阅读说明：本技术 单元、单元的控制方法和单元的控制程序 (Unit, unit control method, and unit control program ) 是由 西山佳秀 永田雄大 于 2020-02-18 设计创作，主要内容包括：提供一种能够在不探知作为访问目标的功能单元的IP地址的情况下访问目标功能单元的技术。单元(200)包括：通信部,用于对与第一网络连接的外部设备(500)和与第二网络连接的其他单元(300)之间的通信进行中继；设定部(252),用于从所述其他单元(300)获取第二网络内的其他单元(300)的地址信息,并生成将所述地址信息与代替所述地址信息的标识符相关联的设定信息(230)；以及链接信息生成部(254),基于标识符,生成用于从外部设备(500)访问其他单元(300)内的信息的链接信息。(Provided is a technique capable of accessing a target functional unit without ascertaining the IP address of the functional unit targeted for access. The unit (200) comprises: a communication unit for relaying communication between an external device (500) connected to a first network and another unit (300) connected to a second network; a setting unit (252) for acquiring address information of another unit (300) within a second network from the other unit (300) and generating setting information (230) associating the address information with an identifier in place of the address information; and a link information generation unit (254) that generates link information for accessing information in the other unit (300) from the external device (500) on the basis of the identifier.)

1. A cell connectable to a programmable logic controller, comprising:

a communication unit configured to relay communication between an external device connected to a first network and another unit connected to a second network;

a setting unit configured to acquire address information of the other unit in the second network from the other unit and generate setting information in which the address information is associated with an identifier in place of the address information; and

and a link information generation unit that generates link information for accessing information in the other unit from the external device, based on the identifier.

2. The unit of claim 1, wherein the communication section

In accordance with reception of a first access request generated by the external device based on the link information from the external device, acquiring the identifier contained in the first access request,

acquiring the address information corresponding to the identifier with reference to the setting information,

accessing information in the other cell based on a second access request including the address information.

3. The unit according to claim 2, wherein the communication section generates the second access request by replacing the identifier included in the first access request with the address information.

4. The unit according to any one of claims 1 to 3, wherein the unit is connected with the other units by a bus,

the communication section communicates with the other unit using the bus.

5. The unit of any of claims 1-4, wherein the unit further comprises a physical communication port,

the communication section communicates with the external device using the communication port.

6. The unit of any of claims 1-4, wherein the link information comprises a hyperlink,

the communication unit causes the external device to display the hyperlink.

7. A control method for a unit connectable to a programmable logic controller, comprising:

a step of relaying communication between an external device connected to a first network and another unit connected to a second network;

a step of acquiring address information of the other unit within the second network from the other unit, and generating setting information in which the address information is associated with an identifier in place of the address information; and

a step of generating link information for accessing information within the other unit from the external device based on the identifier.

8. A control program for a unit connectable to a programmable logic controller,

the control program causes the unit to execute the steps of:

a step of relaying communication between an external device connected to a first network and another unit connected to a second network;

a step of acquiring address information of the other unit within the second network from the other unit, and generating setting information in which the address information is associated with an identifier in place of the address information; and

a step of generating link information for accessing information within the other unit from the external device based on the identifier.

Technical Field

The present disclosure relates to a technique for relaying communication with an external device in a control system including a plurality of units.

Background

In a production site or the like using Factory Automation (FA), a control unit such as a Programmable Logic Controller (PLC) is used for controlling various devices and various devices disposed in the devices. In recent years, a control unit connectable to an external device has been widespread. Regarding such a control unit, patent document 1 (japanese patent laid-open No. 2016-.

Documents of the prior art

Patent document

Patent document 1: japanese patent laid-open publication No. 2016-194808

Disclosure of Invention

Problems to be solved by the invention

Various functional units can be connected to the control unit. In order to realize communication from an external device to each functional unit, a user needs to grasp an Internet Protocol (IP) address of a functional unit to be accessed. The larger the number of connections of the functional unit, the more difficult the grasping of the IP address becomes. Therefore, a technique capable of accessing a target functional unit without ascertaining the IP address of the functional unit as an access target is desired.

Means for solving the problems

In one example of the present disclosure, a unit connectable to a Programmable Logic Controller (PLC) includes: a communication unit configured to relay communication between an external device connected to a first network and another unit connected to a second network; a setting unit configured to acquire address information of the other unit in the second network from the other unit and generate setting information in which the address information is associated with an identifier in place of the address information; and a link information generation unit that generates link information for accessing information in the other unit from the external device, based on the identifier.

According to the present disclosure, a user can access other units within the second network without ascertaining address information of the other units.

In one example of the present disclosure, the communication unit acquires the identifier included in the first access request, refers to the setting information, acquires the address information corresponding to the identifier, and accesses the information in the other cell based on a second access request including the address information, in response to receiving the first access request generated by the external device based on the link information from the external device.

According to the present disclosure, the unit may access the other unit based on address information corresponding to the access request contained in the first access request. Thereby, the address information of other units within the second network is kept secret from the external device belonging to the first network.

In one example of the present disclosure, the communication unit generates the second access request by replacing the identifier included in the first access request with the address information.

According to the present disclosure, the unit may rewrite a first access requirement valid in the first network to a second access requirement valid in the second network. Thereby, the address information of other units within the second network is kept secret from the external device belonging to the first network.

In one example of the present disclosure, the unit is connected to the other unit via a bus. The communication section communicates with the other unit using the bus.

According to the present disclosure, the unit is able to communicate with other units via a bus.

In one example of the present disclosure, the unit further includes a physical communication port. The communication section communicates with the external device using the communication port.

According to the present disclosure, the unit is capable of communicating with other units via a physical communication port.

In one example of the present disclosure, the link information includes a hyperlink. The communication unit causes the external device to display the hyperlink.

According to the present disclosure, a unit can access other units via hyperlinks.

In another example of the present disclosure, a method of controlling a unit connectable to a PLC includes: a step of relaying communication between an external device connected to a first network and another unit connected to a second network; a step of acquiring address information of the other unit within the second network from the other unit, and generating setting information in which the address information is associated with an identifier in place of the address information; and a step of generating link information for accessing information in the other unit from the external device based on the identifier.

According to the present disclosure, a user can access other units within the second network without ascertaining address information of the other units.

In another example of the present disclosure, a control program of a unit connectable to a plc (programmable Logic controller) causes the unit to execute the steps of: a step of relaying communication between an external device connected to a first network and another unit connected to a second network; a step of acquiring address information of the other unit within the second network from the other unit, and generating setting information in which the address information is associated with an identifier in place of the address information; and a step of generating link information for accessing information in the other unit from the external device based on the identifier.

According to the present disclosure, a user can access other units within the second network without ascertaining address information of the other units.

Drawings

Fig. 1 is a diagram showing a configuration example of an information processing system according to an embodiment.

Fig. 2 is an external view showing a configuration example of a control system according to the embodiment.

Fig. 3 is a schematic diagram showing an example of a hardware configuration of a control unit constituting the control system according to the embodiment.

Fig. 4 is a schematic diagram showing an example of a hardware configuration of a relay unit constituting the control system according to the embodiment.

Fig. 5 is a schematic diagram showing an example of a hardware configuration of functional units constituting the control system according to the embodiment.

Fig. 6 is a schematic diagram showing an example of the hardware configuration of an external device constituting the information processing system according to the embodiment.

Fig. 7 is a diagram showing an example of a unit configuration of an information processing system according to the embodiment.

Fig. 8 is a diagram showing a data flow between the relay unit and the function unit when generating the communication setting information.

Fig. 9 is a diagram showing an example of the proxy information transmitted in step S10 in fig. 8.

Fig. 10 is a diagram showing an example of communication setting information.

Fig. 11 is a diagram showing a data flow between the relay unit and the external device when displaying the web portal.

Fig. 12 is a diagram showing the link information generated in step S32 of fig. 11.

Fig. 13 is a diagram showing a portal site displayed by the external device according to the embodiment.

Fig. 14 is a diagram showing data flows among the relay unit, the functional unit, and the external device at the time of proxy response.

Fig. 15 is a diagram showing an example of screen transition of the portal site.

Fig. 16 is a diagram schematically showing rewriting processing of a Uniform Resource Locator (URL).

Fig. 17 is a diagram showing a unit configuration of an information processing system according to modification 1.

Fig. 18 is a diagram showing a unit configuration of an information processing system according to modification 2.

Detailed Description

Embodiments according to the present invention are described below with reference to the drawings. In the following description, the same components and constituent elements are denoted by the same reference numerals. Their names and functions are also the same. Therefore, detailed description thereof will not be repeated.

Application example >

An application example of the present invention is explained with reference to fig. 1. Fig. 1 is a diagram showing a configuration example of an information processing system 1 according to an embodiment.

The information processing system 1 includes one or more control systems 2 and one or more external devices 500. The control system 2 is an FA system for automating the production process. The control system 2 includes a control unit 100, a relay unit 200, and a function unit 300.

The relay unit 200 and the external device 500 are connected to an external network NW 1. Communication between the relay unit 200 and the external device 500 is realized by Ethernet (registered trademark). That is, each of the relay unit 200 and the external device 500 is assigned with an IP address valid in the external network NW1, and the relay unit 200 and the external device 500 communicate with each other based on the IP address.

The control unit 100, the relay unit 200, and the function unit 300 are connected to the internal network NW 2. The communication between these units is for example realized by means of ethernet. That is, each unit constituting the control system 2 is assigned an IP address valid in the internal network NW2, and each unit performs communication with each other based on the IP address.

The control unit 100 is, for example, a PLC. The control unit 100 controls a driving device (not shown) according to a user program designed in advance. The driving apparatus includes various industrial apparatuses for automating the production process. As an example, the driving apparatus includes a robot controller, a service driver, an arm robot controlled by the robot controller, a service motor controlled by the service driver, and the like. In addition, the driving device may also include a vision sensor for photographing the workpiece, other devices utilized in the production process, and the like.

The function unit 300 provides various functions for realizing control of various control objects by the control unit 100. The function unit 300 includes a Web server S2, an application program AP2A, and an application program AP 2B. The application programs AP2A and AP2B are programs for providing various services related to the control system 2.

The external device 500 is, for example, a notebook or desktop Personal Computer (PC), a tablet terminal, a smartphone, a Human Machine Interface (HMI), or other information processing terminal.

The relay unit 200 relays communication between a device connected to the external network NW1 (i.e., the external device 500) and a device connected to the internal network NW2 (i.e., the control unit 100, the function unit 300). Relay unit 200 includes communication unit 250, setting unit 252, and link information generation unit 254 as a functional configuration for realizing a relay function of communication.

The communication section 250 is a communication module for realizing communication with various devices. Typically, the communication unit 250 realizes communication with an external device 500 connected to an external network NW1 (first network) or communication with another unit (for example, the functional unit 300) connected to an internal network NW2 (second network).

The setting unit 252 acquires address information of the functional unit 300 in the internal network NW2 from the functional unit 300. The address information is communication information that can uniquely identify the functional unit 300 within the internal network NW 2. As an example, the address information is an IP address, a domain name, or a host name.

Setting unit 252 generates an identifier in place of the address information based on the address information received from functional unit 300. The identifier is, for example, an arbitrary character string. The setting section 252 associates the address information received from the functional unit 300 with the generated identifier, and writes them into the communication setting information 230.

The link information generation unit 254 generates link information for accessing information in the functional unit 300 connected to the internal network NW2 from the external device 500 connected to the external network NW1, based on the identifier generated by the setting unit 252. "information in the functional unit 300" refers to arbitrary information stored in the functional unit 300, and is a concept including a program (application program) or data. The "link information" is an address indicating an access target to information within the functional unit 300, for example, a URL or a hyperlink. The link information generating part 254 embeds the generated link information into a HyperText Markup Language (HTML) document and then transmits the HTML document to the external device 500.

The external device 500 displays a screen corresponding to the HTML document received from the relay unit 200. Thereby, the link information is displayed on the screen of the external device 500. The user can access the information of the access target displayed by the link information by clicking the displayed link information. At this time, the user does not need to ascertain the IP address of the functional unit 300 as the access target.

The link information displayed on the external device 500 includes only the identifier of the functional unit 300 in the external network NW1, and does not include the IP address of the functional unit 300 in the internal network NW 2. That is, the IP address of the functional unit 300 in the internal network NW2 is not disclosed to the external device 500. Thereby, the functional unit 300 belonging to the internal network NW2 is kept secret. In addition, direct communication between the external device 500 and the function unit 300 can be prevented, and the risk of security accompanying communication is reduced.

< B. control System 2 >

Referring to fig. 2, the control system 2 shown in fig. 1 is explained. Fig. 2 is an external view showing a configuration example of the control system 2.

Referring to fig. 2, the control system 2 includes one or more control units 100, one or more relay units 200, one or more function units 300, one or more function units 400, and a power supply unit 450.

The control unit 100 and the relay unit 200 are connected via an arbitrary data transmission path. The control unit 100 and the relay unit 200 are connected to one or more of the functional units 300 and 400 via an internal bus 10 (see fig. 7) described later.

The control unit 100 performs a central process in the control system 2. The control unit 100 executes a control operation for controlling a control target according to an arbitrarily designed requirement specification. In the configuration example shown in fig. 2, the control unit 100 has one or more communication ports. The control unit 100 corresponds to a process execution unit that executes standard control according to a standard control program.

The relay unit 200 is connected to the control unit 100 and is responsible for communication with other devices. In the configuration example shown in fig. 2, the relay unit 200 has one or more communication ports. The details of the communication function provided by the relay unit 200 will be described later.

The function unit 300 is an optional unit, and is connected with the control unit 100 as necessary. The function unit 300 may typically include an sgu (security Guard unit), a communication unit having a data exchange function based on an Object Linking and Embedding Unified Architecture (OPC UA) for Process Control, an AI unit having a prevention and security function based on Artificial Intelligence (AI), and the like.

The function unit 400 provides various functions for realizing control of various control objects by the control system 2. The function unit 400 may typically include an Input/Output (I/O) unit, a safety I/O unit, a communication unit, a motion controller unit, a temperature adjustment unit, a pulse counter unit, and the like. Examples of the I/O unit include a Digital Input (DI) unit, a Digital Output (DO) unit, an Analog Input (AI) unit, an Analog Output (AO) unit, a pulse capture (pulse catch) Input unit, and a composite unit in which a plurality of kinds are mixed. The safety I/O unit is responsible for safety control related I/O processing.

The power supply unit 450 supplies power of a predetermined voltage to each unit constituting the control system 2.

< C. hardware configuration example of each cell >

Next, an example of a hardware configuration of each unit constituting the control system 2 according to the present embodiment will be described.

(c 1: control unit 100)

Fig. 3 is a schematic diagram showing an example of the hardware configuration of the control unit 100 constituting the control system 2 according to the present embodiment. Referring to fig. 3, the control Unit 100 includes a processor 102 such as a Central Processing Unit (CPU) or a Graphic Processing Unit (GPU), a chipset 104, a main storage 106, a secondary storage 108, a communication controller 110, a Universal Serial Bus (USB) controller 112, a memory card interface 114, a network controller 116, a network controller 118, a network controller 120, an internal Bus controller 122, and an indicator 124 as main components.

The processor 102 reads various programs stored in the secondary storage device 108, and develops and executes the programs in the main storage device 106, thereby realizing control calculations related to the standard control and various processes described later. The chipset 104 mediates data exchange between the processor 102 and each component, thereby realizing processing as the control unit 100 as a whole.

In addition to the system program, a control program that runs on an execution environment provided by the system program is stored in the secondary storage device 108.

The communication controller 110 is responsible for the exchange of data with the functional unit 300. As the communication controller 110, for example, a communication chip corresponding to ethernet or the like can be used.

The USB controller 112 is responsible for data exchange with an arbitrary information processing apparatus via a USB connection.

The memory card interface 114 is configured to be able to attach and detach the memory card 115, and is able to write data such as a control program and various settings to the memory card 115, and read data such as a control program and various settings from the memory card 115.

The network controller 116, the network controller 118, and the network controller 120 are each responsible for data exchange with any device via the network. The network controllers 116, 118, and 120 may use industrial network protocols such as EtherNet (EtherCAT) (registered trademark), EtherNet/IP (EtherNet/IP) (registered trademark), device network (DeviceNet) (registered trademark), and companet (registered trademark).

The internal bus controller 122 is responsible for exchange of data with the relay unit 200, the one or more functional units 300, and the one or more functional units 400 constituting the control system 2. The internal bus may use a communication protocol unique to the manufacturer, or may use a communication protocol identical to or compatible with any industrial network protocol.

The indicator 124 notifies the control unit 100 of the operation state and the like, and includes one or more Light Emitting Diodes (LEDs) and the like disposed on the surface of the unit.

Fig. 3 shows an example of a configuration in which the processor 102 executes a program to provide necessary functions, and a dedicated hardware Circuit (e.g., an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like) may be used and installed for a part or all of the provided functions. Alternatively, the main part of the control unit 100 may be implemented using hardware according to a general-purpose architecture (e.g., a general-purpose computer-based industrial computer). In this case, a plurality of Operating Systems (OSs) having different purposes may be executed in parallel using a virtualization technique, and necessary applications may be executed on each OS.

(c 2: Relay Unit 200)

Fig. 4 is a schematic diagram showing an example of the hardware configuration of the relay unit 200 constituting the control system 2 according to the present embodiment. Referring to fig. 4, the relay unit 200 includes a processor 202 such as a CPU or GPU, a chipset 204, a main storage 206, a secondary storage 208, a communication controller 210, a communication interface 212, a memory card interface 214, a network controller 216, a network controller 218, and an indicator 224 as main components.

The processor 202 reads various programs stored in the secondary storage device 208, and executes the programs in the main storage device 206, thereby realizing various communication functions described later. The chipset 204 mediates data exchange between the processor 202 and each component, thereby realizing processing as the whole of the relay unit 200.

In addition to the system program, the secondary storage device 208 stores various data such as a communication control program 232 running in an execution environment and communication setting information 230 provided by the system program.

The communication controller 210 is responsible for the exchange of data with the control unit 100 or the function unit 300. As the communication controller 210, for example, a communication chip corresponding to ethernet or the like can be used.

The communication interface 212 is responsible for data exchange with an arbitrary information processing apparatus via a USB connection.

The memory card interface 214 is configured to be attachable to and detachable from the memory card 215, and is capable of writing data such as a control program and various settings to the memory card 215, and reading data such as a control program and various settings from the memory card 215.

The network controller 216 and the network controller 218 are respectively responsible for data exchange with any device via the network. The network controllers 216, 218 may also use a general network protocol such as ethernet. As an example, the relay unit 200 communicates with the external device 500 via the network controller 216 or the network controller 218.

The indicator 224 notifies the operating state of the relay unit 200 and the like, and includes one or more LEDs disposed on the unit surface.

Fig. 4 shows an example of a configuration in which the processor 202 executes a program to provide necessary functions, and a dedicated hardware circuit (for example, ASIC or FPGA) may be used and installed for part or all of the provided functions. Alternatively, the main part of the relay unit 200 may be implemented using hardware according to a general-purpose architecture (for example, a general-purpose computer-based industrial computer). In this case, a plurality of OSs different in purpose can be executed in parallel using virtualization technology, and necessary applications are executed on the respective OSs.

(c 3: function unit 300)

Fig. 5 is a schematic diagram showing an example of the hardware configuration of the functional unit 300 constituting the control system 2 according to the present embodiment. Referring to fig. 5, the functional unit 300 includes a processor 302 such as a CPU or GPU, a chipset 304, a main storage 306, a secondary storage 308, a memory card interface 314, an internal bus controller 322, and an indicator 324 as main components.

The processor 302 realizes the server function and various functions by reading various application programs stored in the secondary storage device 308 and expanding them in the primary storage device 306. The chipset 304 mediates data exchange between the processor 302 and each component to realize processing as the whole of the functional unit 300.

In addition to the system program, the secondary storage device 308 stores an application program that runs on an execution environment provided by the system program.

The memory card interface 314 is configured to be able to attach and detach the memory card 315, and is able to write data such as an application program and various settings to the memory card 315, and read data such as an application program and various settings from the memory card 315.

The internal bus controller 322 is responsible for exchange of data with the control unit 100 or the relay unit 200 via the internal bus.

The indicator 324 notifies the functional unit 300 of the operating state and the like, and includes one or more LEDs disposed on the unit surface.

Fig. 5 shows an example of a configuration in which the processor 302 executes a program to provide necessary functions, and a dedicated hardware circuit (for example, ASIC, FPGA, or the like) may be used and installed for a part or all of the provided functions. Alternatively, the main part of the function unit 300 may be implemented using hardware according to a general-purpose architecture (e.g., a general-purpose computer-based industrial computer). In this case, a plurality of OSs different in purpose can be executed in parallel using virtualization technology, and necessary applications are executed on the respective OSs.

< D. hardware configuration example of external device 500 >

Next, the hardware configuration of the external device 500 will be described in order with reference to fig. 6. Fig. 6 is a schematic diagram showing an example of the hardware configuration of an external device 500 constituting the information processing system 1 according to the embodiment.

As an example, the external device 500 includes a computer configured according to a general-purpose computer architecture. The external device 500 includes a processor 502 such as a CPU or a Microprocessor Unit (MPU), a main storage 504, a secondary storage 510, a communication interface 511, an I/O (input/output) interface 514, and a display interface 520. These components can be communicatively connected to each other via an internal bus 525.

The processor 502 controls the operation of the external device 500 by executing various control programs such as the development support program 510A and a browser application program (not shown). The development support program 510A is a program that provides an environment for developing a control program (user program) of the control system 2. The processor 502 reads a control program to be executed from the secondary storage device 510 to the main storage device 504 based on the reception of an execution command of various control programs such as the development support program 510A and the browser application.

The communication interface 511 exchanges data with other communication devices via a network. Including, for example, the relay unit 200, a server, etc. The external device 500 may be configured to be able to download various control programs such as the development support program 510A from the other communication device via the communication interface 511.

The I/O interface 514 is connected to the input device 515, and inputs a signal indicating a user operation from the input device 515. Typically, the input device 515 includes a keyboard, a mouse, a touch panel, and the like, and receives an operation from a user. In the example of fig. 6, the external device 500 and the input device 515 are shown separately, but the external device 500 and the input device 515 may be integrally configured.

The display interface 520 is connected to the display 521, and sends an image signal for displaying an image to the display 521 in response to a command from the processor 502 or the like. The Display 521 is, for example, a Liquid Crystal Display (LCD) or an organic Electroluminescence (EL), and presents various information to the user. The display 521 can display various screens provided by the development support program 510A. In the example of fig. 6, the external device 500 and the display 521 are shown separately, but the external device 500 and the display 521 may be integrally formed.

Example of Unit Structure of information processing System 1

Fig. 7 is a diagram showing an example of the unit configuration of the information processing system 1. A specific example of the unit configuration of the information processing system 1 will be described with reference to fig. 7.

As shown in fig. 7, the information processing system 1 includes a control system 2, and an external device 500. The control system 2 includes a control unit 100, a relay unit 200, and a function unit 300. The control unit 100, the relay unit 200, and the function unit 300 are connected via an internal bus 10. These units may communicate with each other via an internal bus 10. The communication is for example realized by means of a virtual ethernet.

The relay unit 200 and the external device 500 are connected to an external network NW 1. The external device 500 is assigned an IP address "192.168.250.3". The relay unit 200 and the external device 500 each have a physical communication port via which the external network NW1 is connected.

The control unit 100, the relay unit 200, and the function unit 300 are connected to the internal network NW 2. The control unit 100 is assigned a virtual IP address "192.168.250.1". In addition, the Unit name "Unit # 0" is assigned to the control Unit 100.

The relay unit 200 is assigned an IP address of "192.168.250.2". In addition, the Unit name "Unit # 1" is assigned to the relay Unit 200. Relay section 200 functions as a site server "Web 1 (site 1)". The relay unit 200 has installed therein the application programs "App 11" and "App 12". The applications "App 11" and "App 12" are accessed from the Web server "Web 1".

In the example of FIG. 7, functional unit 300 includes two functional units U2, U3. The functional unit U2 is assigned a virtual IP address of "192.168.251.100". In addition, the Unit name "Unit # 2" is assigned to the functional Unit U2. The functional unit U2 functions as a Web server "Web 2 (Web site 2)". The functional unit U2 has application programs "App 21" and "App 22" installed therein. The applications "App 21" and "App 22" are accessed from the Web server "Web 2".

The functional unit U3 is assigned a virtual IP address of "192.168.251.101". In addition, the Unit name "Unit # 3" is assigned to the functional Unit U3. The functional unit U3 functions as a Web server "Web 3 (Web site 3)". The functional unit U3 has application programs "App 31" and "App 32" installed therein. The applications "App 31" and "App 32" are accessed from the Web server "Web 3".

The relay unit 200 has a reverse proxy function. More specifically, when receiving an access request from external device 500, relay unit 200 functions as a web server. Then, the relay unit 200 rewrites the access request received from the external device 500 and transmits the rewritten access request to the function unit 300 as the access destination. In this case, relay section 200 functions as a client, and functional section 300 as an access destination functions as a web server. In this manner, relay unit 200 functions as both a site server and a client.

< F. method for generating communication setting information 230 >

In order to relay communications between the external device 500 and the functional units U2, U3, the relay unit 200 needs to route access requests from the external device 500. In order to realize such a relay function, relay section 200 generates communication setting information 230 (see fig. 1) for routing in advance.

Hereinafter, a method of generating the communication setting information 230 will be described with reference to fig. 8 to 10. Fig. 8 is a diagram showing a data flow between the relay unit 200 and the function unit 300 when the communication setting information 230 is generated. The processing shown in fig. 8 is executed at the time of startup of the control unit 100, for example.

In step S10, the relay unit 200 transmits an acquisition request of information on the functional unit U2 (hereinafter, also referred to as "proxy information") to the functional unit U2. The function unit U2 receives the acquisition request and transmits its own proxy information to the relay unit 200.

Fig. 9 is a diagram showing an example of the proxy information transmitted in step S10. The proxy information includes, for example, a domain name, a unit name, and a host name. In the example of fig. 9, the domain name is shown as "AI", the cell name is shown as "# 2", and the host name is shown as "Unit _ 2".

In step S12, relay unit 200 functions as setting unit 252 (see fig. 1) and updates communication setting information 230 based on the proxy information received from functional unit U2. Fig. 10 is a diagram showing an example of the communication setting information 230. In step S12, information indicated by a broken line 230A is added to the communication setting information 230. Thus, the address information of functional Unit U2 (host name "Unit _ 2" in the example of FIG. 10) is associated with identifier "U2".

The identifier "u 2" associated with the host name "Unit _ 2" is generated according to a rule predetermined by the relay Unit 200. It is preferable that the relay unit 200 generates a character string for easy recognition of the functional unit U2 by the user as an identifier. As an example, the identifier is generated based on the domain name of functional unit U2, the unit name of functional unit U2, or the host name of functional unit U2.

The address information associated with the identifier "U2" does not necessarily need to be a host name as long as the IP address of the functional unit U2 in the internal network NW2 can be determined. As an example, the address information associated with the identifier "U2" may be the IP address of the functional unit U2 itself in the internal network NW2, or may be the domain name of the functional unit U2.

In step S20, the relay unit 200 transmits the acquisition request of the proxy information to the function unit U3. The function unit U3 receives the acquisition request and sends its own proxy information to the relay unit 200.

In step S22, relay unit 200 functions as setting unit 252 (see fig. 1) and updates communication setting information 230 based on the proxy information received from functional unit U3. In step S22, information indicated by a broken line 230B in fig. 10 is added to the communication setting information 230. Thus, the address information of functional Unit U3 (host name "Unit _ 3" in the example of FIG. 10) is associated with identifier "U3". The identifier "u 3" is generated by the relay unit 200 according to the same rule as the identifier "u 2".

The address information associated with the identifier "U3" does not necessarily need to be a host name as long as the IP address of the functional unit U3 in the internal network NW2 can be determined. As an example, the address information associated with the identifier "U3" may be the IP address of the functional unit U3 itself in the internal network NW2, or may be the domain name of the functional unit U3.

< G. display processing of Web portal >

The external device 500 displays a web portal for accessing an application program for each unit within the control system 2. By displaying such a web portal, the user can use the application program of each unit without ascertaining information (for example, an IP address of each unit) of each unit in the control system 2.

The following describes a display flow of the portal site with reference to fig. 11 to 13. Fig. 11 is a diagram showing a data flow between relay unit 200 and external device 500 when displaying a web portal.

In step S30, the user performs a display operation of the portal site on the external device 500 using the input device 515 (see fig. 6). Based on the situation, the external device 500 transmits the acquisition request of the web portal to the relay unit 200.

In step S32, relay unit 200 receives the request for acquiring a web portal from relay unit 200, and functions as link information generation unit 254 (see fig. 1) to generate link information for accessing the application of each unit. Fig. 12 shows the link information 30 generated in step S32.

The link information 30 is described using HTML. The link information 30 contains a URL31 and a hyperlink 32 valid in the external network NW 1. A hyperlink is some string associated with a URL.

The link information 30 is generated based on the communication setting information 230 (see fig. 10). More specifically, the relay unit 200 generates link information based on its own address information (for example, IP address) and the identifier of each unit specified by the communication setting information 230. In the example of fig. 12, based on the IP address "192.168.250.2" of the relay unit 200 and the identifier "U3" of the functional unit U3 defined by the communication setting information 230, the URL "http:// 192.168.250.2/U3/App31/index. php" valid in the external network NW1 is generated. The "App 31" displayed in the URL is an identifier of an application within functional unit U3. The relay unit 200 generates such a URL for each application in each unit of the control system 2, and writes the URL in the link information 30.

In step S40, relay unit 200 functions as communication unit 250 (see fig. 1) and transmits generated link information 30 to external device 500. The external device 500 constructs a web portal based on the received link information 30 and displays the web portal on the display 521 (see fig. 6). Fig. 13 is a diagram showing a portal 710 displayed on the external device 500.

At web portal 710, links to the cells are displayed using hyperlinks. In the example of FIG. 13, the link to functional unit U2 is shown as hyperlink 710A and the link to functional unit U3 is shown as hyperlink 710B.

Further, the content displayed by portal 710 may be changed according to the access rights of the user who logs in to external device 500. The access right given to each user is set in advance in the external device 500 or the like, for example, and is transmitted to the control system 2 as access right information of a different user. Each functional unit 300 sets the type of access right to which access is permitted in accordance with an application, and each functional unit 300 holds the type of access right as access right information of a different application.

In this case, in step S10 and step S20 in fig. 8, each functional unit 300 transmits access right information of a different application to the relay unit 200 when transmitting proxy information (see fig. 9) to the relay unit 200. The relay unit 200 stores the received access right information of the different application programs.

Then, in step S30 of fig. 11, when external device 500 transmits the request for acquiring the web portal to relay section 200, the registration information (for example, user ID) of external device 500 is also transmitted. The relay unit 200 determines the type of access right given to the login user based on the access right information of the different user. Then, the relay unit 200 identifies an application (or a functional unit) that can be accessed with the access right of the login user, based on the access right information of the different application. Then, the relay unit 200 generates link information only for the determined application. Thus, the content displayed in the web portal 710 changes according to the access right given to the user.

< H. reverse proxy processing >

Next, the reverse proxy function by the relay unit 200 will be described with reference to fig. 14 to 16. Fig. 14 is a diagram showing data flows among the relay unit 200, the functional unit 300, and the external device 500 at the time of proxy response.

In step S50, the external device 500 displays the web portal 710 shown in fig. 15. Fig. 15 is a diagram showing an example of screen transition of portal 710. The user may select any one of the hyperlinks within web portal 710. In step S50, hyperlink 710B of, for example, web portal 710 is selected.

In step S52, the external apparatus 500 transmits an access request corresponding to the selected hyperlink 710B to the relay unit 200. The access request includes the URL associated with the selected hyperlink 710B.

In step S54, relay unit 200 functions as communication unit 150 (see fig. 1) and acquires the URL included in the access request received from external device 500 and rewrites the URL. Fig. 16 is a diagram schematically showing a process of rewriting a URL.

In FIG. 16, the access request 40A from the external device 500 is shown as the URL "http:// 192.168.250.2/u3/App31/index. php". "192.168.250.2" shown in the access request 40A indicates the IP address of the relay unit 200. "u 3" displayed in the access request 40A indicates an identifier of the cell that is the access target. "App 31" displayed in the access request 40A indicates an application program of a unit as an access target.

Upon receiving the access request 40A (first access request) from the external device 500, the communication unit 150 acquires the identifier "u 3" included in the access request 40A. Next, the communication unit 150 acquires address information corresponding to the identifier "u 3" with reference to the communication setting information 230 described above with reference to fig. 10. As a result, the address information "unit _ 3" valid in the internal network NW2 is specified. Then, the communication unit 150 rewrites the access request 40A and generates an access request 40B (second access request) including the address information "unit _ 3".

More specifically, the communication unit 150 generates the access request 40B by replacing the identifier "u 3" included in the access request 40A with the address information "unit _ 3" corresponding to the identifier "u 3". At this time, the field "192.168.250.2" (i.e., destination information) contained in the access request 40A is deleted. Thus, the access request 40A "http:// 192.168.250.2/U3/App31/index. php" is rewritten to the access request 40B "http:// unit-3/App 31/index. php", and the destination is rewritten from the relay unit 200 to the functional unit U3. The communication unit 150 transmits the rewritten access request 40B to the functional unit U3.

In step S60, the functional unit U3 accesses the application program within the functional unit U3 based on the access request 40B received from the relay unit 200, and acquires the target information via the application program. The function unit U3 transmits the acquired information to the relay unit 200 as an HTML document.

In step S70, the relay unit 200 functions again as a web server, and transmits the HTML document received from the functional unit U3 to the external device 500. The external device 500 analyzes the received HTML document and displays a screen corresponding to the HTML document on the display 521 (see fig. 6). Fig. 13 shows a screen 720 displayed in step S70.

As described above, by the user clicking the hyperlink 710B, the external device 500 accesses the functional unit U3 corresponding to the hyperlink 710B and acquires target information from the functional unit U3. At this time, the user does not need to ascertain the IP address of the functional unit U3 as the access target.

The link information displayed on the portal 710 includes only the identifier of the functional unit 300 in the external network NW1, and does not include the IP address of the functional unit 300 in the internal network NW 2. That is, the IP address of the functional unit 300 in the internal network NW2 is not disclosed to the external device 500. Thereby, the functional unit 300 belonging to the internal network NW2 is kept secret. In addition, direct communication between the external device 500 and the function unit 300 can be prevented, and the risk of security accompanying communication is reduced.

< I. variation 1 of information processing System 1

Fig. 17 is a diagram showing a unit configuration of an information processing system 1A according to modification 1. The structural units of the information processing system 1A are explained with reference to fig. 17.

In fig. 7, the units constituting the information processing system 1 are connected via an internal bus 10. In contrast, in the information processing system 1A according to modification 1, each unit is connected to the internal network NW2 via a communication port. That is, in the present modification, the respective units are provided at physically separated locations. Even such a cell structure does not depart from the gist of the present invention.

< J. variation 2 of information processing System 1

Fig. 18 is a diagram showing a unit configuration of an information processing system 1B according to modification 2. The unit configuration of the information processing system 1B is explained with reference to fig. 18.

In the information processing system 1 shown in fig. 7, only the relay unit 200 is connected to the external network NW 1. In contrast, in the information processing system 1B according to modification 2, not only the relay unit 200 but also other units are connected to the external network NW1, and the other units are also connected to the external network NW 1. That is, in the present modification, not only the relay unit 200 but also other functional units can directly communicate with the external device 500. Even such a cell structure does not depart from the gist of the present invention.

In the example of fig. 18, not only the relay unit 200 but also the functional unit U3 are directly connected to the external device 500. That is, the communication path from the external apparatus 500 to the functional unit U3 includes a communication path R1 via the relay unit 200 and a communication path R2 not via the relay unit 200.

By having such a plurality of communication paths, permission/prohibition of access to each application can be switched according to the communication paths. As an example, the application program "App 31" of the functional unit U3 prohibits communication through the communication path R2 and permits communication only through the communication path R1. On the other hand, with respect to the application program "App 32" of the functional unit U3, communication over the communication path R1 is prohibited, and communication only over the communication path R2 is permitted.

More specifically, a rule specifying permission/prohibition of access for each communication path and according to each application is held in each functional unit 300 as a permission/prohibition rule. When receiving an access request from the relay unit 200 or the external device 500, the function unit 300 determines an access source from the URL included in the access request, and determines a communication path based on the access source. Then, the functional unit 300 refers to the permission/prohibition specification to determine whether or not access to the access-target application is permitted to the specified communication path.

< K, attached notes >

As described above, the present embodiment includes the following disclosure.

[ Structure 1]

A unit (200) connectable to a PLC (programmable Logic controller) (100), comprising:

a communication unit (250) for relaying communication between an external device (500) connected to a first network and another unit (300) connected to a second network;

a setting unit (252) for acquiring address information of another unit (300) in the second network from the other unit (300), and generating setting information (230) in which the address information is associated with an identifier in place of the address information; and

and a link information generation unit (254) that generates link information for accessing information in the other unit (300) from the external device (500) on the basis of the identifier.

[ Structure 2]

The unit of claim 1, wherein the communication section (250)

In accordance with receiving a first access requirement generated by the external device (500) based on the link information from the external device (500), acquiring the identifier contained in the first access requirement,

acquiring the address information corresponding to the identifier with reference to the setting information (230),

accessing information in the further unit (300) based on a second access requirement comprising the address information.

[ Structure 3]

The unit according to claim 2, wherein the communication section (250) generates the second access request by replacing the identifier included in the first access request with the address information.

[ Structure 4]

The unit according to any one of claims 1 to 3, wherein the unit (200) is connected with the other unit (300) by a bus (10),

the communication unit (250) communicates with the other unit (300) using the bus (10).

[ Structure 5]

The unit according to any of claims 1 to 4, wherein the unit (200) further comprises a physical communication port,

the communication unit (250) communicates with the external device (500) using the communication port.

[ Structure 6]

The unit of any of claims 1-4, wherein the link information comprises a hyperlink,

the communication unit (250) causes the external device (500) to display the hyperlink.

[ Structure 7]

A control method for a unit (200) connectable to a PLC (100), comprising:

a step of relaying communication between an external device (500) connected to a first network and another unit (300) connected to a second network;

a step (S12, S22) of acquiring address information of the other unit (300) within the second network from the other unit (300), and generating setting information (230) associating the address information with an identifier in place of the address information; and

a step (S32) of generating link information for accessing information within the other unit (300) from the external device (500) based on the identifier.

[ Structure 8]

A program [ control program ] is a control program for a unit (200) connectable to a PLC (100),

the control program causes the unit (200) to perform the steps of:

a step of relaying communication between an external device (500) connected to a first network and another unit (300) connected to a second network;

a step (S12, S22) of acquiring address information of the other unit (300) within the second network from the other unit (300), and generating setting information (230) associating the address information with an identifier in place of the address information; and

a step of generating link information for accessing information within the other unit (300) from the external device (500) based on the identifier.

The presently disclosed embodiments are to be considered in all respects as illustrative and not restrictive. It should be understood that the scope of the present invention is indicated by the claims rather than the description, and all changes that come within the meaning and range of equivalency of the claims are intended to be embraced therein.

Description of the symbols

1. 1A, 1B: information processing system

2: control system

10. 525: internal bus

30: linking information

32. 710A, 710B: hyperlink

40A, 40B: request for access

100: control unit

102. 202, 302, 502: processor with a memory having a plurality of memory cells

104. 204, 304: chip group

106. 206, 306, 504: main storage device

108. 208, 308, 510: secondary storage device

110. 210: communication controller

112: USB controller

114. 214, 314: memory card interface

115. 215, 315: memory card

116. 118, 120, 216, 218: network controller

122. 322: internal bus controller

124. 224, 324: indicator device

150. 250: communication unit

200: relay unit

212. 511: communication interface

230: communication setting information

230A, 230B: dotted line

232: communication control program

252: setting part

254: link information generating unit

300. 400: functional unit

450: power supply unit

500: external device

510A: development support program

514: I/O interface

515: input device

520: display interface

521: display device

710: portal website

720: picture frame