Safety systems and maintenance methods

Abstract

The security system includes: a processing execution unit that performs security control according to a security program; a communication unit that forwards external access to the security program held by the processing execution unit; a support device that forwards the security program to the communication unit via a network according to a user operation; and a prompting unit that prompts the user with information related to the security program forwarded from the support device. The communication unit forwards the security program forwarded from the support device to the processing execution unit under the condition of an instruction from the user.

Description

Technical Field

[0001] The present invention relates to a remote maintenance function for a security system. Background Art

[0002] In order to safely use equipment or machinery used in various manufacturing sites, it is necessary to recognize functional safety in accordance with international standards such as IEC 61508.

[0003] Such functional safety is sometimes achieved by executing a safety program using a safety controller. For example, Japanese Patent Application Laid-Open No. 2010-055652 (Patent Document 1) discloses a program development support device for a safety controller.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: Japanese Patent Application Publication No. 2010-055652 Summary of the invention

[0007] Problems to be solved by the invention

[0008] Generally, an environment is provided for performing various maintenance on a controller or the like that performs safety control according to a safety program. Such an environment for performing maintenance on safety control must be configured in accordance with international standards such as IEC 62061.

[0009] As a result, maintenance related to safety control has to be performed at the site where the controller is installed, which restricts improvement of maintenance efficiency and productivity.

[0010] An object of the present invention is to provide a structure that can more safely perform remote maintenance on a process execution unit that executes safety control according to a safety program.

[0011] Means for solving problems

[0012] A security system according to one aspect of the present invention includes: a processing execution unit that executes security control according to a security program; a communication unit that mediates external access to the security program held by the processing execution unit; a support device that transfers the security program to the communication unit via a network according to a user operation; and a prompting unit that prompts the user with information related to the security program transferred from the support device. The communication unit transfers the security program transferred from the support device to the processing execution unit under the condition of an instruction from the user.

[0013] According to the present invention, the information related to the safety program transferred from the support device is presented to the user, and when the user gives a transfer instruction, the safety program is first transferred to the processing execution unit. Therefore, during remote maintenance, the safety program is updated in cooperation with the user on site, so that remote maintenance can be performed more safely.

[0014] The support device may assign the input first password to the security program and transfer it to the communication unit. The communication unit may transfer the security program transferred from the support device to the processing execution unit on the condition that the second password input by the user matches the first password.

[0015] According to this configuration, the safety program can be transferred to the processing execution unit on the condition of cooperation between the user who transferred the safety program from the support device and the user who participated in the communication device that received the safety program, so remote maintenance can be performed more safely.

[0016] The first password may be any one of an arbitrary character string, any one of predetermined candidates, and a value randomly determined by the support device. According to this configuration, a first password of an appropriate format can be used according to usage conditions and requirements in the security system.

[0017] Alternatively, the communication unit may transfer the security program transferred from the support device to the processing execution unit on condition that the user authentication for the user is successful and the user who has successfully authenticated the user is set with a predetermined operation authority. According to this structure, authentication processing beyond the usual user authentication is not required, thus simplifying the user's procedures.

[0018] The communication unit may discard the security program transferred from the support device in response to a transfer rejection instruction from the user. According to this configuration, when the transfer of the security program is rejected, the risk of the communication unit holding an unnecessary security program can be eliminated.

[0019] The information on the safety program may include at least one of an updater of the safety program, an update date and time of the safety program, and a transfer destination of the safety program. According to this configuration, the user can determine whether to allow transfer of the safety program after understanding the details of the safety program.

[0020] The presenting means may include at least one of a display operation device connected to the communication unit through a network, an indicator disposed on the exposed surface of the processing execution unit, and an indicator disposed on the exposed surface of the communication unit. According to this configuration, necessary information can be presented to the user in various forms.

[0021] Alternatively, the communication unit may hold an electronic key. Alternatively, the support device may encrypt the security program so that the communication unit can decrypt the program using the electronic key and then transfer the encrypted program to the communication unit. According to this structure, the security program can be reliably transferred to the target communication unit, and the security program can be prevented from being rewritten during transfer.

[0022] Alternatively, the communication unit may hold a secret key as an electronic key. Alternatively, the support device may hold a public key paired with the secret key. According to this structure, key management in the communication unit and the support device can be easily performed.

[0023] Alternatively, the support device may generate a one-time key when the security program needs to be transferred, encrypt the one-time key with a public key and send it to the communication unit, and encrypt the security program with the one-time key and send it to the communication unit. According to this structure, the security program can be encrypted with the one-time key, thereby preventing the increase of security protection risks caused by the leakage of keys, and making it easy to manage keys.

[0024] According to another aspect of the present invention, a maintenance method in a controller system is provided. The controller system includes: a processing execution unit that performs security control according to a security program; a communication unit that transfers external access to the security program maintained by the processing execution unit; and a support device. The maintenance method includes the following steps: the support device transfers the security program to the communication unit via a network according to a user operation; prompts the user with information related to the security program transferred from the support device; and transfers the security program transferred from the support device to the processing execution unit under the condition of an instruction from the user.

[0025] Effects of the Invention

[0026] According to the present invention, remote maintenance can be performed more safely on a processing execution unit that performs safety control according to a safety program. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is an external view showing a configuration example of the safety system according to the present embodiment.

[0028] Figure 2 This is a schematic diagram for explaining the outline of remote maintenance in the safety system according to the present embodiment.

[0029] Figure 3 1 is a schematic diagram showing a hardware configuration example of a control unit constituting the safety system according to the present embodiment.

[0030] Figure 4 This is a schematic diagram showing a hardware configuration example of a relay unit constituting the security system according to the present embodiment.

[0031] Figure 5 1 is a schematic diagram showing a hardware configuration example of a safety unit constituting the safety system according to the present embodiment.

[0032] Figure 6 This is a diagram for explaining the requirements for maintenance of the safety system according to the present embodiment.

[0033] Figure 7 1 is a schematic diagram showing a hardware configuration example of a support device connected to the safety system according to the present embodiment.

[0034] Figure 8 This is a diagram for explaining maintenance performed by directly connecting the safety system and the support device according to the present embodiment.

[0035] Fig. 9 This is a diagram for explaining issues in remote maintenance of a safety system from a support device.

[0036] Fig.10 This is a diagram for explaining one form of remote maintenance of the safety system according to the present embodiment from a support device.

[0037] Fig.11 This is a diagram for explaining another form of remote maintenance of the safety system according to the present embodiment from the support device.

[0038] Fig.12 This is a diagram for explaining an example of an improved form of remote maintenance of the safety system according to the present embodiment from a support device.

[0039] Fig.13 It is shown in Fig.12 The diagram shown is a schematic diagram of an example of a user interface presented on a display and operating device during remote maintenance.

[0040] Fig.14 It is shown Fig.12 The following is a sequence diagram of the process steps in remote maintenance.

[0041] Fig.15 This is a diagram for explaining another example of an improved form of remote maintenance of the safety system according to the present embodiment from the support device.

[0042] Fig.16 It is shown Fig.15 The following is a sequence diagram of the process steps in remote maintenance.

[0043] Fig.17 This is a diagram for explaining still another example of an improved form of remote maintenance of the safety system according to the present embodiment from the support device.

[0044] Fig.18 It is shown in Fig.17Schematic diagram of an example of a user interface prompted in a display operation device during remote maintenance as shown.

[0045] Fig.19 It shows Fig.17 Sequence diagram of the processing steps in the remote maintenance as shown.

[0046] Fig. 20 It is a diagram for explaining another example of an improved method for remote maintenance of the security system of the present embodiment from a support device.

[0047] Fig.21 It shows Fig. 20 Diagram of an example of the operation authority information as shown. Detailed implementation mode

[0048] The embodiments of the present invention will be described in detail with reference to the accompanying drawings. In addition, the same or corresponding parts in the drawings are denoted by the same reference numerals and their description is omitted.

[0049] <A. Application example>

[0050] First, the overall structure of the security system 1 of the present embodiment will be described.

[0051] Figure 1 It is an external view showing a structural example of the security system 1 of the present embodiment. Refer to Figure 1 , the security system 1 includes a control unit 100, a relay unit 200, a security unit 300, one or more functional units 400, and a power supply unit 450.

[0052] The control unit 100 is connected to the relay unit 200 via an arbitrary data transmission path (such as PCI Express (registered trademark) or Ethernet, etc.). The control unit 100 is connected to the security unit 300 and one or more functional units 400 via an internal bus 10 (refer to Figure 2 ).

[0053] The control unit 100 performs central processing in the security system 1. The control unit 100 performs a control operation for controlling a controlled object according to arbitrarily designed requirement specifications. When compared with the control operation performed by the security unit 300 described later, the control operation performed by the control unit 100 is referred to as "standard control". In Figure 1 In the structural example shown, the control unit 100 has one or more communication ports. The control unit 100 corresponds to a processing execution unit that executes standard control according to a standard control program.

[0054] The relay unit 200 is connected to the control unit 100 and is responsible for the communication function with other devices. In Figure 1In the illustrated configuration example, the relay unit 200 has one or more communication ports. The communication function provided by the relay unit 200 will be described in detail later.

[0055] The safety unit 300 independently performs control operations for realizing safety functions related to the control object and the control unit 100. The control operations performed by the safety unit 300 are called "safety control". Generally, "safety control" is designed to meet the requirements for realizing safety functions specified by IEC 61508 and the like. "Safety control" is a general term for processing to prevent equipment, machinery, etc. from threatening human safety. The safety unit 300 is equivalent to a processing execution unit that executes safety control according to the safety program SPG.

[0056] The functional unit 400 provides various functions for realizing the control of various control objects by the safety system 1. Typically, the functional unit 400 may include an I / O unit, a safety I / O unit, a communication unit, a motion controller unit, a temperature adjustment unit, a pulse counter unit, etc. As the I / O unit, for example, a digital input (DI) unit, a digital output (DO) unit, an analog input (AI) unit, an analog output (AO) unit, a pulse capture input unit, and a composite unit formed by mixing multiple types, etc. The safety I / O unit is responsible for the I / O processing of the safety control.

[0057] The power supply unit 450 supplies power of a predetermined voltage to each unit constituting the safety system 1 .

[0058] In the safety system 1 of the present embodiment, remote maintenance of the safety unit 300 that executes safety control is possible.

[0059] Figure 2 Schematic diagram for explaining the outline of remote maintenance in the safety system 1 of the present embodiment. Figure 2 , the support device 500 can be connected to the security system 1 via a network.

[0060] More specifically, the support device 500 is connected to the relay unit 200 corresponding to a communication unit through a network. The relay unit 200 relays external access from the support device 500 to the standard control program held by the control unit 100 and the safety program SPG held by the safety unit 300 .

[0061] The support device 500 can remotely maintain the safety program SPG through an application executed by the support device 500. As a typical process of remote maintenance, the support device 500 transfers the safety program SPG to the relay unit 200 via the network according to a user operation. The relay unit 200 transfers the transferred safety program SPG to the safety unit 300.

[0062] In this specification, "maintenance" is a concept that includes operations such as monitoring or changing the state of the safety unit 300 responsible for safety control or the safety program SPG executed by the safety unit 300. "Maintenance" is basically executed by the operator OP1 (user) operating the support device 500. In this specification, a term such as "remote maintenance" means that maintenance is carried out in a state where the operator OP1 of the support device 500 is located at a place where the safety system 1 (safety unit 300) to be maintained cannot be directly confirmed (visually).

[0063] In the present embodiment, in remote maintenance, in order to more reliably ensure the safety of the operator OP2 at the site where the safety system 1 is configured, as an implementation condition of remote maintenance, it includes the confirmation and instruction of the operator OP2 at the site.

[0064] More specifically, the safety system 1 presents information related to the safety program SPG transferred from the support device 500 to the operator OP2 (user) at the site. Then, the relay unit 200 transfers the safety program SPG transferred from the support device 500 to the safety unit 300 on the condition of the instruction from the operator OP2 (user) at the site.

[0065] By setting such presentation of information related to the safety program SPG to the operator OP2 at the site and the instruction from the operator OP2 at the site as reflection conditions of the safety program SPG, it is possible to increase the participation of the operator OP2 at the site and more reliably ensure safety.

[0066] <B. Hardware Structure Examples of Each Unit>

[0067] Next, a hardware structure example of each unit constituting the safety system 1 of the present embodiment will be described.

[0068] (b1: Control Unit 100)

[0069] Figure 3 It is a schematic diagram showing a hardware structure example of the control unit 100 constituting the safety system 1 of the present embodiment. Referring to Figure 3 , as main components, the control unit 100 includes a processor 102 such as a CPU (Central Processing Unit) or a GPU (Graphical Processing Unit), a chipset 104, a main storage device 106, a secondary storage device 108, a communication controller 110, a USB (Universal Serial Bus) controller 112, a memory card interface 114, network controllers 116, 118, 120, an internal bus controller 122, and an indicator 124.

[0070] The processor 102 reads various programs stored in the secondary storage device 108, expands and executes them in the main storage device 106, thereby realizing control operations of standard control and various processes described below. The chipset 104 mediates data exchange between the processor 102 and various components, thereby realizing the overall processing of the control unit 100.

[0071] The main storage device 106 is composed of a volatile storage device such as DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory). The secondary storage device 108 is composed of a nonvolatile storage device such as HDD (Hard Disk Drive) or SSD (Solid State Drive).

[0072] In addition to the system program, the secondary storage device 108 also stores a control program that operates in an execution environment provided by the system program.

[0073] The communication controller 110 is responsible for data exchange with the relay unit 200. As the communication controller 110, for example, a communication chip compatible with PCI Express or Ethernet can be used.

[0074] The USB controller 112 is responsible for data exchange with any information processing device via a USB connection.

[0075] The memory card interface 114 is configured to allow the memory card 115 to be inserted and removed, and can write a control program or various setting data to the memory card 115 or read a control program or various setting data from the memory card 115 .

[0076] The network controllers 116, 118, and 120 are responsible for data exchange with any device via the network. The network controllers 116, 118, and 120 may also use industrial network protocols such as EtherCAT (registered trademark), EtherNet / IP (registered trademark), DeviceNet (registered trademark), and CompoNet (registered trademark).

[0077] The internal bus controller 122 is responsible for data exchange with the safety unit 300 or one or more functional units 400 constituting the safety system 1. Figure 2 ) can use the manufacturer's inherent communication protocol, or can use a communication protocol that is the same as or based on any industrial network protocol.

[0078] The indicator 124 notifies the control unit 100 of the operating state and the like, and is composed of one or more LEDs and the like disposed on the exposed surface of the unit.

[0079] Figure 3 The example of a structure in which the processor 102 executes a program to provide the necessary functions is shown, but a dedicated hardware circuit (such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array)) may be used to implement part or all of these provided functions. Alternatively, the main part of the control unit 100 may be implemented using hardware based on a general-purpose architecture (such as an industrial personal computer based on a general-purpose personal computer). In this case, virtualization technology may be used to execute multiple OS (Operating System) with different purposes in parallel, and necessary applications may be executed on each OS.

[0080] (b2: relay unit 200)

[0081] Figure 4 2 is a schematic diagram showing a hardware configuration example of the relay unit 200 constituting the security system 1 of the present embodiment. Figure 4 As main components, the relay unit 200 includes a processor 202 such as a CPU or a GPU, a chipset 204, a primary storage device 206, a secondary storage device 208, a communication controller 210, a communication interface 212, a memory card interface 214, network controllers 216, 218 and an indicator 224.

[0082] The processor 202 reads various programs stored in the secondary storage device 208, expands and executes them in the main storage device 206, thereby realizing various communication functions described below. The chipset 204 mediates data exchange between the processor 202 and various components, thereby realizing the overall processing of the relay unit 200.

[0083] In addition to the system program, the secondary storage device 208 also stores a communication processing program that operates on an execution environment provided by the system program.

[0084] The communication controller 210 is responsible for data exchange with the control unit 100. As the communication controller 210, similar to the communication controller 210 in the control unit 100, for example, a communication chip compatible with PCI Express or Ethernet can be used.

[0085] The communication interface 212 is responsible for data exchange with any information processing device via a USB connection.

[0086] The memory card interface 214 is configured to allow the memory card 215 to be inserted and removed, and can write a control program or various setting data to the memory card 215 or read a control program or various setting data from the memory card 215 .

[0087] The network controllers 216 and 218 are respectively responsible for exchanging data with any device via the network. The network controllers 216 and 218 may also use a common network protocol such as Ethernet.

[0088] The indicator 224 notifies the operating state of the relay unit 200 and the like, and is composed of one or more LEDs and the like disposed on the exposed surface of the unit.

[0089] Figure 4 The configuration example in which the processor 202 executes a program to provide necessary functions is shown, but a part or all of these provided functions may be implemented using a dedicated hardware circuit (such as an ASIC or FPGA, etc.). Alternatively, the main part of the relay unit 200 may be implemented using hardware based on a general-purpose architecture (such as an industrial personal computer based on a general-purpose personal computer). In this case, a plurality of OSs with different purposes may be executed in parallel using virtualization technology, and necessary applications may be executed on each OS.

[0090] (b3: safety unit 300)

[0091] Figure 5 Schematic diagram showing a hardware configuration example of the safety unit 300 constituting the safety system 1 of the present embodiment. Figure 5 As main components, the security unit 300 includes a processor 302 such as a CPU or a GPU, a chipset 304, a primary storage device 306, a secondary storage device 308, a memory card interface 314, an internal bus controller 322 and an indicator 324.

[0092] The processor 302 reads various programs stored in the secondary storage device 308, expands and executes them in the main storage device 306, thereby realizing the control operation of security control and various processes described below. The chipset 304 transfers data exchange between the processor 302 and various components, thereby realizing the overall processing of the security unit 300.

[0093] In addition to the system program, the secondary storage device 308 also stores a security program that operates in an execution environment provided by the system program.

[0094] The memory card interface 314 is configured to allow the memory card 315 to be inserted and removed, and can write a security program or various setting data to the memory card 315 or read a security program or various setting data from the memory card 315 .

[0095] The internal bus controller 322 is responsible for data exchange with the control unit 100 via the internal bus 10 (refer to Figure 2 ).

[0096] The indicator 324 notifies the operation status of the security unit 300 and the like, and is composed of one or more LEDs or the like arranged on the exposed surface of the unit.

[0097] Figure 5 A structural example in which the processor 302 executes a program to provide necessary functions is shown. However, dedicated hardware circuits (such as ASICs or FPGAs) can also be used to install part or all of the provided functions. Alternatively, hardware based on a general architecture (such as an industrial personal computer based on a general personal computer) can also be used to implement the main part of the security unit 300. In this case, virtualization technology can also be used to execute multiple operating systems with different uses in parallel, and execute necessary applications on each operating system.

[0098] <C. Maintenance of the security system 1>

[0099] Next, the maintenance of the security system 1 according to the present embodiment will be described.

[0100] Figure 6 It is a diagram for explaining the requirements for the maintenance of the security system 1 according to the present embodiment. In Figure 6 , as a typical example, it is assumed that the user program (security program SPG) stored in the security unit 300 (hereinafter also referred to as "device") is rewritten using the user program (security program SPG) generated by the support device 500.

[0101] Figure 6 The requirements shown are defined by "6.11.2 Software Based Parameterization" of IEC 62061:2005, etc.

[0102] 1. The operator performing the maintenance has the authority (for example, permission confirmation using a password)

[0103] 2. The security program SPG sent from the support device 500 to the device is a debugged program

[0104] 3. The device to be rewritten can be uniquely identified (for example, the support device 500 and the device are directly connected, or the determination is made using the unique name or serial number of the target device)

[0105] 4. The file rewritten from the support device 500 is consistent with the file on the device (for example, confirmation using a checksum)

[0106] 5. Operator safety at the site (e.g., a situation where injury due to malfunction or stop does not occur)

[0107] For the maintenance of the safety unit 300 that performs safety control rather than the control unit 100 that performs standard control, the above-mentioned stricter requirements are needed.

[0108] In the present embodiment, in addition to performing maintenance at the site where the safety system 1 is configured, the support device 500 configured at a distance can also be operated to maintain the safety system 1. Hereinafter, the maintenance performed by operating the support device 500 configured at a distance is referred to as "remote maintenance".

[0109] "The operator performing maintenance has permission" as requirement 1 means ensuring the correctness of the sender (or transmitter) of the safety program SPG.

[0110] "The device to be rewritten can be uniquely identified" as requirement 3 means ensuring the correctness of the transfer destination of the safety program SPG.

[0111] "The file rewritten from the support device 500 is the same as the file on the device" as requirement 4 means ensuring the correctness of the safety program SPG transferred to the safety unit 300.

[0112] In order to implement remote maintenance for the safety unit 300, it is particularly preferable to consider the above-mentioned requirement 3. In addition, it is also preferable to consider requirement 5.

[0113] Hereinafter, the structure for implementing remote maintenance for the safety system 1 will be described.

[0114] <D. Example of the hardware structure of the support device 500>

[0115] Next, an example of the hardware structure of the support device 500 connected to the safety system 1 of the present embodiment will be described.

[0116] Figure 7 It is a schematic diagram showing an example of the hardware structure of the support device 500 connected to the safety system 1 of the present embodiment. As an example, the support device 500 is implemented using hardware based on a general architecture (e.g., a general personal computer).

[0117] Refer to Figure 7 , the support device 500 includes a processor 502 such as a CPU or GPU, a main storage device 504, an input unit 506, an output unit 508, a secondary storage device 510, an optical drive 512, and a communication interface 520. These components are connected via a processor bus 518.

[0118] The processor 502 reads out a program (for example, the OS 5102 and the support program 5104 ) stored in the secondary storage device 510 , expands and executes the program in the main storage device 504 , thereby realizing various processes described below.

[0119] In addition to the OS 5102 for realizing basic functions, the secondary storage device 510 also stores a support program 5104 for providing functions as the support device 500. The support program 5104 is executed by an information processing device (substantially the processor 502) as a computer, thereby realizing the support device 500 of this embodiment.

[0120] The secondary storage device 510 stores a project 5106 generated by a user in a development environment provided by executing the support program 5104. Furthermore, the secondary storage device 510 may store keys (private keys and public keys) and certificates described later.

[0121] In this embodiment, the support device 500 provides a development environment that can perform integrated settings for each device included in the safety system 1 and generate programs executed by each device. Project 5106 includes data generated by this integrated development environment. Typically, project 5106 includes a standard control source program 5108 and a safety source program 5112.

[0122] After being converted into the target code, the standard control source program 5108 is transferred to the control unit 100 and stored as the standard control program. After being converted into the target code, the safety source program 5110 is transferred to the safety unit 300 and stored as the safety program.

[0123] The input unit 506 is composed of a keyboard, a mouse, etc., and receives user operations. The output unit 508 is composed of a display, various indicators, a printer, etc., and outputs processing results from the processor 502, etc.

[0124] The communication interface 520 exchanges data with the security system 1 via any communication medium such as USB or Ethernet.

[0125] The support device 500 includes an optical drive 512 that reads a program stored in a recording medium 514 (eg, an optical recording medium such as a DVD (Digital Versatile Disc)) that non-temporarily stores computer-readable commands, and installs the program in the secondary storage device 510 or the like.

[0126] The support program 5104 and the like executed by the support device 500 can be installed via a computer-readable recording medium 514, but can also be installed in the form of being downloaded from a server device or the like on the network. In addition, the functions provided by the support device 500 in the present embodiment are sometimes implemented in the form of using a part of the modules provided by the OS.

[0127] Figure 7 A structural example is shown in which the functions required for the support device 500 are provided by executing a program by the processor 502, but a part or all of these provided functions can also be installed using dedicated hardware circuits (such as ASICs or FPGAs).

[0128] In addition, during the operation of the security system 1, the support device 500 can also be removed from the security system 1.

[0129] <E. Structure for ensuring the correct transfer destination of the security program (requirement 3)>

[0130] First, a structure for implementing "able to uniquely identify the device to be rewritten" as requirement 3 will be described.

[0131] (e1: Problem)

[0132] Figure 8 This is a diagram for explaining the maintenance performed by directly connecting the security system 1 and the support device 500 of the present embodiment. Refer to Figure 8 , when the support device 500 and the security system 1 (security unit 300) are directly connected on-site, the operator operating the support device 500 can visually confirm the device (security unit 300) at the connection destination, and thus can uniquely identify the device to be rewritten through this visual inspection and connection operation.

[0133] Fig. 9 This is a diagram for explaining the problems in the remote maintenance from the support device 500 to the security system 1. Refer to Fig. 9 , the support device 500 is electrically connected to the security system 1 via the network 4.

[0134] In the network 4, the security system 1 is determined by the network address (typically an IP address) assigned to the relay unit 200.

[0135] The support device 500 has a list LS that associates the names and IP addresses of the devices (security units 300) that are pre-registered as transfer destinations. The operator refers to the list LS and selects the security unit 300 that is the transfer destination. In Fig. 9In the example shown, "192.168.250.1" (Safety_1) is selected as the IP address. Then, the support device 500 transfers the safety program SPG to the device having the selected IP address according to the operation of the operator.

[0136] Here, the IP address can be arbitrarily set for each device, or may be dynamically assigned by a router, etc. Therefore, “192.168.250.1” may be erroneously set for another security system 2 .

[0137] Alternatively, the transfer destination may be disguised as another security system 2 by impersonation or the like.

[0138] Thus, by merely specifying an IP address, it is not possible to ensure that the transfer destination of the safety program SPG is correct due to erroneous settings, impersonation, etc. That is, even if the safety program SPG is transferred to a wrong system, it may not be noticed.

[0139] (e2: Solution 1)

[0140] As a target Figure 8 The solution to the problem 1 shown is a method of using encryption based on a key.

[0141] Fig.10 1 is a diagram for explaining one method of remote maintenance of the safety system 1 of the present embodiment from the support device 500. Fig.10 In the structure shown, the relay unit 200 of the security system 1 holds an electronic key, and the support device 500 encrypts the data required for maintenance (typically the security program SPG) in a manner that can be decrypted using the electronic key held by the relay unit 200 and transfers it to the relay unit 200.

[0142] More specifically, a key pair consisting of a secret key based on a public key and a public key is prepared in advance for the security system 1. The secret key is stored in the relay unit 200, and the corresponding public key is stored in the support device 500. That is, the relay unit 200 holds the secret key as an electronic key, and the support device 500 holds the public key paired with the secret key.

[0143] For example, the safety system 1 (relay unit 200) having "192.168.250.1" (Safety_1) as the IP address stores the secret key SK1, and the corresponding public key PK1 is associated with the record of "192.168.250.1" in the list LS held by the support device 500. In addition, in order to prevent the public key PK1 from being masqueraded, the server certificate generated by authenticating the public key PK1 by the certification authority may be stored in the support device 500.

[0144] In this way, the relay unit 200 holds the secret key SK1 as an electronic key. In addition, the support device 500 holds at least one of the public key PK1 paired with the secret key SK1 and the server electronic certificate issued for the public key PK1.

[0145] In remote maintenance, the support device 500 encrypts the security program SPG using the public key of the selected transfer destination when transferring the security program SPG to the device with the selected IP address according to the operator's operation. The encrypted security program SSP (transfer data) generated by encryption is transferred to the transfer destination.

[0146] When the encrypted security program SSP (transfer data) is transferred to the security system 1 which is the original transfer destination, it can be decrypted using the secret key SK1 stored in the relay unit 200 of the security system 1 .

[0147] On the other hand, if the encrypted security program SSP (transfer data) is transferred to the wrong transfer destination, that is, the security system 2, it cannot be decrypted using the secret key SK2 stored in the relay unit 200 of the security system 2. Alternatively, it is assumed that no secret key is stored in the relay unit 200 of the security system 2. In this case, the transfer data cannot be decrypted either.

[0148] Furthermore, even if the transferred data is received by some method, the transferred data cannot be decrypted in the security system 2 .

[0149] In this way, the support device 500 can decrypt the forwarding data at the forwarding destination only when the forwarding data is forwarded to the security system 1 having the key pre-associated with the selected forwarding destination, so the security program SPG will not be sent to the wrong forwarding destination. Therefore, even if there is an incorrect IP address setting of the forwarding destination or an IP address impersonation, the security program SPG can be forwarded to the correct forwarding destination. In addition, when the relay unit 200 can decrypt the data (encrypted security program SSP) forwarded from the support device 500 using the secret key SK1, the decrypted data (security program SPG) is forwarded to the security unit 300.

[0150] In addition, the relay unit 200 may perform virus scanning on the decrypted security program SPG and then transfer it to the security unit 300. This is to take into account the possibility of virus infection before encryption in the support device 500.

[0151] (e3: Solution 2)

[0152] In the above-mentioned solution 1, a configuration is exemplified in which the transfer data is generated using the public key of the transfer destination. However, from the viewpoint of improving the efficiency of the encryption and decryption processing and increasing the transfer speed, a common key may be further used.

[0153] Fig.11 1 is a diagram for explaining another method of remote maintenance of the safety system 1 of the present embodiment from the support device 500. Fig.11 In the structure shown, Fig.10 Similarly to the structure shown, a key pair consisting of a secret key and a public key is prepared in advance for the security system 1.

[0154] First, in the support device 500, the security program SPG is encrypted by the public key TCK, which is a one-time key generated each time, to generate an encrypted security program SSP (transfer data). At the same time, the public key TCK is encrypted by the public key of the selected transfer destination to generate an encrypted public key STC.

[0155] The encrypted security program SSP and the encrypted public key STC are transferred from the support device 500 to the selected transfer destination.

[0156] In this way, the support device 500 generates a one-time key, namely a public key TCK, when it is necessary to transfer the security program SPG. Then, the support device 500 encrypts the one-time key, namely the public key TCK, using the public key (encrypted public key STC), and sends it to the relay unit 200. At the same time, the support device 500 encrypts the security program SPG using the public key TCK (encrypted security program SSP), and sends it to the relay unit 200.

[0157] The relay unit 200 of the security system 1 at the forwarding destination decrypts the encrypted public key STC received from the support device 500 into the public key TCK using the secret key SK1 of the device. Then, the relay unit 200 of the security system 1 at the forwarding destination decrypts the encrypted security program SSP (forwarding data) received from the support device 500 into the security program SPG using the decrypted public key TCK.

[0158] On the other hand, if the encrypted security program SSP and the encrypted public key STC are forwarded to the wrong forwarding destination, i.e., the security system 2, the data cannot be decrypted using the secret key SK2 stored in the relay unit 200 of the security system 2. Alternatively, assuming that no secret key is stored in the relay unit 200 of the security system 2, the forwarded data cannot be decrypted in this case.

[0159] In addition, even if data from the support device 500 is received by a certain method, the transferred data cannot be decrypted in the security system 2.

[0160] In this way, the support device 500 can decrypt at the transfer destination only when it transfers the transfer data to the security system 1 that has a key pre-associated with the selected transfer destination. Therefore, the security program SPG is not sent to the wrong transfer destination. Thus, even if there is a setting of a wrong IP address of the transfer destination or an impersonation of the IP address, the security program SPG can be transferred to the correct transfer destination.

[0161] (e4: Use of a certification authority)

[0162] The public keys of the respective devices used by the support device 500 can be obtained directly or indirectly from the security system 1 (or the relay unit 200) that is the transfer destination. Alternatively, the public keys can be registered with a certification authority (CA: Certificate Authority), and a server certificate for the public key issued by the certification authority can be used as the public key of each device. By using a certification authority, it is possible to prevent the forgery of public keys and the like.

[0163] <F. Structure for ensuring the safety of on-site workers (requirement 5)>

[0164] First, the structure for implementing "safety of on-site workers" as requirement 5 will be described.

[0165] (f1: Problem)

[0166] In the above Fig.10 and Fig.11 In the solution shown, the operator operates the support device 500, and as a result, a new security program SPG is transferred to the security unit 300. Usually, the operator of the support device 500 contacts the on-site worker in charge of the site where the security unit 300 is configured and performs the rewrite operation of the security program SPG. Therefore, there is no problem with the safety of the worker.

[0167] However, it is more preferable to ensure such an exchange in the system. That is, it is preferable to construct a system that can ensure the safety of on-site workers.

[0168] (f2: Solution 1)

[0169] As Solution 1 for systematically ensuring the above requirement 5, the following structural example is shown: Making the explicit operation of the on-site worker a condition for reflecting the new security program SPG transferred from the support device 500 to the security unit 300.

[0170] Fig.12This is a diagram for explaining an example of an improved form of remote maintenance from the support device 500 on the safety system 1 according to the present embodiment. Fig.12 The structure shown is equivalent to the above Fig.10 The structure shown in the figure is improved. Fig.12 The safety system 1 shown is connected to a display operation device 600 that accepts operations by a worker at a site. As a specific example, the display operation device 600 is connected to the relay unit 200 via a network.

[0171] exist Fig.12 In the illustrated configuration, the safety program SPG transferred from the support device 500 during remote maintenance is not directly transferred to the safety unit 300 but is temporarily stored in the relay unit 200. Then, upon explicit instruction from an on-site operator, the safety program SPG is transferred from the relay unit 200 to the safety unit 300.

[0172] More specifically, in remote maintenance, the support device 500 encrypts the security program SPG using the public key of the selected transfer destination when transferring the security program SPG to the device having the selected IP address according to the operation of the operator. The encrypted security program SSP (transfer data) generated by encryption is transferred to the transfer destination. When the encrypted security program SSP (transfer data) is transferred to the original transfer destination, that is, the security system 1, it can be decrypted using the secret key SK1 stored in the relay unit 200 of the security system 1.

[0173] When the relay unit 200 of the security system 1 can decrypt the transferred data into the security program SPG using the secret key SK1, the relay unit 200 temporarily stores the decrypted security program SPG inside. Then, the relay unit 200 of the security system 1 notifies the display operation device 600 of information related to the decrypted security program SPG.

[0174] The on-site worker refers to the display operation device 600 to confirm the validity of the safety program SPG and the safety of the on-site workers including himself, and then instructs the display operation device 600 to approve the transfer. The display operation device 600 sends a transfer instruction to the relay unit 200 according to the transfer approval.

[0175] The relay unit 200 transfers the previously stored safety program SPG to the safety unit 300 in accordance with the transfer instruction from the display operation device 600. Thus, the rewriting process of the safety program SPG is completed.

[0176] In this way, the relay unit 200 transfers the safety program SPG transferred from the support device 500 to the safety unit 300 using the instruction from the on-site operator as a condition. By reflecting the safety program SPG to the safety unit 300 using the explicit operation of the on-site operator as a condition, the safety of the on-site operator can be more reliably ensured.

[0177] Fig.13 It is shown in Fig.12 FIG. 1 is a diagram showing an example of a user interface presented on the display operation device 600 during remote maintenance. Fig.13 The display operation device 600 presents the information related to the safety program SPG from the relay unit 200. That is, the display operation device 600 presents the information related to the safety program SPG transferred from the support device 500 to the user.

[0178] As an example, the user interface screen provided by the display operation device 600 includes information 602 indicating an operator who changed the safety program SPG, information 604 indicating a change date and time of the safety program SPG, and information 606 indicating a transfer destination of the safety program SPG.

[0179] After confirming the information presented on the display operation device 600 and confirming that all the workers on the site, including himself, are safe, the worker at the site presses the approval button 608 on the display operation device 600. In response to the pressing of the approval button 608, the display operation device 600 sends a transfer instruction to the relay unit 200. Then, the safety program SPG is transferred from the relay unit 200 to the safety unit 300.

[0180] In this way, the information of the safety program SPG transferred from the support device 500 is displayed on the display operation device 600. Then, after the on-site operator confirms the appropriateness of the safety program SPG and the safety of the on-site operator, he agrees to transfer the safety program SPG. Then, in response to the transfer agreement from the on-site operator, the relay unit 200 transfers the safety program SPG to the safety unit 300.

[0181] On the other hand, if the worker at the site presses the reject button 610 for some reason, the display operation device 600 sends a transfer stop message to the relay unit 200. Then, the relay unit 200 may discard the stored safety program SPG. In this way, the relay unit 200 may discard the safety program SPG transferred from the support device 500 in response to the transfer rejection instruction from the user.

[0182] In addition, Fig.13In the user interface shown, as information related to the safety program SPG, the updater of the safety program SPG, the update date and time of the safety program SPG, and the transfer destination of the safety program SPG are presented. However, instead of presenting all of this information, at least a part of it may be presented.

[0183] Fig.14 It is shown Fig.12 The following is a sequence diagram of the process steps in remote maintenance. Fig.14 According to the operator's operation on the support device 500 (sequence SQ100), the support device 500 executes the generation / compilation process of the safety program SPG (sequence SQ102).

[0184] Next, according to the operator's selection of the transfer destination and the transfer operation (sequence SQ104), the support device 500 establishes a network connection with the selected relay unit 200, encrypts the security program SPG using the public key of the transfer destination, and generates an encrypted security program SSP (transfer data) (sequence SQ106). Then, the support device 500 transfers the transfer data to the selected transfer destination (sequence SQ108).

[0185] When receiving the transferred data from the support device 500 , the relay unit 200 at the transfer destination decrypts the received data into the secure program SPG using the secret key SK1 of the device itself (sequence SQ110 ).

[0186] Then, the relay unit 200 notifies the display operation device 600 of the information related to the decrypted safety program SPG (sequence SQ112). The display operation device 600 presents the information related to the safety program SPG based on the information from the relay unit 200 (sequence SQ114). Furthermore, when the display operation device 600 accepts an operation from an operator on site (sequence SQ116), it transmits the content of the accepted operation (transfer approval or transfer rejection) to the relay unit 200 (sequence SQ118).

[0187] When receiving the transfer approval instruction from the display operation device 600 (sequence SQ120: Yes), the relay unit 200 transfers the decrypted security program SPG to the security unit 300 (sequence SQ122). The security program SPG is transferred from the relay unit 200 to the security unit 300 via the internal bus 10. The security unit 300 stores the security program SPG from the relay unit 200 (sequence SQ124). Then, the security unit 300 performs security control according to the stored security program SPG.

[0188] Thus, the remote maintenance of the safety cell 300 from the support device 500 is completed.

[0189] On the other hand, when the relay unit 200 receives a transfer rejection instruction from the display operation device 600 (sequence SQ120: No), it discards the stored safety program SPG (sequence SQ126). In this case, the remote maintenance of the safety cell 300 by the support device 500 ends halfway.

[0190] (f3: Solution 2)

[0191] The same technical concept as the above solution 1 can also be applied to the above Fig.11 That is, in the above Fig.11 In the illustrated configuration, explicit operation by an on-site operator may be set as a condition so that the new safety program SPG transferred from the support device 500 is reflected in the safety unit 300 .

[0192] Fig.15 This is a diagram for explaining another example of an improved form of remote maintenance from the support device 500 on the safety system 1 according to the present embodiment. Fig.15 The structure shown is equivalent to the above Fig.11 The structure shown in the figure is improved. Fig.15 The safety system 1 shown is connected to a display operation device 600 that accepts operations from a worker at a site.

[0193] exist Fig.15 In the structure shown, first, in the support device 500, the security program SPG is encrypted by the public key TCK, which is a one-time key generated each time, to generate an encrypted security program SSP (transfer data). At the same time, the public key TCK is encrypted by the public key of the selected transfer destination to generate an encrypted public key STC.

[0194] The encrypted security program SSP and the encrypted public key STC are transferred to the selected transfer destination from the support device 500. The support device 500 encrypts the data required for maintenance using the public key TCK, and encrypts the public key TCK in a manner that can be decrypted using the key (secret key SK1) maintained by the relay unit 200, and sends it to the relay unit 200.

[0195] The relay unit 200 of the security system 1 at the forwarding destination decrypts the encrypted public key STC received from the support device 500 into the public key TCK using the secret key SK1 of the device. Then, the relay unit 200 of the security system 1 at the forwarding destination decrypts the encrypted security program SSP (forwarding data) received from the support device 500 into the security program SPG using the decrypted public key TCK.

[0196] When the security program SPG can be decrypted, the relay unit 200 of the security system 1 temporarily stores the decrypted security program SPG in the security system 1. Then, the relay unit 200 of the security system 1 notifies the display operation device 600 of information related to the decrypted security program SPG.

[0197] The on-site worker refers to the display operation device 600 to confirm the validity of the safety program SPG and the safety of the on-site workers including himself, and then instructs the display operation device 600 to approve the transfer. The display operation device 600 sends a transfer instruction to the relay unit 200 according to the transfer approval.

[0198] The relay unit 200 transfers the previously stored safety program SPG to the safety unit 300 in accordance with the transfer instruction from the display operation device 600. Thus, the rewriting process of the safety program SPG is completed.

[0199] In this way, by reflecting the safety program SPG in the safety unit 300 under the condition of explicit operation by the on-site worker, the safety of the on-site worker can be ensured more reliably.

[0200] Fig.16 It is shown Fig.15 The following is a sequence diagram of the process steps in remote maintenance. Fig.16 According to the operator's operation on the support device 500 (sequence SQ100), the support device 500 executes the generation / compilation process of the safety program SPG (sequence SQ102).

[0201] Next, according to the operator's selection of the transfer destination and the transfer operation (sequence SQ104), the support device 500 generates a public key TCK as a one-time key (sequence SQ130). Then, the support device 500 encrypts the security program SPG using the generated public key TCK to generate an encrypted security program SSP (transfer data) (sequence SQ132). Furthermore, the support device 500 encrypts the public key TCK using the public key of the transfer destination to generate an encrypted public key STC (sequence SQ134).

[0202] Finally, the support device 500 transfers the encrypted security program SSP and the encrypted public key STC to the selected transfer destination (sequence SQ136).

[0203] When receiving the encrypted common key STC from the support device 500, the relay unit 200 at the transfer destination decrypts the received encrypted common key STC into the common key TCK using the secret key SK1 of the own device (sequence SQ140).

[0204] Furthermore, the relay unit 200 decrypts the encrypted security program SSP (transfer data) into the security program SPG using the public key TCK (sequence SQ142).

[0205] Then, the relay unit 200 notifies the display operation device 600 of the information related to the decrypted safety program SPG (sequence SQ112). The display operation device 600 presents the information related to the safety program SPG based on the information from the relay unit 200 (sequence SQ114). Furthermore, when the display operation device 600 accepts an operation from an operator on site (sequence SQ116), it transmits the content of the accepted operation (transfer approval or transfer rejection) to the relay unit 200 (sequence SQ118).

[0206] When receiving the transfer approval instruction from the display operation device 600 (sequence SQ120: Yes), the relay unit 200 transfers the decrypted security program SPG to the security unit 300 (sequence SQ122). The security program SPG is transferred from the relay unit 200 to the security unit 300 via the internal bus 10. The security unit 300 stores the security program SPG from the relay unit 200 (sequence SQ124). Then, the security unit 300 performs security control according to the stored security program SPG.

[0207] Thus, the remote maintenance of the safety cell 300 from the support device 500 is completed.

[0208] On the other hand, when the relay unit 200 receives a transfer rejection instruction from the display operation device 600 (sequence SQ120: No), it discards the stored safety program SPG (sequence SQ126). In this case, the remote maintenance of the safety cell 300 by the support device 500 ends halfway.

[0209] (f4: Solution 3)

[0210] In the above configuration, an authentication process may be further added to the display operation device 600. By adding the authentication process, it is possible to more reliably instruct the security unit 300 to transfer the security program SPG.

[0211] Fig.17 This is a diagram for explaining still another example of an improved form of remote maintenance from the support device 500 on the safety system 1 according to the present embodiment. Fig.17 The structure shown is equivalent to the above Fig.12 The structure shown is a structure obtained by adding authentication processing.

[0212] exist Fig.17In the illustrated configuration, a preset transmission password SPW is given to the safety program SPG transferred from the support device 500 during remote maintenance. That is, the support device 500 gives the password input by the operator to the safety program SPG and transfers it to the relay unit 200 .

[0213] On the other hand, the on-site operator confirms the appropriateness of the safety program SPG by referring to the display operation device 600, and after confirming the safety of the on-site operators including himself, inputs the reception password RPW to the display operation device 600. The safety program SPG is transferred from the relay unit 200 to the safety unit 300 only when the reception password RPW input by the on-site operator is consistent with the transmission password SPW assigned to the safety program SPG.

[0214] More specifically, in remote maintenance, the operator inputs the sending password SPW into the support device 500 before or during the transfer of the safety program SPG. The sending password SPW usually uses a password shared with the on-site operator. Then, the support device 500 encrypts the safety program SPG and the input sending password SPW using the public key of the selected transfer destination for the device with the selected IP address in accordance with the operator's operation. The transfer data generated by encryption is transferred to the transfer destination. When the encrypted safety program SSP (transfer data) is transferred to the original transfer destination, that is, the safety system 1, it can be decrypted using the secret key SK1 stored in the relay unit 200 of the safety system 1.

[0215] When the relay unit 200 of the security system 1 is able to decrypt the transferred data into the security program SPG and the transmission password SPW using the secret key SK1, the decrypted security program SPG and the transmission password SPW are temporarily stored inside. Then, the relay unit 200 of the security system 1 notifies the display operation device 600 of the information related to the decrypted security program SPG.

[0216] The on-site worker refers to the display operation device 600 to confirm the validity of the safety program SPG and the safety of the on-site workers including himself, and then inputs the reception password RPW to the display operation device 600. The input reception password RPW is transmitted to the relay unit 200.

[0217] The relay unit 200 checks the receiving password RPW from the display operation device 600 with the previously stored sending password SPW. When the two passwords match, the relay unit 200 transfers the safety program SPG to the safety unit 300. Thus, the rewriting process of the safety program SPG is completed. In this way, the relay unit 200 transfers the safety program SPG transferred from the support device 500 to the safety unit 300 on the condition that the receiving password RPW input by the operator on site matches the sending password SPW.

[0218] On the other hand, when the reception password RPW from the display operation device 600 does not match the previously stored transmission password SPW, the relay unit 200 may discard the stored security program SPG.

[0219] Fig.18 It is shown in Fig.17 FIG. 1 is a diagram showing an example of a user interface presented on the display operation device 600 during remote maintenance. Fig.18 The display operation device 600 prompts the user to input the reception password RPW and the information related to the safety program SPG from the relay unit 200. As an example, the user interface screen provided by the display operation device 600 includes information 602 indicating the operator who changed the safety program SPG, information 604 indicating the date and time of the change of the safety program SPG, information 606 indicating the transfer destination of the safety program SPG, and a password input field 612.

[0220] After the on-site operator confirms the information displayed on the display operation device 600 and confirms that the on-site operators including himself are safe, he enters the receiving password RPW into the password input field 612. Then, he presses the send button 614. In response to the pressing of the send button 614, the display operation device 600 sends the receiving password RPW input into the password input field 612 to the relay unit 200. Then, the relay unit 200 checks the receiving password RPW from the display operation device 600 and the stored sending password SPW. When the two passwords are consistent, the relay unit 200 transfers the safety program SPG to the safety unit 300.

[0221] On the other hand, when the worker at the site presses the reject button 610 for some reason, the display operation device 600 transmits a transfer stop to the relay unit 200. Then, the relay unit 200 may discard the stored safety program SPG.

[0222] Fig.19 It is shown Fig.17 The following is a sequence diagram of the process steps in remote maintenance. Fig.19According to the operator's operation on the support device 500 (sequence SQ100), the support device 500 executes the generation / compilation process of the safety program SPG (sequence SQ102). In addition, the operator inputs the transmission password SPW to be given to the safety program SPG (sequence SQ103).

[0223] Next, according to the operator's selection of the transfer destination and the transfer operation (sequence SQ104), the support device 500 establishes a network connection with the selected relay unit 200, encrypts the security program SPG and the transmission password SPW using the public key of the transfer destination, and generates encrypted transfer data (sequence SQ107). Then, the support device 500 transfers the transfer data to the selected transfer destination (sequence SQ108).

[0224] When receiving the transfer data from the support device 500, the relay unit 200 at the transfer destination decrypts the received data into the security program SPG and the transmission password SPW using the secret key SK1 of the device itself (sequence SQ111).

[0225] Then, the relay unit 200 notifies the display operation device 600 of the information related to the decrypted security program SPG (sequence SQ112). The display operation device 600 displays the information related to the security program SPG based on the information from the relay unit 200 (sequence SQ114). Furthermore, when the display operation device 600 accepts the reception password RPW from the operator on site (sequence SQ117), it sends the accepted reception password RPW to the relay unit 200 (sequence SQ119). In addition, sometimes a transfer rejection instruction is sent to the relay unit 200.

[0226] When the reception password RPW received from the display operation device 600 matches the transmission password SPW stored in advance (sequence SQ121: Yes), the relay unit 200 transfers the decrypted security program SPG to the security unit 300 (sequence SQ122). The security program SPG is transferred from the relay unit 200 to the security unit 300 via the internal bus 10 for execution. The security unit 300 stores the security program SPG from the relay unit 200 (sequence SQ124). Then, the security unit 300 executes security control according to the stored security program SPG.

[0227] Thus, the remote maintenance of the safety cell 300 from the support device 500 is completed.

[0228] On the other hand, if the reception password RPW received from the display operation device 600 does not match the pre-stored transmission password SPW (sequence SQ121: No), the relay unit 200 discards the stored safety program SPG (sequence SQ126). In this case, the remote maintenance of the safety unit 300 by the support device 500 ends halfway.

[0229] As described above, the support device 500 includes the arbitrary transmission password SPW input by the operator in the transfer data and transmits it to the relay unit 200. The display operation device 600 prompts the information related to the safety program SPG transmitted from the support device 500, and prompts the operator on site to input the reception password RPW. When the password authentication based on the reception password RPW input by the operator on site succeeds, the transfer of the safety program SPG from the relay unit 200 to the safety unit 300 starts. On the other hand, when the password authentication based on the reception password RPW input by the operator on site fails, the safety program SPG is not transferred to the safety unit 300.

[0230] In this way, the safety program SPG is reflected in the safety unit 300 on the condition that the password is consistent between the operator of the support device 500 and the worker at the site. Therefore, the possibility of erroneous transfer of the safety program SPG to the safety unit 300 can be reduced to almost zero.

[0231] (f5: Variation of Solution 3)

[0232] The above-mentioned solution 3 can be modified as follows.

[0233] (1) Regarding Solution 3, Fig.12 The structure shown is described as follows, but it can also be applied to Fig.15 Furthermore, it is not limited to Fig.12 and Fig.15 The structure shown may adopt any structure as long as it is a structure capable of verifying the passwords inputted by the support device 500 and the on-site personnel.

[0234] (2) In solution 3, a structure is illustrated in which the relay unit 200 uses the transmission password SPW and the reception password RPW to perform password authentication, but the subject that performs password authentication may be any. For example, the password authentication may be performed by the display operation device 600 instead of the relay unit 200, or by the control unit 100 or the security unit 300. Furthermore, the password authentication may be performed in any information processing device that is configured separately from the security system 1.

[0235] In this way, password authentication can be executed by any execution subject according to the system structure.

[0236] (3) Any method can be used as the transmission password SPW and the reception password RPW. For example, any character string can be used as the password, or it can be selected arbitrarily from a plurality of candidates (numbers, patterns, photos, etc.) prepared in advance. In solution 3, the transmission password SPW and the reception password RPW are not intended to conceal information, but to confirm the communication between the operator of the support device 500 and the operator on site. Therefore, strict encryption strength may not be required.

[0237] Furthermore, the support device 500 may also randomly select or determine the sending password SPW. In this case, after the support device 500 determines or selects the sending password SPW, the operator of the support device 500 communicates the sending password SPW to the on-site operator by means of a telephone or the like. At this time, it is assumed that the operator of the support device 500 makes a communication regarding the scheduled transfer of the safety program SPG for the safety unit 300, etc. The on-site operator inputs the receiving password RPW into the display operation device 600 according to the content of the communication from the operator of the support device 500. By adopting this method of generating the sending password SPW, the communication between the operator of the support device 500 and the on-site operator can be more reliably performed.

[0238] As described above, the transmission password SPW may be any one of an arbitrary character string, any one of predetermined candidates, and a value randomly determined by the support device 500 .

[0239] (4) Instead of the above-mentioned configuration of authentication using the transmission password SPW and the reception password RPW, user authentication of an on-site operator who operates the display operation device 600 may be utilized.

[0240] Fig. 20 This is a diagram for explaining still another example of an improved form of remote maintenance from the support device 500 on the safety system 1 according to the present embodiment. Fig. 20 The structure shown is equivalent to the above Fig.12 The structure shown is a structure obtained by adding a user authentication process and an authority authentication process.

[0241] exist Fig. 20 In the remote maintenance shown, the transfer instruction can be sent only when the operator who operates the display operation device 600 has the operation authority.

[0242] exist Fig. 20 In the illustrated configuration, the safety program SPG transferred from the support device 500 during remote maintenance is given the preset operation authority information OPA. The operation authority information OPA received by the relay unit 200 is transferred to the display operation device 600.

[0243] On the other hand, when operating the display operation device 600, the operator on site inputs his / her own user name UID and user authentication password UPW. The display operation device 600 performs user authentication based on the input user name UID and user authentication password UPW. When the user authentication is successful, the display operation device 600 refers to the operation authority information OPA received from the relay unit 200 to determine whether the operator who has successfully authenticated the user has the operation authority (authority authentication).

[0244] Fig.21 It is shown Fig. 20 An example of the operation authority information OPA is shown in FIG. Fig.21 The operation authority information OPA includes information indicating whether operation authority is set for each user name. That is, the operation authority information OPA is account information for permission transfer instructions.

[0245] exist Fig.21 In the example shown, the operation authority is set for the operator with the user name "User_1", while the operation authority is not set for the operator with the user name "User_2".

[0246] exist Fig.21 In the example shown, the granting of operation authority is specified in user account (user name) units as account information, but the present invention is not limited thereto and the granting of operation authority may be specified in user group units or task units.

[0247] The display operation device 600 enables the transmission of the transfer instruction to the relay unit 200 only when the operator who has successfully passed the user authentication has the operation authority. Then, upon receiving the transfer instruction from the display operation device 600, the relay unit 200 starts to transfer the safety program SPG to the safety unit 300.

[0248] In this way, the relay unit 200 transfers the safety program SPG transferred from the support device 500 to the safety unit 300 on the condition that the user authentication for the operator (user) succeeds and the predetermined operation authority is set for the operator (user) who succeeds in the user authentication.

[0249] use Fig. 20 and Fig.21 The user authentication process and the authority authentication process shown restrict the sender of the transfer instruction, thereby making it possible to more reliably ensure the safety of the operator OP2 at the site where the safety system 1 is installed.

[0250] In addition, Fig. 20 In the example of using the user name UID and the user authentication password UPW, however, the implementation method of user authentication can be arbitrary. For example, living body information (such as face authentication or fingerprint authentication) can also be used.

[0251] In addition, in Fig. 20 , a structural example in which the display operation device 600 performs user authentication is shown. However, the execution entity of user authentication can be arbitrary. Similarly, the execution entity of user account management (such as adding and registering users, etc.) can also be arbitrary. For example, user authentication and / or user account management can be executed by any one of the control unit 100, relay unit 200, and security unit 300 that make up the security system 1. Furthermore, it can also be executed by an external server (such as a single sign-on server, etc.) outside the security system 1.

[0252] (f6: Other Variants)

[0253] In the above description, a structural example in which the display operation device 600 presents information to on-site workers and accepts instructions from on-site workers is described. However, it is not limited to this, and instructions from on-site workers can be accepted using any unit or device.

[0254] For example, display devices and input devices configured in any one of the control unit 100, relay unit 200, and security unit 300 that make up the security system 1 can also be used. Specifically, information related to the security program SPG transferred from the support device 500 can be presented via an indicator (such as a 7-segment display device or an LED, etc.) or a display configured on the exposed surface of any unit. In this case, the indicator configured on the exposed surface of any unit presents information related to the security program SPG transferred from the support device 500 to the user. That is, the indicators configured on the exposed surfaces of the control unit 100 and the security unit 300 present information related to the security program SPG to the user.

[0255] In addition, instructions from on-site workers can also be accepted via a button or a dual in-line package switch, etc., configured on the exposed surface of any unit. Furthermore, instructions from on-site workers can also be accepted via a portable terminal that performs wireless communication with the security system 1 or the display operation device 600.

[0256] <G. Other Methods>

[0257] In the above-described embodiment, a system in which the security unit 300 that executes the security program SPG and the relay unit 200 that exchanges data with the support device 500 are composed of independent units is illustrated. When the relay unit 200 and the security unit 300 are made separate, by adding the relay unit 200 to an existing system, the above-described remote maintenance can be easily achieved.

[0258] However, it is not necessary to separate the relay unit 200 and the security unit 300, and a structure in which the two are integrated may also be adopted. Furthermore, a structure in which the control unit 100, the relay unit 200, and the security unit 300 are all integrated may also be adopted. In this case, there are advantages such as the ability to make the housing more compact.

[0259] <H. Note>

[0260] The above-described present embodiment includes the following technical idea.

[0261] [Structure 1]

[0262] A security system having:

[0263] A processing execution unit (300) that executes security control in accordance with a security program (SPG);

[0264] A communication unit (200) that relays external access to the security program held by the processing execution unit;

[0265] A support device (500) that transfers the security program to the communication unit via a network (4) according to a user operation; and

[0266] A prompting unit (600) that prompts a user with information related to the security program transferred from the support device,

[0267] The communication unit transfers the security program transferred from the support device to the processing execution unit on the condition of an instruction from the user.

[0268] [Structure 2]

[0269] The security system according to Structure 1, wherein

[0270] The support device assigns a first password (SPW) input thereto to the security program and transfers it to the communication unit,

[0271] The communication unit transfers the security program transferred from the support device to the processing execution unit on the condition that a second password (RPW) input from the user matches the first password.

[0272] [Structure 3]

[0273] The security system according to Structure 2, wherein

[0274] The first password is any one of an arbitrary string, any one of predetermined candidates, and a value randomly determined by the support device.

[0275] [Structure 4]

[0276] The safety system according to structure 1, wherein:

[0277] The communication unit transfers the security program transferred from the support device to the processing execution unit on condition that user authentication for the user succeeds and a predetermined operation authority is set for the user who succeeds in user authentication.

[0278] [Structure 5]

[0279] A safety system according to any one of structures 1 to 4, wherein:

[0280] The communication unit discards the security program transferred from the support device in response to an instruction from a user to reject the transfer.

[0281] [Structure 6]

[0282] A safety system according to any one of structures 1 to 5, wherein:

[0283] The information related to the safety program includes at least one of an updater of the safety program, an update date and time of the safety program, and a transfer destination of the safety program.

[0284] [Structure 7]

[0285] A safety system according to any one of Structures 1 to 6, wherein:

[0286] The presenting means includes at least one of a display operation device connected to the communication unit through a network, an indicator arranged on the exposed surface of the processing execution unit, and an indicator arranged on the exposed surface of the communication unit.

[0287] [Structure 8]

[0288] A safety system according to any one of structures 1 to 7, wherein:

[0289] The communication unit holds an electronic key,

[0290] The support device encrypts the security program so that the communication unit can decrypt the program using the electronic key, and then transfers the encrypted program to the communication unit.

[0291] [Structure 9]

[0292] The safety system according to structure 8, wherein:

[0293] The communication unit holds a secret key (SK1) as the electronic key,

[0294] The support device holds a public key (PK1) paired with the secret key.

[0295] Structure 10

[0296] The security system according to Structure 9, wherein,

[0297] The support device generates a one-time key (TCK) when it is necessary to transfer the security program, encrypts the one-time key using the public key and sends it to the communication unit, and encrypts the security program using the one-time key and sends it to the communication unit.

[0298] Structure 11

[0299] A maintenance method in a controller system (1), wherein,

[0300] The controller system has:

[0301] A processing execution unit (300) that executes security control in accordance with a security program (SPG);

[0302] A communication unit (200) that relays external access to the security program held by the processing execution unit; and

[0303] A support device (500),

[0304] The maintenance method has the following steps:

[0305] The support device transfers the security program to the communication unit via a network according to a user operation (SQ108; SQ136);

[0306] Prompt the user for information related to the security program transferred from the support device (SQ114); and

[0307] Taking an instruction from the user as a condition, transfer the security program transferred from the support device to the processing execution unit (SQ116, SQ118, SQ120, SQ122, SQ124; SQ117, SQ119, SQ121, SQ122, SQ124).

[0308] <I. Advantages>

[0309] According to the safety system 1 of the present embodiment, as a condition for reflecting the safety program SPG transferred from the support device 500 to the relay unit 200 to the safety unit 300, confirmation and instruction from the on-site operator are required. By adopting such a condition, cooperation is required between the operator of the support device 500 located at a location far from the site and the on-site operator, thereby enabling remote maintenance to be performed while satisfying the requirements specified in IEC 62061. In particular, the safety of the on-site operator can be more reliably ensured. Furthermore, the efficiency of remote maintenance is improved, and thereby the productivity of the production equipment can be improved.

[0310] The embodiments disclosed this time should be considered in all respects as illustrative and non-restrictive. The scope of the present invention is indicated by the claims rather than the above description, and all modifications within the meaning and scope equivalent to the claims are included.

[0311] Description of symbols

[0312] 1, 2: security system; 4: network; 10: internal bus; 100: control unit; 102, 202, 302, 502: processor; 104, 204, 304: chipset; 106, 206, 306, 504: primary storage device; 108, 208, 308, 510: secondary storage device; 110, 210: communication controller; 112: USB controller; 114, 214, 314 : memory card interface; 115, 215, 315: memory card; 116, 118, 120, 216, 218: network controller; 122, 322: internal bus controller; 124, 224, 324: indicator; 200: relay unit; 212, 520: communication interface; 300: security unit; 400: function unit; 450: power supply unit; 500: support device; 506: input unit; 5 08: output unit; 512: optical drive; 514: recording medium; 518: processor bus; 600: display operation device; 602, 604, 606: information; 608: approval button; 610: rejection button; 612: password input field; 614: send button; 2010: special opening; 5102: OS; 5104: support program; 5106: project; 5108: standard control source program; 5110, 5112: security source program; LS: list; OP1: operator; OP2: operator; OPA: operation authority information; PK1: public key; RPW: receiving password; SK1, SK2: secret key; SPG: security program; SPW: sending password; SSP: encrypted security program; STC: encrypted public key; TCK: public key; UID: user name; UPW: user authentication password.

Claims

1. A safety system, comprising: Processing execution department, which performs security controls in accordance with security procedures; a communication unit that mediates external access to the security program held by the processing execution unit; a support device that transfers the security program to the communication unit via a network in accordance with a user operation; as well as a prompting unit configured to prompt a user with information related to the security program transferred from the supporting device, The support device assigns the input first password to the security program and transfers the password to the communication unit. The communication unit transfers the security program transferred from the support device to the processing execution unit on the condition that the second password input by the user matches the first password. The support device can monitor the state of the process execution unit or the security program executed by the process execution unit according to a user operation.

2. The security system according to claim 1, in, The first password is any one of an arbitrary character string, any one of predetermined candidates, and a value randomly determined by the support device.

3. A safety system, comprising: Processing execution department, which performs security controls in accordance with security procedures; a communication unit that mediates external access to the security program held by the processing execution unit; a support device that transfers the security program to the communication unit via a network in accordance with a user operation; as well as a prompting unit configured to prompt a user with information related to the security program transferred from the supporting device, The communication unit transfers the security program transferred from the support device to the processing execution unit on the condition that user authentication for the user is successful and the user who has successfully authenticated the user is set with a predetermined operation authority. The support device can monitor the state of the process execution unit or the security program executed by the process execution unit according to a user operation.

4. The safety system according to any one of claims 1 to 3, in, The communication unit discards the security program transferred from the support device in response to an instruction from a user to reject the transfer.

5. The safety system according to any one of claims 1 to 3, in, The information related to the safety program includes at least one of an updater of the safety program, an update date and time of the safety program, and a transfer destination of the safety program.

6. The safety system according to any one of claims 1 to 3, in, The presenting means includes at least one of a display operation device connected to the communication unit through a network, an indicator arranged on the exposed surface of the processing execution unit, and an indicator arranged on the exposed surface of the communication unit.

7. The safety system according to any one of claims 1 to 3, in, The communication unit holds an electronic key, The support device encrypts the security program so that the communication unit can decrypt the program using the electronic key, and then transfers the encrypted program to the communication unit.

8. The security system according to claim 7, in, The communication unit holds a secret key as the electronic key, The support device holds a public key paired with the secret key.

9. The security system according to claim 8, in, The support device generates a one-time key when the security program needs to be transferred, encrypts the one-time key using the public key and sends the one-time key to the communication unit, and encrypts the security program using the one-time key and sends the one-time key to the communication unit.

10. A maintenance method in a controller system, in, The controller system has: Processing execution department, which performs security controls in accordance with security procedures; a communication unit that mediates external access to the security program held by the processing execution unit; as well as Support device, The maintenance method comprises the following steps: The support device assigns the input first password to the security program according to the user operation and transfers it to the communication unit via the network; Prompting a user for information related to the security program transferred from the support device; transferring the security program transferred from the support device to the processing execution unit on the condition that a second password input from the user matches the first password; as well as The support device monitors the state of the process execution unit or the security program executed by the process execution unit according to a user operation.

11. A maintenance method in a controller system, in, The controller system has: Processing execution department, which performs security controls in accordance with security procedures; a communication unit that mediates external access to the security program held by the processing execution unit; as well as Support device, The maintenance method comprises the following steps: The support device transfers the security program to the communication unit via a network according to a user operation; Prompting a user for information related to the security program transferred from the support device; transferring the security program transferred from the support device to the processing execution unit on the condition that user authentication for the user is successful and that the user who successfully authenticated the user is set with a predetermined operation authority; as well as The support device monitors the state of the process execution unit or the security program executed by the process execution unit according to a user operation.

Images