B&R Firmware Version Management on B&R X20 Systems Without OEM Access

Overview

Maintaining B&R Automation hardware on machines from defunct OEMs means you have no service contract, no project source files, no Automation Studio license tied to the machine, and no support portal credentials. This guide covers how to inventory firmware versions, obtain firmware without a B&R customer account, understand compatibility between Automation Studio (AS), Automation Runtime (AR), and module firmware, safely update firmware on a production machine, and troubleshoot version mismatches.

The primary hardware target is the B&R X20CP1584 CPU (Atom 0.6 GHz, 256 MB DDR2, CompactFlash, POWERLINK V1/V2, Ethernet) and its associated X20 I/O modules, bus controllers, and ACOPOS drives. The CP1584 has been supported since Automation Studio V3.0.90.20 and runs AR versions in the standard (non-SGC, non-Embedded) track.

Audience: Automation engineers maintaining B&R X20 systems on machines where the OEM is gone and no documentation exists.

Related documents:

• firmware.md — General firmware concepts and inventory templates
• cf-card-boot.md — CompactFlash card boot procedure and recovery
• acopos-drives.md — ACOPOS servo drive firmware and parameter management

1. Understanding B&R Version Architecture

1.1 The Three-Layer Firmware Stack

B&R systems have three interdependent firmware/version layers:

A mismatch at any layer prevents downloads, causes errors, or bricks modules.

1.2 Automation Runtime (AR) Version Naming Convention

AR versions use a prefix letter + version number format:

For the X20CP1584: The runtime version will typically be in the standard track (no prefix, e.g., 4.10, 4.12, 4.90, 4.93) or may display as E4.xx on the boot screen depending on the firmware generation. Check the CPU’s boot screen or the System Diagnostics Manager to confirm the exact AR version string.

1.3 AS-to-AR Compatibility Rules

• Each AS version ships with a set of AR “upgrades” (runtime packages). The project specifies which AR version the target runs.
• AS version must be >= the minimum AS version that supports the chosen AR version.
• Newer AS versions can generally target older AR versions (backward compatible), but older AS versions cannot target newer AR versions.
• The AR upgrade must be installed on the development PC (via Tools > Upgrades in AS) before you can build a project targeting that AR version.
• Automation Studio 4.x targets AR 4.x. Automation Studio 6.x targets AR 6.x. These are NOT cross-compatible — an AS6 project cannot be downloaded to an AR4 target.

2. Determining Firmware Versions on an Existing System

2.1 CPU / Automation Runtime Version

Method 1: Boot Screen (No Tools Required)

When the X20CP1584 powers on, the boot screen displays the AR version briefly. Connect a monitor/keyboard or observe via serial console (IF1 RS232 at 115.2 kbps). Look for a line like:

B&R Automation Runtime N4.02

or

B&R Automation Runtime E4.10

This is the fastest way to identify the runtime version with zero tooling.

Method 2: System Diagnostics Manager (SDM) via Web Browser

1. Determine the CPU’s IP address (check any network scanner, or try the default B&R range 192.168.1.x)
2. Open a web browser and navigate to http://<CPU-IP>
3. SDM shows detailed hardware/software info including:
   • AR version
   • CPU model and hardware revision
   • All connected I/O modules and their firmware versions
   • X2X Link topology and module status
   • Battery status
4. SDM works even when the PLC is in SERVICE mode

Method 3: Automation Studio — Online > Device Information

With AS connected to the target over Ethernet:

1. Online > Settings — confirm IP connectivity
2. Online > Device Information — shows target AR version, CPU model, serial number
3. Physical View shows each module with its firmware version in the properties panel

Method 4: Read AR Version from the CompactFlash Card

If you have the CF card removed from the CPU (see cf-card-boot.md):

• Mount the CF card on a PC
• The AR version is embedded in the boot configuration files on the card
• Look for the BrAppData directory and configuration files that reference the runtime version

2.2 I/O Module Firmware Versions

X20 I/O modules receive their firmware from the CPU during the download process. The CPU pushes the correct firmware to each module via the X2X Link bus.

Method 1: SDM (Recommended)

Via http://<CPU-IP> in SDM, the I/O tree shows each X20 module with its current firmware version and hardware revision.

Method 2: Automation Studio Physical View

When connected online (Online > Go Online), the Physical View displays each module. Right-click a module > Properties to see the firmware version running on the target vs. the version in the project.

Method 3: Module LEDs

While not version-specific, I/O module LED behavior indicates firmware mismatch:

• Blinking r (red) LED: The module is in an error state, which can include firmware mismatch with the CPU’s expected version
• Solid r LED: Fatal error; module will not operate

2.3 Bus Controller Firmware (X20BC0083, X20BC0088)

Method 1: Web Server on the Bus Controller

For EtherNet/IP bus controllers (X20BC0088):

1. Connect to the bus controller’s IP address via web browser
2. Navigate to the Adapter Status page — Version Information section shows firmware version
3. Login: default username admin, password X20BC0088 (case sensitive, model-specific)

Method 2: Automation Studio

When the bus controller is part of the AS project, its firmware version appears in the Physical View. If the BC is a standalone gateway not managed by a CPU, use the web interface.

2.4 ACOPOS Drive Firmware Versions

Method 1: ACOPOS Service Menu

On the drive front panel:

1. Access the ACOPOS Service menu (procedure varies by drive model — consult acopos-drives.md)
2. Navigate to the firmware/software version parameter
3. The display shows the current drive firmware (e.g., V2.47)

Method 2: Automation Studio — Drive Parameters

When connected to the CPU controlling the drives:

1. Open Hardware Configuration > Drive Parameters
2. The parameter tree shows the drive firmware version
3. Compare against the .GDM file version — open the GDM as text (right-click > Open With > Notepad) and search for the V prefix version string

Method 3: SDM

If drives are connected via POWERLINK, SDM at http://<CPU-IP> may show drive status including firmware versions in the motion diagnostic section.

3. Obtaining Firmware Without an Active Service Contract

3.1 The Access Problem

B&R’s download portal (br-automation.com/downloads) requires a login for most firmware files. Many downloads show “Login for download.” Without an OEM relationship, you face:

• No portal credentials
• No support ticket channel
• No access to firmware upgrade packages through official channels

3.2 Obtaining Automation Studio (Development Tooling)

90-Day Evaluation License (Recommended Starting Point)

1. Go to br-automation.com > Service > Software Registration
2. Register for an evaluation license — provides unrestricted AS functionality for 90 days
3. After 90 days, you can request a new 90-day extension repeatedly
4. The evaluation license gives you full AS access including Tools > Upgrades to download AR packages
5. Limitation: Commercial use is technically not permitted under the evaluation license. For emergency maintenance on a machine with no OEM, this is your practical option.

Important: AS Version Selection

• AS 4.12 is the last version in the AS4 product line and supports all AR 4.x versions
• AS 6.x requires an AR 6.x target — incompatible with older X20 hardware running AR 4.x
• For the X20CP1584 running AR 4.x, install Automation Studio 4.12 (latest AS4)
• AS4.12 includes all hardware upgrades for X20 modules up to the AS4 end-of-life

Automation Studio 6.x Ecosystem (2024-2025)

B&R released Automation Studio 6.0 in mid-2024 as a major overhaul with a reimagined user interface and revised editing rules. Subsequent releases through AS 6.3 (June 2025) added significant new capabilities. AS 6.x does NOT replace AS 4.x — it is a parallel product line with a separate license. Projects from AS 4.x cannot be opened directly in AS 6.x; they must be ported using community migration tools.

AS Code is a VS Code-based editor fully compatible with AS 6 projects, offering modern editors for ST and C/C++, syntax error highlighting, minimap, multiline edit, dark/light themes, references/refactoring, and Git integration. It includes an AI assistant (AS Copilot) for code generation and commenting (ST only as of 6.3). AS Code requires PVI License (1TG0500.01) for smooth debug/transfer. AS 6.3 installs as an update to AS 6.1 — both versions coexist in compatibility mode.

Multicore processing (AS 6.2+): On multi-core AR 6.x controllers, cores can be assigned dynamically to AR or GPOS (Linux via exOS). Not applicable to single-core CP1584, but relevant for migration planning to newer B&R hardware.

Sources: B&R Community — AS 6.3 release, B&R Community — Multicore in AS6, B&R Community — AS 6 features

3.3 Obtaining AR Upgrades and Hardware Upgrades

Once you have AS installed with an evaluation license:

1. Open Automation Studio
2. Tools > Upgrades
3. The Upgrade Manager connects to B&R’s server and downloads available:
   • AR upgrades (runtime versions for the CPU)
   • HW upgrades (firmware for individual hardware modules — I/O modules, bus controllers, interface modules)
4. Install the upgrades you need — they are stored locally and can be used offline afterward
5. Save these upgrade packages to external media for archival. If your evaluation license lapses before you need them again, having the upgrade files stored locally means you can install them on a fresh AS instance without re-downloading.

3.4 Downloading Specific Module Firmware Files

Some firmware files are available on the B&R website without login:

• Browse to br-automation.com > Downloads and filter by hardware type
• Power Panel firmware upgrades are sometimes publicly downloadable
• Bus controller firmware (for web-update method) may be available via B&R support ticket or community

For firmware not available publicly:

• B&R Community Forum (community.br-automation.com): Search for your module and firmware version. Community members sometimes share links or guidance.
• Third-party industrial parts suppliers (EU Automation, all4sps, etc.): Sometimes provide firmware with refurbished modules
• B&R local sales office: Even without a service contract, a local B&R office may provide firmware files as a courtesy, especially for safety-related hardware

3.5 The CF Card as Firmware Carrier

When you download a project from Automation Studio to a target via Transfer, AS writes:

• The AR runtime image
• The application program
• All module firmware files

The resulting CF card contains everything the target needs. Back up every CF card you encounter — it is a complete firmware snapshot of the system.

4. Firmware Downgrade Paths

4.1 Can You Downgrade?

4.2 Downgrading the CPU Runtime

1. In Automation Studio, open the project
2. Physical View > Right-click CPU > Change Runtime
3. Select the older AR version from the installed upgrades
4. Re-transfer the project to the target — this will re-flash the CF card with the older runtime
5. The CPU will reboot with the downgraded runtime

Warning: Downgrading the runtime may clear retentive data. Back up all parameters and recipes first.

4.3 Downgrading I/O Module Firmware

When you transfer a project to the CPU, the CPU automatically pushes the correct firmware to all modules on the X2X Link. If the project specifies an older firmware version for a module, the CPU will downgrade it during the transfer.

Known issue: Some very old firmware versions of bus controllers (X20BC0083, X20BC0088) are incompatible with modern web browsers. If you need to access the web interface for diagnostics after a downgrade, use an older browser or access via Automation Studio instead.

4.4 Interface Module Upgrade Requirements for CP1584

When replacing an X20CPx48x with an X20CPx58x, certain interface modules require a minimum hardware upgrade AND hardware revision. Key modules that may need upgrades:

Modules not listed (X20IF1041-1, X20IF1043-1, X20IF1051-1, etc.) work without upgrade requirements.

5. Compatibility Matrix: AS, AR, and Module Firmware

5.1 How the Matrix Works

There is no single publicly-published table that maps every AS version to every AR version and every module firmware version. The compatibility information is distributed across:

1. AS Release Notes — lists supported AR versions
2. Hardware Upgrade Descriptions — each HW upgrade package specifies which AS version it requires and what modules it covers
3. Product Data Sheets — show first/last supported AS version for each hardware item
4. Automation Studio Upgrade Dialog — filters available upgrades by AS version

5.2 Practical Compatibility for X20CP1584

Key principle: The CP1584 is a legacy X20 CPU. Its latest supported AR versions are in the 4.x series (up to 4.93). Automation Studio 4.12 is the last AS version that can target it.

5.3.1 AS4 to AS6 Migration (When Upgrading Hardware)

B&R has released Automation Studio 6 as the successor to AS4. AS6 targets AR 6.x and introduces a new project format, updated IDE, and shared upgrades. Migration from AS4 to AS6 is a one-way process — AS6 projects cannot be opened in AS4.

Community migration tools (free, open-source):

Migration path for CP1584 users upgrading to newer X20 hardware (e.g., X20CP3484):

1. Install AS4.12 (your current version) and AS6 side by side on the same PC
2. Use as6-migration-tools on your existing AS4 project to generate a migration report
3. In AS4.12, ensure the project is at the latest AS4 version (4.12)
4. Open AS6 and use File > Convert to import the AS4.12 project
5. Address any migration issues flagged by the conversion tool
6. The converted AS6 project targets AR 6.x, which runs on newer X20 CPUs (CP3484, CP3584)
7. See remanufacturing.md for the full hardware migration workflow

Key AS4 → AS6 changes affecting migration:

• mapp Framework 6 is now available for AS6 (see community.br-automation.com/t/mapp-framework-6-released-for-automation-studio-6-voting-started/10277)
• Shared upgrades: AS6 uses a central upgrade repository instead of per-version installs
• PVI 6.x drops INA2000 protocol support — only ANSL and SNMP lines are available (see pvi-api.md)
• OPC-UA configuration model updated; check namespace migration paths
• Some C library APIs may have changed — verify with the migration report

5.3 Checking Compatibility for Your System

1. Determine the CPU’s current AR version (Section 2.1)
2. Install AS 4.12 with evaluation license
3. Install all available upgrades via Tools > Upgrades — click the “Legacy” button to show older/supported packages
4. Create a matching project: In AS, when you add the CPU to the Physical View, the available runtime versions shown in Change Runtime are those compatible with that CPU
5. For each I/O module: The HW upgrade installed on the PC determines what firmware the project will push to the module. Ensure the HW upgrade for each module is installed

5.4 Safety Module Firmware Constraints

Safety I/O modules (X20SLx, X20SLXx) have additional firmware constraints:

• Only firmware versions listed in the FS certificates (Funktionssicherheit / Functional Safety certificates) are permitted
• FS certificates are available from the B&R website
• Using uncertified firmware on safety modules violates safety compliance — do NOT update safety module firmware without the correct FS certificate documentation
• If you encounter firmware mismatch warnings on safety I/O during bootup, check B&R community — some firmware versions generate false mismatch messages during boot that can be ignored if the module runs normally afterward

6. Safely Updating Firmware on a Production Machine

6.1 Pre-Update Checklist

Before any firmware update on a running production machine:

• Back up the existing CF card — image the entire CF card to a file using a card reader. This is your recovery path. See cf-card-boot.md for the backup procedure.
• Document all current versions — CPU AR version, every I/O module firmware, bus controller firmware, drive firmware. Use SDM or AS Physical View.
• Back up all parameters — ACOPOS drive parameters, recipe data, any retentive variables. Use AS to upload from target if possible.
• Verify AS version compatibility — the AS version on your PC must support the target AR version you plan to use
• Install required upgrades — AR upgrade and all HW upgrades on the development PC
• Schedule downtime — firmware updates require a full download cycle, which stops the application
• Notify operations — the machine will be unavailable during the update
• Have a fallback plan — the CF card backup allows you to restore the previous state if the update fails

6.2 Hot Download vs. Cold Download

Hot Download (Online Transfer Without Restart)

B&R supports downloading to a running system without stopping, under these conditions:

• The download does NOT require a runtime change
• The download does NOT require hardware configuration changes
• Only application code/logic is being updated
• Automation Studio determines whether a hot download is possible

When a hot download is possible, AS performs the transfer while the system continues running. The new code is activated on the next cycle boundary.

Cold Download (Full Download With Restart)

Required when:

• Changing the AR version
• Adding/removing/changing hardware configuration
• Updating module firmware
• Initial installation

The PLC will restart and re-initialize all I/O. Expect machine downtime of 2–10 minutes depending on configuration complexity.

6.3 Step-by-Step Firmware Update Procedure

Updating the CPU Runtime and Application

1. Verify connectivity — AS Online > Settings, confirm you can reach the target
2. Stop the target — Online > Stop Target (or schedule during a maintenance window)
3. Change runtime if needed — Physical View > Right-click CPU > Change Runtime
4. Install upgrades — Tools > Upgrades, install AR and HW upgrade packages
5. Transfer — Online > Transfer > Create File and Transfer (or Transfer All)
6. Monitor — watch the CPU LEDs:
   • Green RDY/F double flash = system startup / firmware update in progress (can take several minutes)
   • Solid green RDY/F = application running
   • Red R/E = SERVICE mode (error or intentional stop)
7. Warm restart — Online > Warm Restart to start the application
8. Verify — confirm all I/O modules are online (check via SDM), check for error log entries

Updating Bus Controller Firmware (Web Method — X20BC0088)

1. Connect to bus controller’s web server at http://<BC-IP>
2. Navigate to Advanced > BC Firmware Update
3. Login (default: admin / X20BC0088)
4. Select the firmware file and click Start Download
5. Wait for Download Progress to reach 100%
6. Click Restart Bus Controller
7. Verify on the Adapter Status page

Updating I/O Module Firmware

I/O module firmware is managed by the CPU during the download process. There is no separate firmware update procedure for X20 I/O modules:

1. Ensure the correct HW upgrade is installed in AS
2. Transfer the project to the CPU
3. The CPU automatically pushes firmware to all X2X-connected modules
4. If a module shows a firmware mismatch after transfer, verify the HW upgrade matches

Updating ACOPOS Drive Firmware

1. Via Automation Studio: Connect to the CPU, open Drive Configuration, the firmware update happens as part of the download
2. Via ACOPOS Service Tool: Direct serial connection to the drive for firmware updates independent of the CPU
3. Warning: Drive firmware updates are typically one-directional (upgrade only). Confirm the new firmware is compatible with your ACP10/ACP10MC configuration before proceeding.

6.4 Recovery from a Failed Update

1. Restore the backed-up CF card — insert the original CF card and power cycle. The machine should return to its pre-update state.
2. If the CF card was corrupted during the update, use the CF card backup image to create a new card.
3. If the CPU will not boot at all, set the mode switch to BOOT position and retry the transfer from AS.

7. Version Mismatch Symptoms and Resolution

7.1 Common Version Mismatch Scenarios

7.2 The “No Certificate” Problem

After upgrading AS (especially from v4.11 to v4.12.6 or to AS6), you may see a “No Certificate” status when trying to upgrade targets. This is related to B&R’s Technology Guarding cryptographic system. Resolution:

• Ensure the AS upgrade service has internet access (known issue in AS 6.5.2, fixed in 6.5.3)
• Reinstall the Technology Guard component
• Check that the evaluation license is active and valid

7.3 License Violation on Target

If the CPU’s RDY/F LED blinks yellow and the R/E LED blinks red simultaneously, this indicates a license violation. The application will not run. This typically occurs when:

• The AR version requires a license not present on the target
• The evaluation/runtime license has expired on the target
• A runtime feature (e.g., mapp components) requires additional licensing

Resolution: Upload the existing project from the target first (if possible), resolve the license issue, then re-transfer.

7.4 Configuration Version Mismatch

When trying to go online with a project that doesn’t match the target, AS will refuse the connection. The fix:

1. Upload the configuration from the target (Online > Upload)
2. Compare with the project offline
3. Align the project to match the target, or vice versa

8. B&R Download Portal Access Issues for Non-Customers

8.1 What Requires Login

Most firmware files on br-automation.com require a B&R portal account. This includes:

• HW upgrade packages (module firmware)
• AR runtime upgrades
• Safety certificates
• Some product documentation

8.2 Workaround Strategies

8.3 Self-Registration for Portal Access

As of recent B&R policy, anyone can register on br-automation.com for a basic account. The registration provides access to:

• Software downloads (including AS evaluation)
• Some firmware upgrade packages
• Product documentation and data sheets
• Automation Help (online documentation)

Register at: br-automation.com > Service > Software Registration

8.4 Downloading Firmware Via Automation Studio Tools > Upgrades

The primary method for obtaining AR runtime and hardware firmware packages is through Automation Studio itself, not the B&R website. This is a critical workflow for engineers without OEM support contracts:

How it works:

1. Install Automation Studio (any version — evaluation license is sufficient for this purpose)
2. Launch AS and go to Tools > Upgrades
3. The upgrades dialog connects to B&R’s server and downloads a catalog of all available upgrades
4. Select the target platform (e.g., “PPC5x” for X20CP1584) and browse available AR versions
5. Click “Download Selected Upgrades” to download firmware packages to your local PC
6. The downloaded packages are installed locally and become available for use in projects and online transfers

Important details from B&R Community (community.br-automation.com):

• The upgrade service accesses https://www.br-automation.com to download files — your IT firewall must allow this
• Downloaded files are temporarily stored in C:\Temp (or extracted from https://www.br-automation.com/addons_xml.zip)
• The Windows service running the upgrade process needs rights to: access B&R homepage, download files to C:\Temp, unzip files, and install them
• If Tools > Upgrades shows outdated or missing upgrades, delete everything in C:\Temp and restart the PC — this is the standard fix per B&R support
• AS versions older than V4.6 have discontinued upgrade servers — if you need very old AR versions (3.0.x), you must use AS 3.0.90 or manually locate the upgrade files

Local upgrade installation:

If Tools > Upgrades > Online doesn’t work (no internet access, firewall issues, or discontinued service for older versions):

1. Obtain the upgrade .exe or .zip files from another source (colleague, archived backup, CF card extraction)
2. In AS, go to Tools > Upgrades > Local
3. Point to the directory containing the upgrade files
4. Install manually

With evaluation license: Per the B&R Community, with an evaluation version of AS you can still download upgrades via Tools > Upgrades. The evaluation license is sufficient for this purpose. You must manually select and download the correct upgrade files.

8.5 Long-Term Firmware Archival Strategy

8.6 Known AR Version History for CP1584

This is a partial reconstruction of the AR version history relevant to the CP1584, compiled from community discussions, release notes, and field reports:

Note: The jump from AR 4.x to AR 6.x is a generational change, not an incremental update. AR 6.x does NOT run on CP1584 hardware. The CP1584 maxes out at AR 4.93 (the latest AR 4.x release).

AR 4.93 is the recommended target for all CP1584 machines — it is the final AR 4.x release and includes all security patches. If your machine is running an older AR 4.x version, upgrading to 4.93 should be your first priority.

AR 4.93 upgrade packages for CP1584 (known filenames):

Note: Both G (standard) and E (embedded) prefix variants exist for the CP1584 AR 4.93 upgrade. The correct one depends on which AR version string your CF card currently reports. Use the boot screen or SDM to check before downloading. If unsure, the G (no prefix) variant is the standard track for X20CP1584.

Since portal access can be revoked and OEM relationships don’t exist:

1. Download and archive all upgrade packages from Tools > Upgrades while you have AS access
2. Image every CF card immediately upon receiving a machine — store as .img or .iso files
3. Document the upgrade chain — which AS version, which AR version, which HW upgrade versions for each module
4. Store offline copies of Automation Studio installers — the installer contains the base upgrade set
5. Maintain a version compatibility spreadsheet for each machine documenting the exact stack

9. Quick Reference Procedures

9.1 Complete Firmware Inventory (No Project Files)

1. Power cycle the machine, watch the boot screen — note AR version
2. Connect PC to machine network, scan for B&R devices (try 192.168.1.x)
3. Open browser to CPU IP — use SDM to catalog all I/O modules and firmware versions
4. If bus controllers are present, connect to their web interfaces for firmware info
5. For ACOPOS drives, check Service Menu for firmware version
6. Record everything in a firmware inventory log

9.2 Preparing a Development Environment From Scratch

1. Register for B&R evaluation license at br-automation.com
2. Download and install Automation Studio 4.12 (for AR 4.x targets)
3. Activate evaluation license via CodeMeter
4. Open AS, go to Tools > Upgrades
5. Click "Legacy" button to show all upgrade packages
6. Install the AR upgrade matching the target's current version
7. Install all HW upgrades — these cover module firmware
8. Create a new project matching the hardware configuration
9. Connect to the target and verify online access

9.3 Emergency Firmware Recovery

1. Power down the machine
2. Remove the CF card from the CPU
3. Insert the CF card into a PC card reader
4. Image the card (dd or Win32DiskImager) — save as backup
5. If you have a known-good CF image, restore it to the card
6. Reinsert CF card into CPU
7. Set mode switch to RUN
8. Power up — machine should return to the last known state

10. Troubleshooting Table

Key Findings

1. The 90-day evaluation license is the primary access path. B&R’s self-service evaluation registration provides unrestricted AS functionality including Tools > Upgrades for downloading AR and HW packages. The 90-day window can be renewed indefinitely. This is the most practical method for non-customers to obtain firmware.

2. Firmware lives in three layers. CPU (AR), I/O modules (HW firmware pushed by CPU via X2X), and drives (separate firmware). All three must be compatible for the system to function. Mismatches at any layer cause errors.

3. The CF card is a complete firmware snapshot. Backing up the CF card preserves the AR runtime, application, and module firmware references. This is your most important recovery asset. Archive every CF card image.

4. I/O module firmware is managed by the CPU, not individually. You cannot update a single X20 I/O module’s firmware in isolation — the CPU pushes firmware during the project transfer. The correct HW upgrade must be installed on the development PC.

5. AS 4.12 is the end of the line for X20CP1584. The CP1584 runs AR 4.x, and AS 4.12 is the last AS version in the 4.x product line. AS 6.x targets AR 6.x and is not backward compatible with AR 4.x targets. Always use AS 4.12 for these systems.

6. Version mismatches generate specific error patterns. Red blinking module LEDs, PLC logbook error 123416 for firmware mismatch, compile errors citing exact version ranges for library mismatches. Learn these patterns to diagnose quickly.

7. Downgrades are possible for CPU and I/O modules but not drives. CPU runtime can be changed via Change Runtime in AS. I/O modules are automatically downgraded by the CPU during transfer. ACOPOS drives generally do not support firmware downgrade.

8. Safety module firmware has legal constraints. Only firmware versions listed in the FS (Functional Safety) certificates are permitted. Never update safety module firmware without the correct certificate documentation. Some versions generate false mismatch warnings during boot — verify via B&R community before taking action.

9. The System Diagnostics Manager (SDM) is your best friend. Accessible via web browser at the CPU’s IP address, SDM provides complete firmware inventory, I/O topology, drive status, logbook access, and diagnostic tools without requiring Automation Studio or any B&R account. It works even when the PLC is in SERVICE mode.

10. Archive everything offline. Portal access, evaluation licenses, and community resources may not be available when you need them most. Store AS installers, upgrade packages, CF card images, and documentation on local media that is independent of any B&R infrastructure.

11. AR R4.93.5.2 is the latest available patch for CP1584. The V4.12 AR Upgrade package AS4_AR_E0493_X20CP1584.exe (version 4.93.5.2, dated 2023-04-14) is the last known AR upgrade specifically for the X20CP1584. After applying this, the system is protected against CVE-2025-11044 (ANSL DoS), CVE-2025-3450 (SDM DoS), CVE-2023-3242 (Portmapper DoS), and CVE-2022-4286 (SDM XSS). However, CVE-2024-0323 (FTP weak TLS), CVE-2021-22275 (webserver buffer overflow), and the SA25P003 CVEs (CVE-2025-3449/3448/11498 — SDM session takeover, XSS, CSV injection) remain unpatched on all AR 4.x versions.

12. B&R software lifecycle follows Active → Classic → Limited → Obsolete phases. Software/firmware maintenance starts during Active phase and continues through Classic. During Classic, B&R recommends not deploying new instances. The Limited phase ends production. See spare-parts.md for lifecycle details and remanufacturing.md for migration planning.

11. Complete CVE and Security Advisory Reference for AR 4.x

The CP1584 runs AR 4.x, which is the end-of-life firmware branch. Security patches are no longer being produced for AR 4.x. The following CVEs are known to affect AR 4.x systems. This is the definitive reference for understanding your security exposure.

11.1 CVEs Patched in AR 4.93.5.2 (Last AR 4.x Patch)

The AR upgrade package AS4_AR_E0493_X20CP1584.exe (version 4.93.5.2, dated 2023-04-14) is the last security update for AR 4.x on the CP1584. It addresses:

11.2 CVEs UNPATCHED on All AR 4.x Versions

These vulnerabilities remain unpatched on the CP1584 regardless of what AR 4.x version is installed. B&R has confirmed fixes only exist in AR 6.x+.

11.3 CVEs Patched in Earlier AR 4.x Versions

These were addressed in intermediate AR 4.x patches. If you are running an AR version earlier than 4.93.5.2, these also affect your system.

11.4 Risk Assessment for CP1584 on Production Networks

Given the unpatched vulnerabilities, the CP1584 on a production network presents the following risk profile:

11.5 Practical Security Hardening for Legacy AR 4.x CP1584

Since no more patches are coming for AR 4.x, implement these compensating controls:

Network Segmentation (Most Important)

                    ┌─────────────────────────────┐
                    │  Plant Ethernet Switch       │
                    │  (managed, VLAN-capable)      │
                    └──────────┬──────────────────┘
                               │
                    ┌──────────┴──────────────────┐
                    │  Firewall / ACL Rules:       │
                    │  - Block all inbound to PLC   │
                    │  - Allow only ANSL (30303/11169 UDP)
                    │  - Allow OPC-UA (4840) from SCADA only
                    │  - Block FTP (21) at switch    │
                    │  - Block HTTP (80/443) at switch│
                    └──────────┬──────────────────┘
                               │
                    ┌──────────┴──────────────────┐
                    │  CP1584 Control Network       │
                    │  (isolated VLAN or physical    │
                    │   network segment)           │
                    └─────────────────────────────┘

Service Disabling Checklist

Important limitation: Disabling services requires modifying the Automation Studio project and re-downloading. If you have no AS project and no credentials, the services remain active. In that case, network-level blocking is your only option.

Firewall Rules for PLC Protection

## iptables example for Linux-based firewall protecting a CP1584
## Block all inbound to PLC except required services
iptables -A INPUT -s <PLC_IP> -j DROP

## Allow ANSL from Automation Studio workstation only
iptables -A INPUT -s <AS_WORKSTATION_IP> -d <PLC_IP> -p udp --dport 30303 -j ACCEPT
iptables -A INPUT -s <AS_WORKSTATION_IP> -d <PLC_IP> -p udp --dport 11169 -j ACCEPT

## Allow OPC-UA from SCADA server only (if used)
iptables -A INPUT -s <SCADA_IP> -d <PLC_IP> -p tcp --dport 4840 -j ACCEPT

## Block FTP at the network level (CVE-2024-0323 mitigation)
iptables -A INPUT -d <PLC_IP> -p tcp --dport 21 -j DROP

## Block web server at the network level (CVE-2021-22275 mitigation)
iptables -A INPUT -d <PLC_IP> -p tcp --dport 80 -j DROP
iptables -A INPUT -d <PLC_IP> -p tcp --dport 443 -j DROP

11.6 B&R Security Advisory Reference Links

Cross-References

Sources: B&R AR Upgrade download page (br-automation.com), B&R SA25P003/ICSA-26-141-04, B&R SA25P002, B&R Lifecycle Policy, CISA ICS Advisories, NVD vulnerability database, B&R Community Forum