JP7568572B2 - Surveillance equipment - Google Patents

Description

This disclosure relates to industrial equipment equipped with software and monitoring devices capable of communicating with a network.

Industrial equipment is equipped with software, and when functions are changed or added, the software needs to be updated. Conventionally, one method for remotely updating software on industrial equipment is to remotely write the software to be updated to the storage memory of the industrial equipment via LAN communication, etc.

However, this method had the problem that if a power outage or other problem occurred while writing the software and the writing failed, the industrial equipment would not be able to start up normally.

To solve this problem, there is a conventional technique in which an industrial device is equipped with a backup flash memory for update data and a flash memory for storing update data (see, for example, Patent Document 1). Patent Document 1 discloses a method in which update data is stored in the backup flash memory and then stored in the flash memory for storing update data.

With this method, even if writing to the flash memory for storing update data fails, the industrial equipment can be easily restored by writing the update data stored in the backup flash memory to the flash memory for storing update data.

JP 2011-197870 A

However, the configuration described in Patent Document 1 assumes that the industrial equipment is equipped with a function for communicating with a network. In addition, it is necessary to install two flash memories.

Instead of installing two flash memories, it is also possible to install one large-capacity flash memory and partition it to provide areas for storing updated data and for backups.

However, in either case, the memory capacity required for the industrial equipment becomes large. Therefore, there is a problem that the method disclosed in Patent Document 1 cannot be applied to industrial equipment that is not equipped with a communication function for connecting to a network, or to industrial equipment that does not have sufficient memory capacity.

The present disclosure has been made to solve the above problems, and aims to provide a monitoring device that can quickly and reliably complete the update process for software installed in industrial equipment using update software obtained via a network.

A monitoring device according to the present disclosure is a monitoring device used for updating software installed in industrial equipment with update software acquired via a network, the monitoring device comprising a controller and a first memory, the controller being capable of communicating with the industrial equipment and also capable of communicating with a server via the network, and having a function of acquiring the update software by communicating via the network with a server in which the update software is stored, and executing a write process for writing the acquired update software into the first memory, a function of sending the update software to the industrial equipment, and executing an update process for updating current software written in a second memory in the industrial equipment with the update software, a function of executing an update progress monitoring process for storing in the first memory update progress information indicating a portion of the second memory for which writing of the update software has been completed during the update process, and a function of monitoring the update progress based on the update progress information. and if it is determined in the normal completion determination process that the update process to the software has been completed normally, identifying a portion where the update process has failed from the update progress information and executing a re-update process for the identified portion . The second memory has a page corresponding to the smallest writable unit and a block corresponding to the smallest erasable unit, and one block is made up of a plurality of pages. When executing the update progress monitoring process, the controller generates update progress information as information indicating whether writing has been completed on a page basis. If it is determined in the normal completion determination process that the update process has not been completed normally, when executing the re-update process, the controller identifies the page where the update process has failed as a portion from the update progress information, erases only the block including the identified page from the second memory, and resumes writing on a block basis from the first page of the erased block, thereby executing the re-update process .
A monitoring device according to the present disclosure is a monitoring device used for updating software installed in industrial equipment with update software acquired via a network, the monitoring device comprising a controller and a first memory, the controller being capable of communicating with the industrial equipment and also capable of communicating with a server via the network, and having a function of acquiring the update software by communicating with the server in which the update software is stored via the network, and executing a write process for writing the acquired update software into the first memory, a function of transmitting the update software to the industrial equipment, and executing an update process for updating current software written in a second memory in the industrial equipment with the update software, and a function of storing update progress information indicating a portion of the second memory for which writing of the update software has been completed during the update process in the first memory. the update software is written in the first memory and stored in the second memory; and if it is determined in the normal completion determination process that the update process has not been completed normally, the controller has a function of executing an update progress monitoring process for storing the update software in the second memory, a function of executing a normal completion determination process for determining whether the update process to the update software has been completed normally based on the update progress information, and a function of identifying a portion of the update process that has failed from the update progress information and executing a re-update process for the identified portion. When executing the re-update process, after determining that the update process has been completed normally, the controller obtains a sum value of the update software written in the second memory from the industrial equipment as a first sum value and calculates the sum value of the update software written in the first memory as a second sum value, and if the first sum value and the second sum value do not match, erases all blocks of the update software written in the second memory and executes the re-update process by starting writing from the first page.

According to the present disclosure, by providing a configuration in which a monitoring device having a communication means is connected between an industrial device and a network, it is possible to obtain a monitoring device that can quickly and reliably complete the update process of software installed in the industrial device using update software obtained via the network, even in the case of industrial device that is not equipped with a communication function with the network and has limited non-volatile memory capacity.

1 is an overall configuration diagram including a monitoring device according to a first embodiment of the present disclosure; 5 is a flowchart showing a series of processing steps of a software update process in the monitoring device according to the first embodiment of the present disclosure. FIG. 1 is a diagram for explaining a write process to a non-volatile memory installed in an industrial device, which is executed by a monitoring device relating to embodiment 1 of the present disclosure, and is an explanatory diagram showing the relationship between pages and blocks of the non-volatile memory. FIG. 11 is an overall configuration diagram including a monitoring device according to a second embodiment of the present disclosure. FIG. 11 is a configuration diagram of a monitoring system including a monitoring device according to a third embodiment of the present disclosure. 13 is a flowchart showing a software sum value confirmation process procedure in a monitoring device according to a fourth embodiment of the present disclosure.

Embodiment 1.
Fig. 1 is an overall configuration diagram including a monitoring device according to the first embodiment of the present disclosure. The monitoring device 20 according to the first embodiment shown in Fig. 1 is connected to an industrial device 10 equipped with software via a communication cable 2. Furthermore, the monitoring device 20 is connected to an external network 4 via a LAN or a dedicated line 3.

Therefore, the monitoring device 20 is disposed between the industrial equipment 10 and the network 4, and is configured to be able to communicate with the industrial equipment 10 via the communication cable 2, and is configured to be able to communicate with the server 5 via the dedicated line 3 and the network 4.

The industrial equipment 10 includes a non-volatile memory 11 in which software is installed. The monitoring device 20 includes a CPU (controller) 21 and a non-volatile memory 22. Here, the CPU 21 corresponds to the controller, the non-volatile memory 22 corresponds to the first memory, and the non-volatile memory 11 corresponds to the second memory.

Figure 2 is a flowchart showing a series of processing steps of software update processing in monitoring device 20 according to embodiment 1 of the present disclosure. The series of processing steps performed by monitoring device 20 according to embodiment 1 will be described in detail based on the configuration diagram of Figure 1 and the flowchart of Figure 2.

In step S1, the monitoring device 20 communicates with the server 5 to determine whether or not update software for the industrial equipment 10 is stored in the server 5.

If it is determined that update software is not stored, the process proceeds to step S2, in which the monitoring device 20 does not update the software of the industrial equipment 10 and ends the series of processes.

On the other hand, if it is determined that update software is stored, the process proceeds to step S3, where the monitoring device 20 acquires update software for the industrial equipment 10 from the server 5 via the network 4.

Next, in step S4, the monitoring device 20 writes the update software obtained in step S3 to the non-volatile memory 22 installed in the monitoring device 20.

The monitoring device 20 has a function of controlling the writing of the update software stored in the non-volatile memory 22 to the non-volatile memory 11 mounted on the industrial equipment 10. Therefore, in step S5, the monitoring device 20 executes a write process to write the update software stored in the non-volatile memory 22 to the non-volatile memory 11 mounted on the industrial equipment 10.

Next, in step S6, the monitoring device 20 records the write status during the process of writing the update software to the non-volatile memory 11 as update progress information in the non-volatile memory 22.

Next, in step S7, the monitoring device 20 determines whether the process of writing the update software from the monitoring device 20 to the non-volatile memory 11 was successful or failed midway. If it is determined that the writing was successful, the process proceeds to step S10, and the monitoring device 20 completes a series of processes related to writing the software to the industrial equipment 10.

On the other hand, if it is determined that the write has failed, the process proceeds to step S8, where the monitoring device 20 erases the block containing the page where the write has failed based on the write status in the non-volatile memory 11.

Furthermore, in step S9, the monitoring device 20 resumes writing from the first page of the erased block and returns to step S7. That is, the monitoring device 20 can identify the part where writing failed based on the writing status and perform a re-update process on the identified part.

Details of the writing resumption process based on update progress information will be described later using Figure 3.

Then, after returning to step S7, the monitoring device 20 again determines whether the writing resumed in step S9 was successful. If it is determined that the writing was successful, the process proceeds to step S10, where the software writing to the industrial equipment is completed.

On the other hand, if it is determined that the writing failed, the process proceeds to step S8, and the monitoring device 20 executes the processes from step S8 onwards again.

In this way, by executing the series of processes shown in FIG. 2, even if the industrial equipment 10 does not have a communication function with the network 4 and does not have enough capacity to back up software in the non-volatile memory 11 installed, the software installed in the industrial equipment 10 can be quickly and reliably updated using update software obtained via the network 4 via the monitoring device 20.

In addition, the processes in steps S3 and S4 in FIG. 2 correspond to the "write process", the process in step S5 corresponds to the "update process", the process in step S6 corresponds to the "update progress monitoring process", the process in step S7 corresponds to the "normal completion determination process", and the processes in steps S8 and S9 correspond to the "re-update process".

The type of industrial equipment 10 used in this disclosure is not limited, and may be, for example, a machine tool, an inspection device, a manufacturing device, a power supply device, a power conversion device, etc.

Note that "there is not enough memory capacity" means, for example, that there is enough memory capacity to store one piece of software for the industrial equipment 10, but not enough memory capacity to store two pieces of software, one for backup and one for updates.

The monitoring device 20 is provided with an interface unit that enables communication with the industrial equipment 10, but the communication means can be of any type, such as serial communication or parallel communication. By being provided with such communication means, the monitoring device 20 can monitor the operating state and measurement values of the industrial equipment 10, and perform various settings and control.

The non-volatile memory 11 installed in the industrial equipment 10 and the non-volatile memory 22 installed in the monitoring device 20 may be of any type, and may be, for example, a flash ROM (also called a flash memory), an EEPROM, or the like. The non-volatile memory 22 installed in the monitoring device 20 may be built into the CPU (controller) 21.

Next, we will explain in detail a method for determining whether the process of writing update software from the monitoring device 20 to the non-volatile memory 11 was successful or failed midway, and for resuming the writing if necessary.

In general, in non-volatile memory, the smallest writable unit and the smallest erasable unit are different. Here, the smallest writable unit corresponds to a page (which can also be called a word), and the smallest erasable unit corresponds to a block. Furthermore, one block is made up of multiple pages.

When writing update software to the non-volatile memory 11 mounted on the industrial equipment 10, the monitoring device 20 records the write status on a page-by-page basis within the monitoring device 20. Any recording method may be used, and for example, it is conceivable that the industrial equipment 10 transmits a write completion response to the monitoring device 20 each time the monitoring device 20 writes update software to a page of the non-volatile memory 11.

When this method is adopted, the monitoring device 20 counts each time a completion response is received. Furthermore, if there is no reception response or if a negative response is received, the monitoring device 20 determines that the write has failed. In other words, when the monitoring device 20 executes the update progress monitoring process, it can generate update progress information indicating the write status as information indicating whether or not writing has been completed on a page-by-page basis.

Let us consider a case where the writing of update software from the monitoring device 20 to the non-volatile memory 11 fails due to a problem such as a power outage. In this case, the monitoring device 20 according to the first embodiment sequentially records the writing status as update progress information during the writing process of the update software.

Therefore, the monitoring device 20 can identify the page on which writing has failed based on the write status. As a result, the monitoring device 20 can erase only the block that contains the page on which writing has failed and resume writing from the first page of the erased block, thereby successfully completing the software update.

Figure 3 is a diagram for explaining the write process to the non-volatile memory 11 mounted on the industrial equipment 10, which is executed by the monitoring device 20 according to the first embodiment of the present disclosure, and is an explanatory diagram showing the relationship between pages and blocks of the non-volatile memory 11. The process when writing is resumed will be explained using Figure 3.

Figure 3 shows an example in which each block is made up of pages 1 to N. For example, consider a case in which all pages of block 1 have been written successfully, and then while writing to page 3 of block 2, the write fails due to a problem such as a power outage.

In this case, the monitoring device 20 can determine from the writing status that writing up to page 2 of block 2 was completed successfully, but that page 3 of block 2 was not completed successfully. Therefore, the monitoring device 20 erases the contents of block 2 and resumes writing from page 1 of block 2.

By recording the write status, when a write fails, there is no need to erase all blocks and rewrite from page 1 of block 1. Instead, it is possible to erase only the block containing the page where the write failed and write from the first page of the erased block. As a result, the write time can be shortened.

In addition, non-volatile memory generally has a limit to the number of times it can be rewritten. Therefore, by erasing only the blocks that contain the pages where writing has failed, the number of blocks to be erased can be minimized, and the number of rewrites can be reduced.

As described above, according to the first embodiment, even if the industrial equipment does not have a communication function with a network and does not have sufficient memory capacity, it is possible to update the software installed in the industrial equipment with update software obtained via the network by using a monitoring device that can communicate with the industrial equipment and the server.

In addition, the update software obtained via the network is stored in non-volatile memory mounted on the monitoring device, and the writing status can be monitored and recorded in the non-volatile memory while the update process is being carried out. As a result, even if writing fails due to a problem such as a power outage, the update process can be resumed based on the writing status, allowing the software update to be completed successfully.

Furthermore, by recording the write status, when a write fails, it is not necessary to erase all blocks and start writing from scratch; instead, it is possible to erase only the block containing the page where the write failed and start writing from the first page of the erased block. This reduces the write time. Also, the number of blocks to be erased can be kept to a minimum, reducing the number of rewrites.

Embodiment 2.
In the second embodiment, a case will be described in which the server 5 is configured as a cloud server 7.

Figure 4 is an overall configuration diagram including a monitoring device according to embodiment 2 of the present disclosure. Compared to the configuration of embodiment 1 shown in Figure 1, the configuration of embodiment 2 shown in Figure 4 uses a combination of the Internet 6 and a cloud server 7 instead of the combination of the network 4 and the server 5, and a host management system 8 is further connected to the Internet 6.

As shown in FIG. 4, the server 5 via the network 4 is configured as a cloud server 7 via the Internet 6. A host management system 8 for an administrator may also be provided.

In the configuration shown in FIG. 4, the host management system 8 stores update software for the industrial equipment 10 on the cloud server 7 in advance. The monitoring device 20 can obtain the update software for the industrial equipment 10 from the cloud server 7 via the Internet 6.

As described above, according to the second embodiment, it is possible to quickly and reliably update software even if the monitoring systems are scattered in remote locations throughout the country and overseas.

Embodiment 3.
In the third embodiment, a case will be described in which another industrial device is further connected to the industrial device 10.

FIG. 5 is a configuration diagram of a monitoring system including a monitoring device according to a third embodiment of the present disclosure. As shown in FIG. 5, a second industrial device 30 may be further connected to the industrial device 10.

The monitoring device 20 can write the update software for the second industrial equipment 30 to the non-volatile memory 22, and then write it from the monitoring device 20 to the non-volatile memory 31 installed in the second industrial equipment 30, thereby updating the software of the second industrial equipment 30 in the same manner.

As described above, according to the second embodiment, it is possible to update the software of multiple pieces of industrial equipment.

Embodiment 4.
In the fourth embodiment, measures against data corruption in the monitoring device according to the present disclosure will be described.

Figure 6 is a flowchart showing the software sum value confirmation process steps in a monitoring device according to embodiment 4 of the present disclosure.

In step S10, the monitoring device 20 confirms that writing of the software from the monitoring device 20 to the non-volatile memory 11 mounted on the industrial equipment 10 has been completed. Then, in step S11, the monitoring device 20 obtains from the industrial equipment 10 the sum value of the updated software calculated by the industrial equipment 10 as a first sum value.

Next, in step S12, the monitoring device 20 calculates the sum value of the software written to the non-volatile memory 11 as a second sum value, and compares it with the first sum value obtained in step S11. If the comparison result between the first sum value and the second sum value matches, the process proceeds to step S15, and the monitoring device 20 completes the check of the sum value.

On the other hand, if the comparison result between the first and second sum values shows a mismatch, the process proceeds to step S13, where the monitoring device 20 erases all blocks of the non-volatile memory 11 installed in the industrial equipment 10. Furthermore, in step S14, the monitoring device 20 starts writing the software to be updated again from the first page of the non-volatile memory 11.

This way, you can be sure that your software will be updated even if problems such as data corruption occur.

As described above, according to the fourth embodiment, after the update software has been successfully written to the non-volatile memory in the industrial equipment, the sum values can be compared to detect problems such as garbled data, and even if problems such as garbled data do occur, the software can be reliably updated again.

Embodiment 5.
In the fifth embodiment, a function of setting the software update date and time in advance in the monitoring device 20 according to the present disclosure will be described.

The monitoring device 20 according to the fifth embodiment has a function of executing an update time setting process to set the date and time when software is written to the non-volatile memory 11 installed in the industrial equipment 10.

Software updates cannot be performed while the industrial equipment 10 is in operation. For this reason, the industrial equipment 10 must be stopped before the software can be updated. In the monitoring device 20 according to the first embodiment, the update start date and time can be set to a date and time when the industrial equipment 10 is stopped, so that the software update process can be started at the desired timing without stopping the equipment in operation.

As described above, according to the fifth embodiment, software can be updated at a desired, pre-set timing without stopping the industrial equipment in operation.

Embodiment 6.
In the sixth embodiment, a case will be described in which communication is performed using encrypted data in the monitoring device 20 according to the present disclosure.

The monitoring device 20 according to the sixth embodiment executes encrypted communication with the server 5 via the network 4. By using encrypted communication, security performance can be improved and eavesdropping, tampering, etc. of data related to the update software can be prevented.

As described above, according to the sixth embodiment, it is possible to prevent eavesdropping, tampering, etc. of update software data, and to realize update processing with improved security performance.

Embodiment 7.
In the seventh embodiment, a function of determining whether or not software update is required in the monitoring device 20 according to the present disclosure will be described.

The monitoring device 20 according to the seventh embodiment has a function of acquiring the latest software information stored in the server 5 as first information from the server 5 via the network 4, and a function of acquiring software information of currently implemented software from the industrial equipment 10 as second information. Here, the software information may include software version information.

The monitoring device 20 then compares the acquired information with each other, and if there is a difference or mismatch, it determines that the software installed in the industrial equipment 10 needs to be updated with the latest software available on the server 5.

When the monitoring device 20 determines that an update process is necessary, it can obtain the latest software from the server 5 via the network 4. Furthermore, if necessary, it can update the software of the industrial equipment 10 with the obtained latest software.

As described above, according to embodiment 7, the software of industrial equipment can always be kept up to date with the latest version.

Embodiment 8.
In the eighth embodiment, a countermeasure when the power is turned off during software writing in the monitoring device 20 according to the present disclosure will be described.

The monitoring device 20 according to the eighth embodiment sets a bit indicating that writing is in progress to 1 while writing software from the monitoring device 20 to the non-volatile memory 11 mounted on the industrial equipment 10, and stores the bit in the non-volatile memory 22. When writing is completed, the bit indicating that writing is in progress is reset to 0.

When the monitoring device 20 starts up, it checks the bit indicating that writing is in progress, and if it is 1, it resumes writing, and if it is 0, it does not perform writing and can start up normally. In this way, even if the power to the monitoring device 20 is turned off due to a problem such as a power outage, it can check the bit indicating that writing is in progress when it is restarted, and if it is 1, it can resume writing, ensuring that the software is updated.

As described above, according to the eighth embodiment, when the power is turned on, the bit indicating that writing is in progress is checked, and if the bit is 1, it is determined that the power was turned off during the update process for some reason, and the update process can be resumed, ensuring that the software is updated.

1 Monitoring system, 2 Communication cable, 3 LAN or dedicated line, 4 Network, 5 Server, 6 Internet, 7 Cloud server, 8 Host management system for administrator, 10 Industrial equipment, 11 Non-volatile memory (second memory) mounted on the industrial equipment, 20 Monitoring device, 21 CPU (controller), 22 Non-volatile memory (first memory) mounted on the monitoring device, 30 Second industrial equipment, 31 Non-volatile memory (second memory) mounted on the second industrial equipment.

Claims (6)

A monitoring device used to update software installed in an industrial device with update software acquired via a network, comprising:
A controller;
a first memory,
The controller:
A system capable of communicating with the industrial equipment and a server via the network,
a function of acquiring the update software by communicating with the server in which the update software is stored via the network, and executing a write process for writing the acquired update software into the first memory;
a function of executing an update process for updating current software written in a second memory in the industrial equipment by transmitting the update software to the industrial equipment;
a function of executing an update progress monitoring process for storing, in the first memory, update progress information indicating a portion of the second memory for which writing of the update software has been completed during the execution of the update process;
a function of executing a normal completion determination process for determining whether the update process for the update software has been normally completed based on the update progress information;
and a function of, when it is determined that the update process has not been completed normally in the normal completion determination process, identifying a portion where the update process has failed from the update progress information and executing a re-update process on the identified portion ;
the second memory has a page corresponding to the minimum unit that can be written and a block corresponding to the minimum unit that can be erased, and one block is made up of a plurality of pages;
The controller:
When executing the update progress monitoring process, the update progress information is generated as information indicating whether or not writing has been completed on a page basis;
If it is determined in the normal completion determination process that the update process has not been completed normally, when executing the re-update process, the page in which the update process has failed is identified as the part from the update history information, only the block including the identified page is erased from the second memory, and writing is resumed in block units from the first page of the erased block, thereby executing the re-update process.
Surveillance equipment. A monitoring device used to update software installed in an industrial device with update software acquired via a network, comprising:
A controller;
a first memory,
The controller:
A system capable of communicating with the industrial equipment and a server via the network,
a function of acquiring the update software by communicating with the server in which the update software is stored via the network, and executing a write process for writing the acquired update software into the first memory;
a function of executing an update process for updating current software written in a second memory in the industrial equipment by transmitting the update software to the industrial equipment;
a function of executing an update progress monitoring process for storing, in the first memory, update progress information indicating a portion of the second memory for which writing of the update software has been completed during the execution of the update process;
a function of executing a normal completion determination process for determining whether the update process for the update software has been normally completed based on the update progress information;
and a function of, when it is determined that the update process has not been completed normally in the normal completion determination process, identifying a portion where the update process has failed from the update progress information and executing a re-update process on the identified portion ;
The controller:
When executing the re-update process, after it is determined that the update process has been completed normally, a sum value of the update software written in the second memory is obtained from the industrial equipment as a first sum value, the sum value of the update software written in the first memory is calculated as a second sum value, and if the first sum value and the second sum value do not match, all blocks of the update software written in the second memory are erased, and writing is started from the first page, thereby executing the re-update process.
Surveillance equipment. The controller:
The update start time setting process is performed by setting a date and time when the update process is to be performed as an update start date and time.
The monitoring device according to claim 1 , wherein the update process is started at the update start time. The controller:
4. The monitoring device according to claim 1, wherein when the writing process is executed, the update software is obtained from the server in the form of encrypted data. The controller:
5. A monitoring device as claimed in any one of claims 1 to 4, further comprising: acquiring information including a version of the update software from the server as first information; acquiring information including a version of the software written in the second memory of the industrial equipment as second information; and if the first information and the second information do not match, determining that the latest update software to be updated is present on the server; and executing the writing process to acquire the update software from the server. The controller:
6. The monitoring device according to claim 1, wherein when starting execution of the update process and when starting execution of the re-update process, a bit indicating that writing is in progress is set to 1, when the normal completion determination process determines that the process has completed normally, the bit is reset to 0, when power is turned on, it is determined whether the bit is 1, and when the bit is 1 , the re-update process is executed.