JP5951162B1 - Control device, composite unit device, update determination program, and program update method - Google Patents

Abstract

The program update device (11) updates a firmware, a program storage unit (1051) that stores firmware as a program, a rule storage unit (1052) that stores rule information in which rules for updating the firmware are defined, and When the update information receiving unit (1053) that receives the update information, the determination unit (1054) that determines whether the update information matches the rule information, and the determination unit (1054) are determined to be compatible, the program storage An update unit (1055) that updates firmware stored in the unit (1051) using update information.

Description

The present invention also relates to a control device , a composite unit device, an update determination program, and a program update method.

  In general, software that defines the operation of an embedded device is called firmware. Hereinafter, the firmware may be referred to as FW. In recent years, with the networking of devices typified by smartphones, functions that allow end users to update FW have been utilized for the purpose of function enhancement and bug fixes. The function of updating the FW is partially used not only in consumer products but also in industrial control devices used in plants and factories and electronic devices that control automobiles. Hereinafter, a function capable of updating the FW is referred to as an FW update function.

The FW update function is used in the following procedure by the end user.
(1) The end user obtains an updated FW file from the manufacturer's website.
(2) The end user inputs the manufactured and acquired file to the target embedded device via a network or a recording medium.
(3) The embedded device rewrites the firmware based on the FW file.

  While the FW update function provides the convenience as described above, there is a risk that the FW update function may be abused as a use route of an attacker. For example, if the end user updates the FW of the device using the FW created by the malicious third party, there is a risk that the malicious third party can take over the device. Therefore, it is necessary to be able to prove that the FW used in the FW update function has been released by the manufacturer of the device. Non-Patent Document 1 describes a technique for preventing arbitrary modification of FW by using falsification detection to a message using a digital signature or a message authentication code. Here, it is necessary to note that industrial control devices and electronic control devices for automobiles are not used alone by end users, and that final products using these devices as parts are produced by other manufacturers. is there. For this reason, the manufacturer of the final product is responsible for managing the FW of each device as the final product. It should also be noted that the industrial control device is made into a component and the final product is configured by combining a plurality of them. That is, it is necessary not only to manage the FW of each device as a single unit but also to manage it as a plurality of combinations. On the other hand, in systems such as control systems, which have a large impact when interruption or stoppage due to the occurrence of some kind of failure occurs, eliminate events that may affect system operation such as FW updates as much as possible. It can be said that there is a tendency to.

  For example, as in the example of “Copy Exactly!” Disclosed in Non-Patent Document 2, the risk of malfunction is reduced by constructing the production system by eliminating any shaking.

RFC 4108, “Using Cryptographic Message Syntax (CMS) to Protect Firmware Packages”, http: // tools. ietf. org / html / rfc4108 Intel “Manufacturing Process Copy exact!” Http: // www. intel. com / content / www / us / en / quality / exact-copy. html

  Componentized industrial control devices are not limited in application and are configured with versatile specifications. Of course, the operation of the industrial control device is guaranteed within its specifications. On the other hand, a final product having an industrial control device as one of a plurality of components is system-up after grasping the specifications of the industrial control device. However, despite the range of component specifications, the quality of the final product cannot be verified in consideration of all the fluctuations (variations within the specification allowable range) of each component such as an industrial control device.

  Therefore, from the viewpoint of the manufacturer who builds the final product, the occurrence of fluctuations (changes in the specification within the allowable range) due to the FW update is a risk that a malfunction may occur in the final product, although it is within the specification range. Therefore, the manufacturer that manufactures the final product needs to be able to control and limit the use of the end user of the FW update function of the industrial control device.

  In addition, a final product composed of a plurality of control devices needs to be managed as a combination of the FWs of the individual control devices. Therefore, the FW update function needs to be able to control and limit the use by the end user in consideration of the combination of FW.

  A final product including a plurality of control devices as parts is replaced by an end user. That is, it is necessary to manage the combination of FW in consideration of replacement of individual control devices that are parts of the final product.

  An object of the present invention is to provide a configuration in which a manufacturer that manufactures a final product can control and limit the use of an end user of the FW update function of a control device.

The program update device of the present invention provides:
A program storage unit for storing the program;
A rule storage unit that stores rule information in which rules for updating the program are defined;
An update information receiving unit for receiving update information for updating the program;
A determination unit that determines whether the update information matches the rule information;
And an update unit that updates the program stored in the program storage unit using the update information when it is determined that the determination unit is suitable.

  According to the present invention, a manufacturer that manufactures the final product can control and limit the use of the end user of the FW update function of the control device.

FIG. 3 is a diagram illustrating the configuration of the FW update system 1 according to the first embodiment. FIG. 2 shows the first embodiment, and shows FIG. 1 in a connected state to a communication network 40. FIG. 5 shows the first embodiment, and is a diagram for explaining a process in which the set maker 20 ships a final product including the control device 105. The figure which shows Embodiment 1 and shows the rule file 205 in which the update rule of the project file 202 and FW was described. FIG. 3 is a diagram illustrating the first embodiment, and illustrates a control device 105 and a project file 202 that are passed from the set maker 20 to the end user 30. The figure which shows Embodiment 1 and is a figure explaining the case where the end user 30 updates FW of the control apparatus 105 (30). FIG. 3 is a diagram illustrating the first embodiment and is a block diagram illustrating a configuration of a control device 105; FIG. 5 is a diagram illustrating the first embodiment, and is a sequence diagram illustrating operations of the end user device 300 and the control device 105 (30) in the end user 30. FIG. 5 shows the first embodiment, and shows a state in which a plurality of units A to E use firmware A to E. FIG. 3 is a diagram illustrating the first embodiment and is a block diagram illustrating a configuration of a unit A. FIG. 5 shows the first embodiment, and shows a rule file 205A of unit A. The figure which shows Embodiment 1 and shows the operation | movement in the case where the combination of FW is changed unintentionally by component replacement. The figure which shows Embodiment 1 and shows the rule file 205A which the unit A has. FIG. 5 is a diagram illustrating the first embodiment, and is a block diagram illustrating a configuration in which the control device 105 (30) includes a version acquisition unit. FIG. 5 shows the first embodiment, and shows a sequence in which unit A obtains a version. FIG. 9 is a diagram illustrating the second embodiment and illustrates a hardware configuration of a control device.

Embodiment 1 FIG.
<*** Explanation of configuration *****>
The first embodiment will be described with reference to FIGS. FIG. 1 shows a configuration of an FW update system 1 necessary for FW update. FIG. 2 is a diagram illustrating FIG. 1 in a state of connection to the communication network 40. 2 shows a block configuration diagram of the FW distribution server apparatus 100 (hereinafter, distribution server 100), the set maker apparatus 200, and the end user apparatus 300.

  The distribution server 100 includes a control unit 110, an update information generation unit 120, a communication unit 130, and a storage unit 140. The control unit 110 controls the operation of the distribution server 100. The update information generation unit 120 generates an update FW 102 to be described later. The communication unit 130 communicates with the set maker device 200 and the end user device 300 via the communication network 40. The storage unit 140 stores information such as the update FW 102.

  The set maker apparatus 200 includes a development tool execution unit 210, a communication unit 220, and a storage unit 230. The development tool execution unit 210 executes the development tool 201 that is a program stored in the storage unit 230. The communication unit 220 communicates with the distribution server 100 and the end user device 300 via the communication network 40. The storage unit 230 stores information such as the development tool 201. The development tool execution unit 210 includes a project file generation unit 211 that generates a project file 202 described later, and a rule information generation unit 212 that generates a rule file described later.

  The end user device 300 includes a development tool execution unit 310, a communication unit 320, and a storage unit 330. The development tool execution unit 310 executes the development tool 301 that is a program stored in the storage unit 330. The communication unit 320 communicates via the communication network 40. The storage unit 330 stores information such as the development tool 301.

The control apparatus manufacturer 10 in FIG. 1 has a distribution server 100 that distributes FW, and manages the update FW 102.
(1) The control device manufacturer 10 is a manufacturer that manufactures a control device. As a specific example, when the final product is a PLC (programmable logic controller), a CPU unit, a communication unit, or the like constituting the PLC is a control device. A control device is a device that controls other devices.
(2) The update FW 102 is information for updating the FW included in the control device 105. Note that FW is a program. Therefore, the update FW 102 is update information for updating a program included in the control device 105. The update FW 102 may be difference information between the FW before the update and the FW after the update, or may be overall information that replaces all of the FW before the update. Note that the rule file 205 is also updated, but the rule file 205 may also be difference information or overall information, similar to the update FW 102.

  The distribution server 100 is connected to the communication network 40 and accepts access from the set maker device 200 and the end user device 300 via the communication unit 130.

  The set maker 20 in FIG. 1 includes a set maker apparatus 200 in which a development tool 201 provided from the control apparatus maker 10 is stored. The set maker device 200 is connected to the control device 105 (20). The set maker 20 uses the development tool 201 stored in the set maker apparatus 200 for the control apparatus 105 (20) to perform additional development according to its own purpose. The set maker 20 recognizes the necessity of FW update by the notification from the control device maker 10 or the periodic confirmation. When the FW needs to be updated, the set maker 20 downloads the update FW 102 from the distribution server 100 using the set maker apparatus 200. The downloaded update FW 102 is transmitted to the control device 105 (20) of the set maker 20 via the set maker device 200. The control device 105 (20) updates its own FW with the received update FW102. In FIG. 1, the control device 105 is shown for each of the control device manufacturer 10, the set manufacturer 20, and the end user 30, but the control device 105 is the same. The control device 105 (10) indicates that the control device 105 exists in the control device manufacturer 10. The control device 105 (20) indicates that the control device 105 (10) has been carried into the set maker 20. The control device 105 (30) indicates that the control device 105 (10) is carried into the end user 30 via the set maker 20. When the distinction is unnecessary, it is described as a control device 105. Here, it is assumed that the update FW 102 is protected by a method disclosed in Non-Patent Document 1 or a similar method. There are no particular restrictions on the protection method.

  Similarly, the end user 30 of FIG. 1 also has an end user device 300 in which a development tool 301 provided from the control device manufacturer 10 is stored. In the end user 30, the control device 105 (20) is released in the form of being included in the final product developed by the set maker 20. The set maker 20 is a maker that assembles a final product including a plurality of control devices by using a plurality of control devices manufactured by the control device maker 10. As described above, if the final product is a PLC, the control device is a CPU unit or a communication unit. The end user device 300 is connected to the control device 105 (30), and the end user 30 also uses the development tool 301 stored in the end user device 300 for the control device 105 (30) as in the case of the set manufacturer 20. And additional development to suit their own purposes. The end user 30 also recognizes the necessity of FW update by notification from the control device manufacturer 10 or by periodic check, and downloads the update FW 102 from the distribution server 100 via the end user device 300. The downloaded update FW 102 is transmitted to the control device 105 (30) via the end user device 300. The control device 105 (30) updates its own FW with the received update FW102.

  The above is the basic configuration and basic operation of the FW update.

  Next, with reference to FIGS. 3 to 5, a method in which the set maker 20 that is the manufacturer of the final product controls the FW update function of the control device 105 to the end user 30 will be described.

  FIG. 3 is a diagram illustrating a process in which the set maker 20 ships the final product including the control device 105 to the end user 30. FIG. 4 is a diagram showing a rule file 205 in which project file 202 and FW update rules are described. FIG. 5 shows the control device 105 and the project file 202 delivered from the set maker 20 to the end user 30.

  First, the operation in the set maker 20 will be described with reference to FIGS. Processing in the set maker 20 described below is performed by the set maker apparatus 200.

  The set maker 20 develops the program of the control device 105 (20) with the set maker device 200 in which the development tool 201 is stored. At that time, the development tool 201 generally stored in the set maker apparatus 200 has a management function for managing that the program of the control apparatus 105 (20) is for the control apparatus 105 (20). One of the management functions is a project file 202 shown in FIGS.

A group of files such as programs, parameters, and data managed by the project file 202 is a set of files necessary for control of the control device 105 (20).
(1) The project file 202 includes programs, parameters, or data as a file group, as shown in FIG. The development tool execution unit 210 of the set maker apparatus 200 manages a project file 202 to manage a file group such as a program, a parameter, or data.
(2) The update FW URL 203 in FIG. 4 is one of data managed by the project file 202. The update FW URL 203 is a website location specifier published by the control device manufacturer 10. The update FW 102 of the control device 105 can be downloaded from this website.
(3) Rule file The URL 204 is one of data managed by the project file 202. The rule file URL 204 is a location specifier of a website published by the set maker 20. From this website, a rule file 205 in which FW update rules are defined can be downloaded for the FW update of the final product. The FW update rule is a condition for FW update. Examples of update conditions include FW version 205-1, attribute 205-2 related to the updated function, vulnerability attribute 205-3 resolved by the update, and the like. The FW version 205-1 is also attribute information, and the attribute information including the FW version 205-1 is described in the update FW102. The rule file 205 is also updated. This update will be described later.

  As shown in FIG. 5, when the set maker 20 ships the final product, the development tool execution unit 210 of the set maker apparatus 200 installs the rule file 205-1 to the control apparatus 105 (20). Here, the rule file 205-1 means the installed rule file 205, and when the rule file 205-1 is later updated by accessing the rule file URL 204, the rule file 205 is described as the rule file 205-2. . At the time of this installation, as shown in FIG. 5, a digital signature 207 generated using the private key of the set maker 20 is added to the rule file 205-1. Further, when the set maker 20 ships the final product, the set maker 20 installs the public key 206 for verifying the digital signature 207 added to the rule file 205-1 to the control device 105 (20). The digital signature 207 and the public key 206 are verification information 2060.

  As shown in FIG. 5, a project file 202 is released from the set maker 20 together with the final product to the end user 30.

  Next, the operation in the end user 30 will be described. FIG. 6 is a diagram illustrating a case where the end user 30 updates the FW of the control device 105 (30). FIG. 7 is a block diagram illustrating a configuration of the control device 105. The FW is stored in the program storage unit 1051. FIG. 8 is a sequence diagram showing operations of the end user device 300 and the control device 105 (30) in the end user 30.

<*** Explanation of configuration *****>
First, the configuration of the control device 105 will be described with reference to FIG.

  The control device 105 that is the program update device 11 includes a program storage unit 1051, a rule storage unit 1052, an update information reception unit 1053, a determination unit 1054, an update unit 1055, a rule information reception unit 1056, a request transmission unit 1057, and a verification unit 1058. Prepare. The program storage unit 1051 stores firmware that is a program. The rule storage unit 1052 stores a rule file 205 that is rule information 2051 in which firmware update rules are defined. The update information receiving unit 1053 receives the update FW 102 that is update information 1020 for updating the firmware. The determination unit 1054 determines whether the update information 1020 matches the rule information 2051. The update unit 1055 updates the firmware stored in the program storage unit 1051 using the update information 1020 when it is determined that the determination unit 1054 is suitable. The update unit 1055 updates rule information.

  The rule information receiving unit 1056 receives the new version rule information 2052 in which the rule information 2051 is updated. When the new version rule information 2052 is received, the request transmission unit 1057 transmits a transmission request 51 for requesting transmission of the update information 1020. In this case, the update information receiving unit 1053 receives the update information 1020 as a response to the transmission request 51, and the determination unit 1054 matches the new version rule information 2052 with the update information 1020 received as a response by the update information receiving unit 1053. Determine whether to do.

  The rule information 2051 stored in the rule storage unit 1052 has verification information 2060. The verification unit 1058 verifies whether or not the new version rule information 2052 is valid based on the verification information 2060 and the new version rule information 2052 received by the rule information reception unit 1056, and determines that the new version rule information 2052 is not valid as a result of the verification. The new version rule information 2052 is discarded.

  The rule information receiving unit 1056 receives the new version rule information 2052 from the download device 3000 that downloads the new version rule information 2052 uploaded to the website 103 from the website 103. In this case, the download device 3000 is the end user device 300.

<*** Explanation of operation *****>
Next, operations of the end user device 300 and the control device 105 (30) will be described with reference to FIGS.

  The end user 30 recognizes the necessity of FW update by notification from the control device manufacturer 10 or the set manufacturer 20 or by periodic confirmation. The end user 30 performs maintenance of the control device 105 (30) included in the final product using the end user device 300 in which the development tool 301 and the project file 202 are stored.

<Step S101>
The development tool execution unit 310 of the end user device 300 refers to the rule file URL 204 defined in the project file 202 using the communication unit 320 and checks whether there is a new version of the rule file 205-1. Here, the version of the rule file 205 is managed by the project file 202 as shown in FIG.

<Step S102>
When there is a new version, the development tool execution unit 310 downloads the rule file 205-2 from the website page.

<Step S103>
When the development tool execution unit 310 downloads a new version of the rule file 205-2, the development tool execution unit 310 transmits the rule file 205-2 to the control device 105 (30) via the communication unit 320. Note that the end user device 300 stores the rule file 205 in the storage unit 330. The rule file 205 transmitted from the development tool execution unit 310 to the control device 105 is a copy of the rule file 205 in the storage unit 330.

<Step S104>
The rule information receiving unit 1056 of the control device 105 (30) receives the rule file 205-2 which is the new version rule information 2052. The verification unit 1058 verifies the validity of the digital signature 207 of the rule file 205-1 using the public key 206 installed in advance by the set maker 20. The rule file 205-1 is stored in the rule storage unit 1052. The verification unit 1058 executes a normal digital signature 207 verification method. Specifically, the verification unit 1058 decrypts the digital signature 207 with the public key 206 and generates a decrypted value h1. Also, the verification unit 1058 generates a hash value h2 using information included in the acquired new version of the rule file 205-2, and compares the decrypted value h1 and the hash value h2. The verification unit 1058 determines that the verification is successful when h1 = h2, and determines that the verification is not successful when h1 = h2.

<Step S105>
In the case of verification failure, the verification unit 1058 discards the received rule file 205-2 and notifies the end user device 300 of an error.

<Step S106>
When the verification by the verification unit 1058 is successful, the update unit 1055 updates the rule file 250-1 held by the update unit 1055 with the received update rule file 205-2. Further, the request transmission unit 1057 transmits a notification of successful update to the end user device 300. The notification of successful update is a transmission request 51 for requesting transmission of the update FW 102.

<Step S107>
The communication unit 320 of the end user device 300 receives the transmission request 51. When the transmission request 51 is received, the development tool execution unit 310 accesses the update FW URL 203 via the communication unit 320 and checks whether there is an update FW 102 that conforms to the rule indicated by the rule file 205-2. The entity of the update FW URL 203 is the distribution server 100 as shown in FIG. When there is an update FW 102 that matches the rule, the development tool execution unit 310 downloads the update FW 102 that matches the rule from the update FW URL 203 (S108; YES). If there is no update FW 102 that conforms to the rules of the rule file 205-2 as a result of accessing the update FW URL 203, the development tool execution unit 310 outputs to the display device and notifies that no firmware update is required ( S108; NO).

<Step S109>
The development tool execution unit 310 transmits the downloaded update FW 102 to the control device 105 (30) via the communication unit 320.

<Step S110>
The update information receiving unit 1053 receives the update FW 102 that is the update information 1020. The determination unit 1054 confirms whether or not the received update FW 102 conforms to the rule indicated by the rule file 205-2. At this time, as described above, it is assumed that the update FW 102 is protected from tampering by the method disclosed in Non-Patent Document 1 or a similar method, and the protection method and method are not particularly limited.

<Step S111>
When the rule is met (YES in S110), the update unit 1055 is the update FW 102 for which the match is confirmed (YES in S110) and the validity is confirmed (YES in S104), and the controller 105 (30 ) FW is updated. After completing the update, the update unit 1055 transmits a normal end to the end user device 300.

<NO in step S110>
If the rule does not match (NO in S110), the update unit 1055 does not update the FW and transmits an update impossible message to the end user device 300.

  The rule file 205 according to the first embodiment is not a single one, and may be divided for each end user 30 or for each version of the final product.

  Next, with reference to FIG. 9 to FIG. 11, rules regarding the FW combinations of the units included in the control device 105 (30) will be described.

  FIG. 9 shows a state in which the control device 105 (30) has a plurality of units A to E, and the plurality of units A to E use the firmware A to E, respectively. The control device 105 (30) is a composite unit device including a plurality of units. In FIG. 9, the update FW group 401 includes update firmware A to E. The firmware A and B for update are referred to as update FW (A), update FW (B), and the like. The update FW (A) corresponds to the update FW 102 described in FIG. Similarly, the update FW (B) to the update FW (E) correspond to the update FW 102, respectively. FIG. 10 is a block diagram showing a configuration of unit A serving as a master unit. Unit A has the same configuration as the control device 105 of FIG. The program storage unit 1051 to verification unit 1058 in FIG. 7 correspond to the program storage unit 1051M to verification unit 1058M in FIG. FIG. 11 shows a rule file 205A of unit A. The rule file 205A is stored in the rule storage unit 1052M. The operation of the unit A shown in FIG. 10 is the same as that of the control device 105 (30) of FIG. 8, and the control device 105 (30) of FIG. However, the contents of the rule file 205A are different.

  The control device 105 (30) illustrated in FIG. 9 includes five units A, B, C, D, and E that may be updated. This is an example, and the configuration is not limited. Here, it is assumed that the unit A plays the role of a master in the control device 105 (30). Hereinafter, unit A is referred to as master unit A. If the control device 105 (30) is a PLC, the master unit A is a CPU unit, and the slave units B, C, D, and E are communication units other than the CPU unit.

  The updated FW group 401 is downloaded by the method shown in FIG. 8 (S109 in FIG. 8).

  The update FW group 401 passes through the path 41 in FIG. That is, the update FW group 401 always passes through the master unit A, and the FW of each unit A to E is updated. In this update process, the master unit A confirms whether the update FW (A), FW (B), and the like match the rules of the rule file 205A. That is, when updating the update FW group 401, the master unit A plays the role of the control device 105 (30) in FIG. 8, and in the case of the path 41, the control device 105 (30) in FIG. Replaced with master unit A. In the case of the path 41, as described above, the tampering with the update FW (A) or the like is protected by the method disclosed in Non-Patent Document 1 or a similar method.

  On the other hand, the slave units B to E do not permit the FW update for the path 42 in FIG. 9, that is, the direct slave unit. As described above, when the FW of the slave units B to E is updated, the master unit A is always used. The slave unit includes a control unit, a communication unit, and a storage unit that stores the FW (not shown). When receiving a FW update request via the communication unit, the control unit rejects the request.

  The rule storage unit 1052M of the master unit A stores the rule file 205A of FIG. In the example of FIG. 11, the rule file 205A has update availability information 205A-0 indicating whether or not the FW of each unit may be updated. The determination unit 1054M of the master unit A includes the update FW (A) of the master unit A, and the update FW (B) to FW (E) of the slave units B to E as the rule file 205A by the set manufacturer 20. It is checked whether the FW conforms to the rule shown. This check corresponds to S110 in FIG. 8, and in S110, the determination unit 1054M of the master unit A refers to the rule indicated by the rule file 205A and determines whether the FW to be updated conforms to the rule. Specifically, it is as follows. When the FW for determining conformity is the update FW (B), the determination unit 1054M refers to the update availability information 205A-0 and determines that it is compatible because it can be updated. However, when the FW for determining the conformity is the update FW (C), the determination unit 1054M determines that it does not conform to the rule because the update is not possible with the update availability information 205A-0.

  In the master unit A, the operation is the same as that of the control device 105 (30) in FIG. 8 except that the determination unit 1054M determines whether the update FW group 401 conforms to the rule. When the determination unit 1054M determines that the rule is met, the update unit 1055M updates the FW.

  Next, a case where the master unit A acquires the FW version from each unit will be described with reference to FIGS. As in the case of FIG. 9, the control device 105 (30) includes units A to E.

  FIG. 12 shows an operation in the case where the combination of FWs is changed unintentionally by component replacement. Note that FIG. 12 is an example, and the configuration and attributes are not limited. FIG. 13 shows a rule file 205A held by the master unit A. In the FW version 205A-1 of the rule file 205A, the upper limit of the FW version allowed for each unit is defined. In FW version 205A-1, the FW can be updated up to version 1.2. FIG. 14 shows a configuration in which the master unit A further includes a version acquisition unit 1059M that acquires the FW version from each unit. FIG. 15 shows an operation when the version acquisition unit 1059M acquires a version from the FW.

  As shown in FIG. 12, it is assumed that the unit B of the control device 105 (30) has a hardware failure and is replaced with the unit B-1. At this time, the FW version of unit B is 1.1, which conforms to the FW version 205A-1 of the rule file 205A installed in unit A. According to FW version 205A-1, FW can be updated up to version 1.2, but update to the latest 1.3 is not permitted. Therefore, when the latest version 1.3 FW is mounted on the unit B-1 to be replaced, it does not conform to the FW version 205A-1.

<*** Explanation of operation *****>
<Step S201>
The version acquisition unit 1059M of the master unit A acquires the FW version of each of the units B to E from each FW in addition to its own FW version when the control device 105 (30) is activated.

<Step S202>
The determination unit 1054M confirms the consistency between the rules described in the rule file 205A and the acquired version.

<Step S203>
When the latest version 1.3 FW is installed in the unit B-1, the determination unit 1054M confirms that the unit B-1 is the FW version 205A-1 of the rule file 205A by checking the consistency with the rule. Discover that the rules are not met.
In this case, the request transmission unit 1057M transmits a non-conformance signal 52 indicating unsuitability to the end user device 300. This nonconforming signal 52 is a transmission request 51. The transmission request 51 includes information on the update FW that is desired to be transmitted. The notification of non-conformity is not limited to the end user device 300, but a display function unit (not shown) of the master unit A having a function of receiving and displaying the notification, or an HMI (Human Machine Interface) via the network. , May be transmitted to other terminal apparatuses such as SCADA (Supervision Control And Data Acquisition).

<Steps S204 and S205>
When the end user apparatus 300 receives the transmission request 51, the development tool execution unit 310 accesses the update FW URL 203, and the distribution server 100 sends an update FW (B) (version 1.2) that conforms to the rules of the rule file 205A. It is acquired and transmitted to the control device 105 (S205).

<Step S206>
The update unit 1055M updates the FW of the unit B-1 using the update FW (B). In this case, the firmware of the unit B-1 is updated to “1.2” by the end user device 300 and the master unit A, and the process is completed.

<*** Explanation of effects *****>
The control device 105 according to the first embodiment stores a rule file 205 provided by the set maker 20. Therefore, the set maker 20 that manufactures the final product can control and limit the use of the end user of the FW update function of the control device 105.
In the first embodiment, the rule file 205 can be updated. Therefore, the set maker 20 can control and restrict the end user's use of the FW update function of the industrial control device in more detail and flexibly.
The rule file 205 can be downloaded from the website, but the set maker 20 can upload the new version rule file updated by the set maker apparatus 200 to the website. Therefore, the rules can be easily changed by the set maker 20, and the changed rules can be easily provided to the end user 30.

  In the first embodiment, the master unit determination unit 1054M checks the FW for updating the slave using the rule file 205A, so that the combination of FWs can be managed, and an inappropriate FW update is performed by the end user 30. Can be controlled. That is, the set manufacturer 20 can manage and control the update of the combination of FWs by defining the update conditions of the individual update FWs in the rule file 205A shown in FIG. Also, only the master unit determination unit 1054M of the master unit A determines whether or not the FW can be updated, and the slave unit itself does not update the FW. Therefore, the combination of FW can be integrated and managed.

  In the control device 105 according to the first embodiment, the version acquisition unit 1059M acquires the version of the FW, and the determination unit 1054M determines whether the acquired version matches the rule file 205A. Therefore, even when the unit is replaced by the end user 30, the combination of FW can be managed. In addition, when the version does not match, a compatible version update FW is acquired, so even if the version of the FW does not match, it can be quickly switched to the version compatible FW.

Embodiment 2. FIG.
The second embodiment will be described with reference to FIG. FIG. 16 is a hardware configuration example when the distribution server 100, the set maker device 200, the end user device 300, the control device 105, the master unit A, and the like are realized by a computer. This will be described with reference to FIG. The control device 105, which is a computer, will be described as an example. The description of the control device 105 also applies to the distribution server 100, the set maker device 200, and the end user device 300.

  The control device 105 includes hardware such as a processor 901, an auxiliary storage device 902, a memory 903, a communication device 904, an input interface 905, and a display interface 906. The processor 901 is connected to other hardware via the signal line 910, and controls these other hardware. The input interface 905 is connected to the input device 907. The display interface 906 is connected to the display 908.

  The processor 901 is an IC (Integrated Circuit) that performs processing. The processor 901 is, for example, a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit). The auxiliary storage device 902 is, for example, a ROM (Read Only Memory), a flash memory, or an HDD (Hard Disk Drive). The memory 903 is, for example, a RAM (Random Access Memory). The communication device 904 includes a receiver 9041 that receives data and a transmitter 9042 that transmits data. The communication device 904 is, for example, a communication chip or a NIC (Network Interface Card). The input interface 905 is a port to which the cable 911 of the input device 907 is connected. The input interface 905 is, for example, a USB (Universal Serial Bus) terminal. The display interface 906 is a port to which the cable 912 of the display 908 is connected. The display interface 906 is, for example, a USB terminal or an HDMI (registered trademark) (High Definition Multimedia Interface) terminal. The input device 907 is, for example, a mouse, a keyboard, or a touch panel. The display 908 is, for example, an LCD (Liquid Crystal Display).

  The auxiliary storage device 902 stores programs that realize the functions of the program storage unit 1051 to the verification unit 1058 shown in FIG. In the case of the master unit A shown in FIG. 14, programs that realize the functions of the program storage unit 1051M to the version acquisition unit 1059M are stored. The program storage unit 1051 to the verification unit 1058 and the program storage unit 1051M to the version acquisition unit 1059M are collectively referred to as “parts”. This program is loaded into the memory 903, read into the processor 901, and executed by the processor 901. More specifically, among the “units”, the storage unit is realized by a program, an auxiliary storage device 902, a memory 903, and the like. In addition, among the “units”, the transmission unit and the reception unit are realized by a program, the communication device 904, and the like. Other than the storage unit, transmission unit, and reception unit are implemented by a program. The auxiliary storage device 902 also stores an OS (Operating System). Then, at least a part of the OS is loaded into the memory 903, and the processor 901 executes a program that realizes the function of “unit” while executing the OS. Although one processor 901 is illustrated in FIG. 16, the control device 105 may include a plurality of processors 901. A plurality of processors 901 may execute a program for realizing the function of “unit” in cooperation with each other. In addition, information, data, signal values, and variable values indicating the processing results of “unit” are stored in the memory 903, the auxiliary storage device 902, or a register or cache memory in the processor 901.

  The “part” may be provided as “circuitry”. Further, “part” may be read as “circuit”, “process”, “procedure”, or “processing”. “Circuit” and “Circuitry” include not only the processor 901 but also other types of processing circuits such as a logic IC or GA (Gate Array) or ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array). It is a concept to include.

  As described above, the operation of the “unit” of the control device 105 and the master unit of the first embodiment can also be grasped as an update determination program or a program update method.

  M master unit, 1 FW update system, 10 control device manufacturer, 11 program update device, 20 set manufacturer, 30 end user, 40 communication network, 41, 42 route, 51 transmission request, 52 nonconforming signal, 100 distribution server, 102 update FW, 1020 update information, 103 website, 110 control unit, 120 update information generation unit, 130 communication unit, 140 storage unit, 105, 105 (10), 105 (20), 105 (30) control device, 1050 unit Device, 1051, 1051M program storage unit, 1052, 1052M rule storage unit, 1053, 1053M update information reception unit, 1054, 1054M determination unit, 1055, 1055M update unit, 1056, 1056M rule information reception unit, 1057, 1 057M request transmission unit, 1058, 1058M verification unit, 1059M version acquisition unit, 200 set maker device, 201 development tool, 202 project file, 203 update FW URL, 204 rule file URL, 205 rule file, 2051 rule information, 2052 new version rule Information, 205-1 FW version, 205-2, 205-3 attribute, 206 public key, 207 digital signature, 2060 verification information, 210 development tool execution unit, 211 project file generation unit, 212 rule information generation unit, 220 communication unit , 230 storage unit, 300 end user device, 3000 download device, 301 development tool, 310 development tool execution unit, 320 communication unit, 330 storage unit.

Claims (8)

In the control device manufactured by the control device manufacturer and included in the final product assembled by the set manufacturer,
A program storage unit for storing the program;
A rule storage unit that stores rule information generated by a set maker apparatus of the set maker, which is rule information in which rules for updating the program are defined;
An update information receiving unit for receiving update information for updating the program and generated by the distribution server device of the control device manufacturer ;
A determination unit that determines whether the update information matches the rule information;
A control apparatus provided with the update part which updates the said program which the said program memory | storage part memorize | stores using the said update information, when it determines with the said determination part adapting. The control device further includes:
A rule information receiving unit that receives the new version rule information generated by the set maker device, which is the new version rule information in which the rule information is updated;
A request transmitter for transmitting a transmission request for requesting transmission of the update information when the new version rule information is received;
The update information receiving unit
In response to the transmission request, the update information is received,
The determination unit
The control device according to claim 1, wherein the update information received as a response by the update information receiving unit determines whether or not the new version rule information matches. The rule information stored in the rule storage unit is:
Have verification information,
The control device further includes:
Based on the verification information and the new version rule information received by the rule information receiving unit, the new version rule information is verified if the new version rule information is verified as valid as a result of the verification. The control device according to claim 2, further comprising: a verification unit that discards. The rule information receiving unit
The control device according to claim 2, wherein the new version rule information is received from a download device that downloads the new version rule information uploaded to the website from the website. A master device that is a control device manufactured by the control device manufacturer and included in the final product assembled by the set manufacturer, and is a master unit device, and a slave unit that is a slave unit device In a composite unit device that is a control device comprising a plurality of unit devices,
The master unit is
A rule storage unit for storing rule information in which rules for updating the program of each of the unit devices are defined and generated by the set manufacturer device of the set manufacturer ;
An update information receiving unit that receives the update information for each unit device, which is update information generated by the distribution server device of the control device manufacturer, for updating the program of each unit device;
A determination unit that determines whether the update information matches the rule information;
A composite unit device comprising: an update unit that updates a program of the unit device corresponding to the update information using the update information when it is determined that the determination unit is compatible. The master unit further includes:
A version acquisition unit that acquires the version of each unit device program from each unit device;
The rule information stored in the rule storage unit is:
The versions allowed for each unit device program are defined,
The determination unit
It is determined whether the version of each unit device program acquired by the version acquisition unit conforms to the version defined in the rule information,
The master unit further includes:
The composite unit device according to claim 5, further comprising: a request transmission unit that outputs a non-conformance signal indicating non-conformity when it is determined that at least one of the versions acquired by the version acquisition unit does not conform. A control device manufactured by a control device manufacturer and a control device included in an end product assembled by a set manufacturer, and a computer that is a control device having a storage device,
Processing for storing a program in the storage device;
Processing for storing in the storage device the rule information in which rules for updating the program are defined and generated by the set maker device of the set maker ;
Processing for receiving update information for updating the program and generated by the distribution server device of the control device manufacturer ;
A process of determining whether the update information matches the rule information;
A process for updating the program stored in the storage device by using the update information when it is suitable;
Update judgment program for executing A control device manufactured by a control device manufacturer and included in a final product assembled by a set manufacturer, and includes a program storage unit, a rule storage unit, an update information reception unit, a determination unit, and an update unit In the program update method performed by the control device,
The program storage unit stores a program,
The rule storage unit stores rule information that is a rule information in which rules for updating the program are defined and is generated by a set maker device that the set maker has ,
The update information receiving unit is update information for updating the program, and receives update information generated by a distribution server device of the control device manufacturer ,
The determination unit determines whether the update information matches the rule information;
A program update method for updating the program stored in the program storage unit using the update information when the update unit determines that the determination unit is suitable.

Images