Patent ID: 12253841

DESCRIPTION OF THE EMBODIMENTS

Hereinafter, embodiments according to the invention will be described with reference to the drawings. In the following description, the same parts and elements are designated by the same reference numerals. These parts and elements also have the same names and functions. Therefore, the detailed description of these parts and elements will not be repeated.

A. Application Example

An application example of the invention will be described with reference toFIG.1.FIG.1is a diagram showing a configuration example of an information processing system1according to an embodiment.

The information processing system1includes one or more control systems2and one or more external devices500. The control system2is an FA system for automating a production process. The control system2includes a control unit100, a relay unit200, and a function unit300.

The relay unit200and the external device500are connected to an external network NW1. Communication between the relay unit200and the external device500is realized by Ethernet (registered trademark). That is, each of the relay unit200and the external device500is assigned with a valid IP address in the external network NW1, and the relay unit200and the external device500communicate with each other based on the IP address.

The control unit100, the relay unit200, and the function unit300are connected to an internal network NW2. Communication between these units is realized by, for example, Ethernet. That is, each unit constituting the control system2is assigned with a valid IP address in the internal network NW2, and each unit communicates with each other based on the IP address.

The control unit100is, for example, a PLC. The control unit100controls a drive device (not shown) according to a user program designed in advance. The drive device includes various industrial devices for automating the production process. As an example, the drive device includes a robot controller, a servo driver, an arm robot controlled by the robot controller, a servo motor controlled by the servo driver, etc. Further, the drive device may include a visual sensor for photographing a workpiece, other devices used in the production process, etc.

The function unit300provides various functions for realizing control for various control targets with the control unit100. The function unit300includes a Web server S2and applications AP2A and AP2B. The applications AP2A and AP2B are programs for providing various services related to the control system2.

The external device500is, for example, a notebook type or desktop type PC (Personal Computer), a tablet terminal, a smartphone, an HMI (Human Machine Interface), or other information processing terminals.

The relay unit200relays communication between a device (that is, the external device500) connected to the external network NW1 and a device (that is, the control unit100and the function unit300) connected to the internal network NW2. The relay unit200includes a communication unit250, a setting unit252, and a link information generation unit254as a functional configuration for realizing a communication relay function.

The communication unit250is a communication module for realizing communication with various devices. Typically, the communication unit250realizes communication with the external device500connected to the external network NW1 (first network), and communication with another unit (for example, the function unit300) connected to the internal network NW2 (second network).

The setting unit252acquires address information of the function unit300in the internal network NW2 from the function unit300. The address information is communication information capable of uniquely identifying the function unit300in the internal network NW2. As an example, the address information is an IP address, a domain name or a host name.

The setting unit252generates an identifier that substitutes for the address information based on receiving the address information from the function unit300. The identifier is, for example, an arbitrary character string. The setting unit252associates the address information received from the function unit300with the generated identifier, and writes these in communication setting information230.

The link information generation unit254generates link information used for accessing information in the function unit300connected to the internal network NW2 from the external device500connected to the external network NW1 based on the identifier generated by the setting unit252. The “information in the function unit300” means arbitrary information stored in the function unit300, and is a concept including a program (application) and data. The “link information” is an address indicating an access destination to the information in the function unit300, and is, for example, a URL or a hyperlink. The link information generation unit254embeds the generated link information in an HTML (HyperText Markup Language) document, and then transmits the HTML document to the external device500.

The external device500displays a screen corresponding to the HTML document received from the relay unit200. As a result, the link information is displayed on the screen of the external device500. By clicking the displayed link information, the user can access the information of the access destination indicated by the link information. At this time, the user does not need to ascertain the IP address of the function unit300which is the access destination.

Further, the link information displayed on the external device500only includes the identifier of the function unit300in the external network NW1, and does not include the IP address of the function unit300in the internal network NW2. That is, the IP address of the function unit300in the internal network NW2 is not disclosed to the external device500. As a result, the function unit300belonging to the internal network NW2 is concealed. In addition, direct communication between the external device500and the function unit300is prevented, and the security risk associated with the communication is reduced.

B. Control System2

The control system2shown inFIG.1will be described with reference toFIG.2.FIG.2is an external view showing a configuration example of the control system2.

With reference toFIG.2, the control system2includes one or a plurality of control units100, one or a plurality of relay units200, one or a plurality of function units300, one or a plurality of function units400, and a power supply unit450.

The control unit100and the relay unit200are connected via an arbitrary data transmission path. The control unit100, the relay unit200, and one or a plurality of function units300and400are connected via an internal bus10(seeFIG.7) described later.

The control unit100executes a central process in the control system2. The control unit100executes a control operation for controlling a control target according to an arbitrarily designed requirement specification. In the configuration example shown inFIG.2, the control unit100has one or a plurality of communication ports. The control unit100corresponds to a process execution unit that executes standard control according to a standard control program.

The relay unit200is connected to the control unit100and is in charge of a communication function with other devices. In the configuration example shown inFIG.2, the relay unit200has one or a plurality of communication ports. Details of the communication function provided by the relay unit200will be described later.

The function unit300is an optional unit, and is connected to the control unit100as required. The function unit300may typically include an SGU (Security Guard Unit), a communication unit having a data exchange function by OPC UA (Object Linking and Embedding for Process Control Unified Architecture), an AI unit having a preventive maintenance function by AI (Artificial Intelligence), etc.

The function unit400provides various functions for realizing control for various control targets with the control system2. The function unit400may typically include an I/O unit, a safety I/O unit, a communication unit, a motion controller unit, a temperature adjustment unit, a pulse counter unit, etc. As the I/O unit, for example, a digital input (DI) unit, a digital output (DO) unit, an analog input (AI) unit, an analog output (AO) unit, a pulse catch input unit, and a composite unit in which a plurality of types are mixed can be mentioned. The safety I/O unit is in charge of an I/O process related to safety control.

The power supply unit450supplies power of a predetermined voltage to each unit constituting the control system2.

C. Hardware Configuration Example of Each Unit

Next, a hardware configuration example of each unit constituting the control system2according to the present embodiment will be described.

(c1: Control unit100)

FIG.3is a schematic diagram showing a hardware configuration example of the control unit100constituting the control system2according to the present embodiment. With reference toFIG.3, the control unit100includes, as main components, a processor102such as a CPU (Central Processing Unit) and a GPU (Graphical Processing Unit), a chipset104, a main storage device106, a secondary storage device108, a communication controller110, a USB (Universal Serial Bus) controller112, a memory card interface114, network controllers116,118, and120, an internal bus controller122, and an indicator124.

The processor102reads various programs stored in the secondary storage device108, and expands and executes the programs in the main storage device106, so as to realize the control operation related to standard control and various processes as described later. The chipset104realizes the processing of the control unit100as a whole by mediating the exchange of data between the processor102and each component.

In addition to a system program, the secondary storage device108stores a control program that operates in an execution environment provided by the system program.

The communication controller110is in charge of exchanging data with the function unit300. As the communication controller110, for example, a communication chip corresponding to Ethernet or the like can be adopted.

The USB controller112is in charge of exchanging data with an arbitrary information processing device via USB connection.

The memory card interface114is configured so that a memory card115can be attached thereto and detached therefrom, and is capable of writing data such as the control program and various settings to the memory card115or reading data such as the control program and various settings from the memory card115.

Each of the network controllers116,118, and120is in charge of exchanging data with an arbitrary device via a network. The network controllers116,118, and120may employ industrial network protocols such as EtherCAT (registered trademark), EtherNet/IP (registered trademark), DeviceNet (registered trademark), and CompoNet (registered trademark).

The internal bus controller122is in charge of exchanging data with the relay unit200, one or a plurality of function units300, and one or a plurality of function units400constituting the control system2. A manufacturer-specific communication protocol may be used for the internal bus, or a communication protocol that is the same as or compliant with any of the industrial network protocols may be used.

The indicator124notifies an operating state or the like of the control unit100, and is composed of one or a plurality of LEDs arranged on a surface of the unit.

FIG.3shows a configuration example in which the required functions are provided by the processor102executing programs, but some or all of these provided functions may be implemented by using a dedicated hardware circuit (for example, ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array)). Alternatively, the main part of the control unit100may be realized by using hardware that follows a general-purpose architecture (for example, an industrial personal computer based on a general-purpose personal computer). In this case, a plurality of OSs (Operating Systems) having different uses may be executed in parallel by using a virtualization technology, and the required applications may be executed on each OS.

(c2: Relay Unit200)

FIG.4is a schematic diagram showing a hardware configuration example of the relay unit200constituting the control system2according to the present embodiment. With reference toFIG.4, the relay unit200includes, as main components, a processor202such as a CPU and a GPU, a chipset204, a main storage device206, a secondary storage device208, a communication controller210, a communication interface212, a memory card interface214, network controllers216and218, and an indicator224.

The processor202reads various programs stored in the secondary storage device208, and expands and executes the programs in the main storage device206, so as to realize various communication functions as described later. The chipset204realizes the processing of the relay unit200as a whole by mediating the exchange of data between the processor202and each component.

In addition to a system program, the secondary storage device208stores various data such as a communication control program232that operates in an execution environment provided by the system program, and communication setting information230.

The communication controller210is in charge of exchanging data with the control unit100and the function unit300. As the communication controller210, for example, a communication chip corresponding to Ethernet or the like can be adopted.

The communication interface212is in charge of exchanging data with an arbitrary information processing device via USB connection.

The memory card interface214is configured so that a memory card215can be attached thereto and detached therefrom, and is capable of writing data such as the control program and various settings to the memory card215or reading data such as the control program and various settings from the memory card215.

Each of the network controllers216and218is in charge of exchanging data with an arbitrary device via a network. The network controllers216and218may employ a general-purpose network protocol such as Ethernet. As an example, the relay unit200communicates with the external device500via the network controller216or the network controller218.

The indicator224notifies an operating state or the like of the relay unit200, and is composed of one or a plurality of LEDs arranged on a surface of the unit.

FIG.4shows a configuration example in which the required functions are provided by the processor202executing programs, but some or all of these provided functions may be implemented using a dedicated hardware circuit (for example, ASIC or FPGA). Alternatively, the main part of the relay unit200may be realized by using hardware that follows a general-purpose architecture (for example, an industrial personal computer based on a general-purpose personal computer). In this case, a plurality of OSs having different uses may be executed in parallel by using a virtualization technology, and the required applications may be executed on each OS.

(c3: Function Unit300)

FIG.5is a schematic diagram showing a hardware configuration example of the function unit300constituting the control system2according to the present embodiment. With reference toFIG.5, the function unit300includes, as main components, a processor302such as a CPU and a GPU, a chipset304, a main storage device306, a secondary storage device308, a memory card interface314, an internal bus controller322, and an indicator324.

The processor302reads various application programs stored in the secondary storage device308, and expands and executes the application programs in the main storage device306, so as to realize a server function and various functions. The chipset304realizes the processing of the function unit300as a whole by mediating the exchange of data between the processor302and each component.

In addition to a system program, the secondary storage device308stores an application program that operates in an execution environment provided by the system program.

The memory card interface314is configured so that a memory card315can be attached thereto and detached therefrom, and is capable of writing data such as the application programs and various settings to the memory card315or reading data such as the application programs and various settings from the memory card315.

The internal bus controller322is in charge of exchanging data with the control unit100and the relay unit200via an internal bus.

The indicator324notifies an operating state or the like of the function unit300, and is composed of one or a plurality of LEDs arranged on a surface of the unit.

FIG.5shows a configuration example in which the required functions are provided by the processor302executing the programs, but some or all of these provided functions may be implemented by using a dedicated hardware circuit (for example, ASIC or FPGA). Alternatively, the main part of the function unit300may be realized by using hardware that follows a general-purpose architecture (for example, an industrial personal computer based on a general-purpose personal computer). In this case, a plurality of OSs having different uses may be executed in parallel by using a virtualization technology, and the required applications may be executed on each OS.

D. Hardware Configuration Example of External Device500

Next, a hardware configuration of the external device500will be described in order with reference toFIG.6.FIG.6is a schematic diagram showing a hardware configuration example of the external device500constituting the information processing system1according to an embodiment.

As an example, the external device500is composed of a computer configured according to a general-purpose computer architecture. The external device500includes a processor502such as a CPU and an MPU, a main storage device504, a secondary storage device510, a communication interface511, an I/O (Input/Output) interface514, and a display interface520. These components are communicably connected to each other via an internal bus525.

The processor502controls the operation of the external device500by executing various control programs such as a development support program510A and a browser application (not shown). The development support program510A is a program that provides an environment for developing the control program (user program) of the control system2. Based on receiving an execution instruction of various control programs such as the development support program510A and the browser application, the processor502reads the control program to be executed from the secondary storage device510to the main storage device504.

The communication interface511exchanges data with another communication device via a network. The another communication device includes, for example, the relay unit200, a server, etc. The external device500may be configured to be capable of downloading various control programs such as the development support program510A from the another communication device via the communication interface511.

The I/O interface514is connected to an input device515and captures a signal indicating a user operation from the input device515. The input device515typically includes a keyboard, a mouse, a touch panel, a touch pad, etc., and receives the operation from the user. In the example ofFIG.6, the external device500and the input device515are shown as separate parts, but the external device500and the input device515may be integrally configured.

The display interface520is connected to a display521and sends an image signal for displaying an image to the display521according to a command from the processor502or the like. The display521is, for example, an LCD (Liquid Crystal Display) or an organic EL (Electro Luminescence), and presents various information to the user. The display521may display various screens provided by the development support program510A. In the example ofFIG.6, the external device500and the display521are shown as separate parts, but the external device500and the display521may be integrally configured.

E. Unit Configuration Example of Information Processing System1

FIG.7is a diagram showing an example of a unit configuration of the information processing system1. A specific example of the unit configuration of the information processing system1will be described with reference toFIG.7.

As shown inFIG.7, the information processing system1includes the control system2and the external device500. The control system2includes the control unit100, the relay unit200, and the function unit300. The control unit100, the relay unit200, and the function unit300are connected via the internal bus10. These units communicate with each other via the internal bus10. The communication is realized by, for example, virtual Ethernet.

The relay unit200and the external device500are connected to the external network NW1. An IP address “192.168.250.3” is assigned to the external device500. The relay unit200and the external device500each have a physical communication port, and are connected to the external network NW1 via the communication port.

The control unit100, the relay unit200, and the function unit300are connected to the internal network NW2. A virtual IP address “192.168.250.1” is assigned to the control unit100. Further, a unit name “Unit #0” is assigned to the control unit100.

An IP address “192.168.250.2” is assigned to the relay unit200. Further, a unit name “Unit #1” is assigned to the relay unit200. The relay unit200functions as a Web server “Web1”. Applications “App11” and “App12” are installed in the relay unit200. The applications “App11” and “App12” are accessed from the Web server “Web1”.

In the example ofFIG.7, the function unit300is composed of two function units U2 and U3. A virtual IP address “192.168.251.100” is assigned to the function unit U2. Further, a unit name “Unit #2” is assigned to the function unit U2. The function unit U2 functions as a Web server “Web2”. Applications “App21” and “App22” are installed in the function unit U2. The applications “App21” and “App22” are accessed from the Web server “Web2”.

A virtual IP address “192.168.251.101” is assigned to the function unit U3. Further, a unit name “Unit #3” is assigned to the function unit U3. The function unit U3 functions as a Web server “Web3”. Applications “App31” and “App32” are installed in the function unit U3. The applications “App31” and “App32” are accessed from the Web server “Web3”.

The relay unit200has a reverse proxy function. More specifically, the relay unit200functions as a Web server when receiving an access request from the external device500. Then, the relay unit200rewrites the access request received from the external device500, and transmits the rewritten access request to the function unit300of the access destination. At this time, the relay unit200functions as a client, and the function unit300of the access destination functions as a Web server. In this way, the relay unit200functions as both a Web server and a client.

F. Method of Generating Communication Setting Information230

The relay unit200needs to route the access request from the external device500in order to relay the communication between the external device500and the function units U2 and U3. In order to realize such a relay function, the relay unit200generates the communication setting information230(seeFIG.1) for routing in advance.

Hereinafter, a method of generating the communication setting information230will be described with reference toFIG.8toFIG.10.FIG.8is a diagram showing a data flow between the relay unit200and the function unit300during generation of the communication setting information230. The process shown inFIG.8is executed, for example, when the control unit100is started.

In step S10, the relay unit200transmits an acquisition request for information about the function unit U2 (hereinafter, also referred to as “proxy information”) to the function unit U2. The function unit U2 receives the acquisition request, and transmits its own proxy information to the relay unit200.

FIG.9is a diagram showing an example of the proxy information transmitted in step S10. The proxy information includes, for example, a domain name, a unit name, and a host name. In the example ofFIG.9, the domain name is shown as “A1”, the unit name is shown as “#2”, and the host name is shown as “Unit 2”.

In step S12, the relay unit200functions as the setting unit252(seeFIG.1) described above, and updates the communication setting information230based on the proxy information received from the function unit U2.FIG.10is a diagram showing an example of the communication setting information230. In step S12, information shown by a broken line230A is added to the communication setting information230. As a result, the address information of the function unit U2 (in the example ofFIG.10, the host name “Unit 2”) is associated with the identifier “u2”.

The identifier “u2” associated with the host name “Unit 2” is generated according to a predetermined rule by the relay unit200. Preferably, the relay unit200generates a character string as the identifier that makes it easy for the user to identify the function unit U2. As an example, the identifier is generated based on the domain name of the function unit U2, the unit name of the function unit U2 or the host name of the function unit U2.

The address information associated with the identifier “u2” is not necessarily the host name if the address information can specify the IP address of the function unit U2 in the internal network NW2. As an example, the address information associated with the identifier “u2” may be the IP address itself of the function unit U2 in the internal network NW2, or may be the domain name of the function unit U2.

In step S20, the relay unit200transmits an acquisition request for proxy information to the function unit U3. The function unit U3 receives the acquisition request, and transmits its own proxy information to the relay unit200.

In step S22, the relay unit200functions as the setting unit252(seeFIG.1) described above, and updates the communication setting information230based on the proxy information received from the function unit U3. In step S22, information shown by a broken line230B inFIG.10is added to the communication setting information230. As a result, the address information of the function unit U3 (in the example ofFIG.10, the host name “Unit 3”) is associated with the identifier “u3”. The identifier “u3” is generated by the relay unit200according to the same rule as the identifier “u2”.

The address information associated with the identifier “u3” is not necessarily the host name if the address information can specify the IP address of the function unit U3 in the internal network NW2. As an example, the address information associated with the identifier “u3” may be the IP address itself of the function unit U3 in the internal network NW2, or may be the domain name of the function unit U3.

G. Display Process of Portal Site

The external device500displays a portal site for accessing the application of each unit in the control system2. By displaying such a portal site, the user can use the application of each unit without ascertaining the information of each unit in the control system2(for example, the IP address, etc. of each unit).

Hereinafter, a display flow of the portal site will be described with reference toFIG.11toFIG.13.FIG.11is a diagram showing a data flow between the relay unit200and the external device500during display of the portal site.

In step S30, it is assumed that the user has performed a display operation of the portal site on the external device500by using the input device515(seeFIG.6). Based on this, the external device500transmits an acquisition request for the portal site to the relay unit200.

In step S32, the relay unit200receives the acquisition request for the portal site from the external device500, and functions as the link information generation unit254(seeFIG.1) described above and generates link information for accessing the application of each unit.FIG.12is a diagram showing the link information30generated in step S32.

The link information30is described in HTML. The link information30includes a valid URL31in the external network NW1, and a hyperlink32. The hyperlink is some kind of character string associated with a URL.

The link information30is generated based on the communication setting information230(seeFIG.10) described above. More specifically, the relay unit200generates the link information based on its own address information (for example, an IP address) and the identifier of each unit defined in the communication setting information230. In the example ofFIG.12, based on the IP address “192.168.250.2” of the relay unit200and the identifier “u3” of the function unit U3 defined in the communication setting information230, a valid URL “http://192.168.250.2/u3/App31/index.php” is generated in the external network NW1. “App31” shown in the URL is the identifier of the application in the function unit U3. The relay unit200generates such a URL for each application in each unit of the control system2, and writes the URL in the link information30.

In step S40, the relay unit200functions as the communication unit250(seeFIG.1) described above, and transmits the generated link information30to the external device500. The external device500configures the portal site based on the received link information30, and displays the portal site on the display521(seeFIG.6).FIG.13is a diagram showing a portal site710displayed on the external device500.

A link to each unit is shown as a hyperlink on the portal site710. In the example ofFIG.13, the link to the function unit U2 is shown as a hyperlink710A, and the link to the function unit U3 is shown as a hyperlink710B.

The content displayed on the portal site710may be changed according to an access right of the user who has logged in to the external device500. The access right given to each user is set in advance in the external device500, etc., for example, and is transmitted to the control system2as user-specific access right information. Further, in each of the function units300, the type of the access right that permits access is set for each application, and each of the function units300holds the type of the access right as application-specific access right information.

On this premise, in steps S10and S20ofFIG.8, each of the function units300transmits the application-specific access right information to the relay unit200when transmitting the proxy information (seeFIG.9) to the relay unit200. The relay unit200stores the received application-specific access right information.

Thereafter, in step S30ofFIG.11, when transmitting the acquisition request for the portal site to the relay unit200, the external device500also transmits login information (for example, user ID) to the external device500. The relay unit200specifies the type of the access right given to the logged-in user based on the user-specific access right information. Then, the relay unit200specifies the application (or function unit) that can be accessed with the access right of the logged-in user based on the application-specific access right information. Thereafter, the relay unit200generates link information only for the specified application. As a result, the content displayed on the portal site710is changed according to the access right given to the user.

H. Reverse Proxy Process

Next, the reverse proxy function of the relay unit200will be described with reference toFIG.14toFIG.16.FIG.14is a diagram showing a data flow between the relay unit200, the function unit300, and the external device500during a proxy response.

In step S50, it is assumed that the external device500is displaying the portal site710shown inFIG.15.FIG.15is a diagram showing an example of screen transition of the portal site710. The user can select any of the hyperlinks in the portal site710. In step S50, for example, it is assumed that the hyperlink710B of the portal site710is selected.

In step S52, the external device500transmits an access request corresponding to the selected hyperlink710B to the relay unit200. The access request includes a URL associated with the selected hyperlink710B.

In step S54, the relay unit200functions as the communication unit150(seeFIG.1) described above, acquires the URL included in the access request received from the external device500, and rewrites the URL.FIG.16is a diagram schematically showing a rewriting process of the URL.

InFIG.16, an access request40A from the external device500is shown as the URL “http://192.168.250.2/u3/App31/index.php”. “192.168.250.2” shown in the access request40A indicates the IP address of the relay unit200. “u3” shown in the access request40A indicates the identifier of the unit of the access destination. “App31” shown in the access request40A indicates the application of the unit of the access destination.

The communication unit150acquires the identifier “u3” included in the access request40A based on receiving the access request40A (first access request) from the external device500. Next, the communication unit150acquires the address information corresponding to the identifier “u3” with reference to the communication setting information230described with reference toFIG.10described above. As a result, the valid address information “unit3” in the internal network NW2 is specified. Thereafter, the communication unit150rewrites the access request40A and generates an access request40B (second access request) including the address information “unit3”.

More specifically, the communication unit150generates the access request40B by replacing the identifier “u3” included in the access request40A with the address information “unit_3” corresponding to the identifier “u3”. At this time, the domain “192.168.250.2” (that is, destination information) included in the access request40A is deleted. As a result, the access request40A “http://192.168.250.2/u3/App31/index.php” is rewritten to the access request40B “http://unit_3/App31/index.php”, and the destination is rewritten from the relay unit200to the function unit U3. The communication unit150transmits the rewritten access request40B to the function unit U3.

In step S60, the function unit U3 accesses the application in the function unit U3 based on the access request40B received from the relay unit200, and acquires the target information via the application. The function unit U3 transmits the acquired information as an HTML document to the relay unit200.

In step S70, the relay unit200functions as a Web server again, and transmits the HTML document received from the function unit U3 to the external device500. The external device500analyzes the received HTML document and displays a screen corresponding to the HTML document on the display521(seeFIG.6).FIG.13shows a screen720displayed in step S70.

As described above, the user clicks the hyperlink710B whereby the external device500accesses the function unit U3 corresponding to the hyperlink710B and acquires the target information from the function unit U3. At this time, the user does not need to ascertain the IP address of the function unit U3 which is the access destination.

Further, the link information displayed on the portal site710only includes the identifier of the function unit300in the external network NW1, and the IP address of the function unit300in the internal network NW2 is not included. That is, the IP address of the function unit300in the internal network NW2 is not disclosed to the external device500. As a result, the function unit300belonging to the internal network NW2 is concealed. In addition, direct communication between the external device500and the function unit300is prevented, and the security risk associated with the communication is reduced.

I. First Modified Example of Information Processing System1

FIG.17is a diagram showing a unit configuration of an information processing system1A according to the first modified example. The unit configuration of the information processing system1A will be described with reference toFIG.17.

InFIG.7described above, each unit constituting the information processing system1is connected via the internal bus10. In contrast thereto, in the information processing system1A according to the first modified example, each unit is connected to the internal network NW2 via the communication port. That is, in this modified example, each unit is installed at a physically separated place. Even such a unit configuration does not deviate from the gist of the invention.

J. Second Modified Example of Information Processing System1

FIG.18is a diagram showing a unit configuration of an information processing system1B according to the second modified example. The unit configuration of the information processing system1B will be described with reference toFIG.18.

In the information processing system1shown inFIG.7described above, only the relay unit200is connected to the external network NW1. In contrast thereto, in the information processing system1B according to the second modified example, not only the relay unit200but also other units are connected to the external network NW1. That is, in this modified example, not only the relay unit200but also other function units can directly communicate with the external device500. Even such a unit configuration does not deviate from the gist of the invention.

In the example ofFIG.18, not only the relay unit200is directly connected to the external device500, the function unit U3 is also directly connected to the external device500. That is, in the communication path from the external device500to the function unit U3, a communication path R1 via the relay unit200and a communication path R2 not via the relay unit200exist.

With existence of a plurality of communication paths, permission/prohibition of access to each application is switched according to the communication path. As an example, for the application “App31” of the function unit U3, communication on the communication path R2 is prohibited, and only communication on the communication path R1 is permitted. On the other hand, for the application “App32” of the function unit U3, communication on the communication path R1 is prohibited, and only communication on the communication path R2 is permitted.

More specifically, the access permission/prohibition rule is defined in advance for each communication path and each application, and is held in each of the function units300as a permission/prohibition rule. When receiving the access request from the relay unit200or the external device500, the function unit300specifies the access source from the URL included in the access request, and specifies the communication path based on the access source. Thereafter, the function unit300determines whether or not access to the application of the access destination is permitted for the specified communication path by referring to the permission/prohibition rule.

K. Appendix

As described above, the present embodiment includes the following disclosure.

[Configuration 1]

A unit (200) connectable to a PLC (Programmable Logic Controller) (100), the unit including: a communication unit (250) for relaying communication between an external device (500) connected to a first network and an other unit (300) connected to a second network; a setting unit (252) for acquiring address information of the other unit (300) in the second network from the other unit (300), and generating setting information (230) in which the address information is associated with an identifier that substitutes for the address information; and a link information generation unit (254) generating link information used for accessing information in the other unit (300) from the external device (500) based on the identifier.

[Configuration 2]

The unit according to configuration1, wherein the communication unit (250):

based on receiving a first access request that is generated by the external device (500) based on the link information from the external device (500), acquires the identifier included in the first access request,

acquires the address information corresponding to the identifier with reference to the setting information (230), and

accesses information in the other unit (300) based on a second access request including the address information.

[Configuration 3]

The unit according to configuration2, wherein the communication unit (250) generates the second access request by replacing the identifier included in the first access request with the address information.

[Configuration 4]

The unit according to any one of configurations1to3, wherein the unit (200) is connected to the other unit (300) by a bus (10), and

the communication unit (250) communicates with the other unit (300) by using the bus (10).

[Configuration 5]

The unit according to any one of configurations1to4, wherein the unit (200) further includes a communication port that is physical, and

the communication unit (250) communicates with the external device (500) by using the communication port.

[Configuration 6]

The unit according to any one of configurations1to4, wherein the link information includes a hyperlink, and

the communication unit (250) displays the hyperlink on the external device (500).

[Configuration 7]

A control method for a unit (200) connectable to a PLC (100), the control method including: a step of relaying communication between an external device (500) connected to a first network and an other unit (300) connected to a second network;

a step of acquiring address information of the other unit (300) in the second network from the other unit (300), and generating setting information (230) in which the address information is associated with an identifier that substitutes for the address information (S12, S22); and
a step of generating link information used for accessing information in the other unit (300) from the external device (500) based on the identifier.

[Configuration 8]

A non-transitory computer-readable recording medium, recording a control program for a unit (200) connectable to a PLC (100), the control program causing the unit (200) to execute:

a step of relaying communication between an external device (500) connected to a first network and an other unit (300) connected to a second network;

a step of acquiring address information of the other unit (300) in the second network from the other unit (300), and generating setting information (230) in which the address information is associated with an identifier that substitutes for the address information (S12, S22); and

a step of generating link information used for accessing information in the other unit (300) from the external device (500) based on the identifier.

It should be considered that the embodiments disclosed herein are exemplary in all respects and not restrictive. The scope of the invention is shown by the claims rather than the above description, and it is intended that all modifications within the meaning and scope equivalent to the claims are included.