of the setting when there is a write from another node. Therefore, a user who does not use the write protect function is mistaken for another node on the network. Even if the data is destroyed, it is possible to identify the cause later and to solve the trouble early.

  7 and 8 show a second embodiment of the present invention. In this embodiment, unlike the first embodiment, write protection is performed by the communication unit 12. That is, as shown in FIG. 7, the communication unit 12 is an MPU 12 a that is a microprocessor that controls the operation of the entire communication unit 12, an ASIC 12 b that performs transfer to a bus interface and a shared memory, and a shared memory with the CPU unit 11. A first RAM 12c to be used, a ROM 12d for storing system firmware, a second RAM 12e used as a work memory during execution of the system firmware stored in the ROM 12d, and a nonvolatile memory 12f are provided. The nonvolatile memory 12f stores history information and information for specifying a node that is not write-protected. The communication unit 12 is connected to a CPU unit or the like via a bus, and transmits and receives data via the bus.

  Here, the MPU 12a of the communication unit 12 has a write protection function in addition to a normal communication processing function. In other words, in the case of a read-type message, it is received normally and passed to other units as necessary, but the message received from another node is a write-type message and is not set to be unprotected. In case, refuse to receive. Of course, in the case of a write-type message from a node that is set not to be protected, it is received and passed to another unit as necessary. Furthermore, in the present embodiment, when a write message is received, history information is registered in the nonvolatile memory 12f. Specifically, the flowchart shown in FIG. 8 is implemented.

  That is, it is determined whether the received message is addressed to the own node (ST11). If it is not addressed to the own node, the process jumps to step 17 to perform normal routing processing. In this case, the received message is transferred to the unit of another node specified by the destination address.

  On the other hand, if a message addressed to the own node is received, the process jumps to step 12 to determine whether or not the message received from the command type is a write type (ST12). If it is not a writing system such as reading, the branch determination in step 12 is No, and normal routing processing is performed. Here, a process of transferring the received message to a unit (CPU unit or the like) of the destination address is performed.

  If the received message is a writing system, the process jumps to step 13 to store the message communication history (ST13). That is, predetermined information is extracted from the received message, and stored in the nonvolatile memory 12f in a data structure as shown in FIG.

  Thereafter, it is determined whether there is a read-only (write protect) setting (ST14). That is, in the present embodiment, both the specification that allows the previous writing and the specification that prohibits the writing can be supported. If there is no call-only setting and a specification that allows unconditional writing is selected, the branch determination in step 14 is No, and normal routing processing is performed in step 17. In this normal routing process, since there is no read-only setting, the received message is transferred to the unit of the own node specified by the destination address.

  If there is a read-only setting, the process jumps to step 15 to determine whether or not the source address of the received message is set to be out of protection (ST15). In other words, in this embodiment, writing from all other nodes is not prohibited, but writing from a pre-registered node is executed without protection, so the source address of the message is confirmed and protected. If there is an out-of-target setting, the process jumps to step 17 to perform normal response processing. The normal response process here performs a process of transferring the received message. Note that the setting of the node that is not to be protected is registered in advance in the nonvolatile memory 12f of the communication unit 12 using a tool or the like.

  If the source address of the received message is a node that has not been set as not to be protected, the branch determination in step 15 is No, so the process jumps to step 16 to execute response processing during write protection (ST16). . Specifically, the write process requested by the message received this time is not performed, and a response “cannot be executed because the write protection is in progress” is returned.

  Also in the communication unit, various modifications can be made, such as making sure to provide read-only protection or not registering history information, as with the CPU unit 11 of the first embodiment. .

  Furthermore, in each of the above-described embodiments, for example, a tool can be used as a method for performing a read-only setting and registering a transmission-permitted source address. As an example, a registration screen as shown in FIG. 9 is output and displayed on the display screen of the tool display device, and a check mark is placed in “Enable message communication write protection function”. Clicking with a pointing device) makes a read-only setting. Then, a node address that is not protected is input. The information can be set by transferring / downloading the information from the tool to a predetermined unit and storing it in a predetermined storage area.

  In the above-described embodiment, the other node is the monitoring system 25. However, the present invention is not limited to this, and is connected to another network such as a PLC and capable of message communication. Can also be other nodes.

It is a figure which shows an example of the system configuration | structure of a prior art example. It is a figure which shows an example of the network system to which this invention is applied. It is a figure which shows the internal structure which shows one Embodiment (1st Embodiment) of the CPU unit which concerns on this invention. It is a figure which shows the example of a frame structure of a message and a response. It is a figure which shows an example of the data structure of the history information memorize | stored and held. It is a flowchart which shows the principal part function in one Embodiment (1st Embodiment) of the CPU unit which concerns on this invention. It is a figure which shows the internal structure which shows one Embodiment (2nd Embodiment) of the communication unit which concerns on this invention. It is a flowchart which shows the principal part function in one Embodiment (2nd Embodiment) of the communication unit which concerns on this invention. It is a figure which shows an example of the setting screen of a tool.

Explanation of symbols

10 PLC
11 CPU unit 11a System ROM
11b MPU
11c System RAM
11d User memory 11e ASIC
11f IO memory 12 Communication unit 12a MPU
12b ASIC
12c 1st RAM
12d ROM
12e 2nd RAM
12f Non-volatile memory 20 Control system network 21 Control target device 22 Information system network 25 Monitoring system

Claims (6)

A unit constituting a programmable controller,
When receiving a message from another node connected via the network, a determination means for determining whether the message is a writing system,
A unit comprising a function for preventing writing based on a predetermined message determined to be a writing system by the determining means.   It has a function of recognizing the address of the node that has sent the write message and allowing writing according to the message in the case of a write message from a node that is allowed to write. The unit according to claim 1.   The unit according to claim 2, further comprising storage means for storing and holding history information of the message when the message is a writing system from a node at which writing is permitted.   3. The unit according to claim 1, further comprising storage means for storing and holding history information of the message when the message is at least a writing system.   The unit according to any one of claims 1 to 4, wherein the unit is a CPU unit or a communication unit. A programmable controller having a function of performing message communication with other nodes connected to a network,
A programmable controller comprising the unit according to claim 1.

Images