Control device, control system, management method and program storage medium

Abstract

A control device, a control system, a management method, and a program storage medium. The control device can modify a first user program and first setting information stored in a storage unit and executed by a control engine using a second user program and second setting information, respectively. The security engine of the control device verifies the identity of the first and second user programs and evaluates the appropriateness of the settings indicated by the second setting information, and permits or prohibits the implementation of the aforementioned modifications based on the verification results and evaluation.

Description

Technical Field

[0001] The present disclosure relates to a control device, a control system, a management method, and a program storage medium. Background Art

[0002] Control devices such as PLCs (Programmable Logic Controllers) are used in various manufacturing sites. These devices are computers that execute control programs designed for the controlled object, such as manufacturing equipment or manufacturing facilities, based on configuration information including control parameters.

[0003] In recent years, the IoT (Internet of Things) has been gaining momentum in control devices, creating environments that allow them to connect to external devices and networks, such as the internet and the cloud. In such environments, control programs in control devices can be rewritten by external devices. If such rewriting is malicious, it could potentially cause serious incidents.

[0004] Japanese Patent Application Publication No. 2008-065678 discloses a method for addressing this risk. Specifically, Japanese Patent Application Publication No. 2008-065678 discloses the following method: a PLC determines whether an encrypted control program is a program specific to a device. If so, it decrypts the control program based on the encrypted program and executes the control program to control the device.

[0005] In the method disclosed in Japanese Patent Application Laid-Open No. 2008-065678, a PLC includes a storage unit that stores pre-entered identification data and encryption rules. This identification data is used to determine whether an encrypted program is unique to the device. If the encrypted program is determined to be unique to the device, the PLC decrypts the encrypted program according to the encryption rules to obtain the control program and utilize it. Therefore, to protect the control program from malicious tampering, that is, to restrict tampering by legitimate users only, the identification data and encryption rules must be prepared, placing a burden on the user. Summary of the Invention

[0006] The present disclosure provides a structure that can ensure the security of a control device while reducing the burden on users. A control device in one example of the present disclosure includes: a storage unit that stores a first user program related to the control of an object and first setting information indicating settings related to the control; a receiving unit that receives a second user program related to the control of the object and second setting information indicating settings related to the control; a change unit that changes the first user program and the first setting information in the storage unit using the second user program and the second setting information, respectively; a control engine that executes the first user program using the first setting information; and a security engine that manages security of the first setting information and the first user program, the security engine including: a program verification unit that verifies whether the first user program and the second user program satisfy program identity; an evaluation unit that evaluates the appropriateness of the settings indicated by the second setting information; and a change control unit that permits or prohibits the change unit from implementing the change based on the verification result of the program verification unit and the evaluation of the evaluation unit.

[0007] According to the example disclosed above, when the accepted second user program and second setting information are used to change the first user program and the first setting information of the storage unit executed by the control engine, the security protection engine verifies the identity of the first user program and the second user program, and evaluates the appropriateness of the setting represented by the second setting information, and permits or prohibits the implementation of the above-mentioned changes based on the verification results and evaluation.

[0008] Therefore, without requiring special input from the user, it is possible to control whether to prohibit or permit changes to the first user program and the first setting information executed by the control engine. As a result, the burden on the user can be reduced, and accidents caused by improper tampering with the control program or setting information can be avoided, thereby ensuring the safety of the control device.

[0009] In the example disclosed above, the evaluation unit includes a check unit that checks whether the second setting information satisfies a constraint condition related to control of the object.

[0010] According to the example disclosed above, the validity evaluation of the setting indicated by the second setting information can be realized by checking whether the second setting information satisfies the constraint conditions related to the control of the object.

[0011] In one example disclosed above, the control device further permits or prohibits implementation of the above-mentioned change based on time information indicated by production plan information including a production changeover adjustment period of the target production line.

[0012] According to the example disclosed above, it is possible to prevent accidents caused by tampering of control programs or setting information completely unrelated to production plan information.

[0013] In the example disclosed above, the program verification unit generates program verification codes for verifying the identity of the first and second user programs, respectively, and verifies the identity by comparing the program verification codes.

[0014] According to the above disclosure, it is possible to verify a program using a verification code that can be generated from each program itself.

[0015] In one example disclosed above, the program verification code includes hash values ​​generated based on the first user program and the second user program, respectively.

[0016] According to the example disclosed above, a hash value can be used as a verification code.

[0017] In the example disclosed above, when the modification unit performs the modification, the hash value generated based on the second user program is stored as the hash value of the first user program after the modification.

[0018] According to the example disclosed above, when a modification is made by the modification unit, a hash value generated by the second user program for verification can be saved as the hash value of the modified first user program. This allows subsequent verification to use the saved hash value instead of generating a hash value from the first user program.

[0019] In one example disclosed above, the control device includes a safety protection unit and a control unit independent of the safety protection unit. The safety protection engine is included in the safety protection unit, and the control engine is included in the control unit.

[0020] According to one example disclosed above, the security protection engine can be provided as a unit independent of the control unit of the control engine.

[0021] In another example of the present disclosure, in a control system having the plurality of control devices connected to a network, one of the plurality of control devices has the function of the security protection engine for the other control devices.

[0022] A control system includes multiple control devices connected to a network, each of which includes: a storage unit that stores a first user program related to the control of an object and first setting information indicating settings related to the control; a reception unit that receives a second user program related to the control of the object and second setting information indicating settings related to the control; a change unit that uses the second user program and the second setting information, respectively, to change the first user program and the first setting information in the storage unit; and a control engine that uses the first setting information to execute the first user program. One of the multiple control devices further includes a security protection engine that manages security protection for the first setting information and the first user program of each control device. The security protection engine includes: a program verification unit that verifies whether the first and second user programs of each control device satisfy program identity; an evaluation unit that evaluates the appropriateness of the settings indicated by the second setting information of each control device; and a change control unit that permits or prohibits the change unit of each control device from implementing the changes based on the verification results of the program verification unit and the evaluation of the evaluation unit.

[0023] According to another example of the present disclosure, one control device among a plurality of control devices connected to a network can provide the above-described security engine function for all control devices.

[0024] In another example of the present disclosure, a management method for managing the safety protection of a control device is provided. The control device includes: a storage unit that stores a first user program related to the control of an object and a first setting information indicating settings related to the control; an acceptance unit that accepts a second user program related to the control of an object and a second setting information indicating settings related to the control; and a control engine that uses the first setting information to execute the first user program. The management method includes the following steps: verifying whether the identity of the programs is satisfied for the first user program and the second user program; evaluating the appropriateness of the settings represented by the second setting information; and determining whether to cause the control device to implement a change process of changing the first user program and the first setting information of the storage unit using the second user program and the second setting information, respectively, based on the verification result in the verification step and the evaluation in the evaluation step.

[0025] According to another example disclosed above, when the accepted second user program and second setting information are used to change the first user program and first setting information of the storage unit executed by the control engine, verification of the identity of the first user program and the second user program and evaluation of the appropriateness of the setting represented by the second setting information can be implemented, and based on the verification results and evaluation, the implementation of the above-mentioned changes can be permitted or prohibited.

[0026] Therefore, without requiring special input from the user, it is possible to control whether to prohibit or permit changes to the first user program and the first setting information executed by the control engine. As a result, the burden on the user can be reduced, and accidents caused by improper tampering with the control program or setting information can be avoided, thereby ensuring the safety of the control device.

[0027] In another example of the present disclosure, a storage medium storing a program for causing a computer to execute the above-mentioned management method is provided. The control device includes: a storage unit that stores a first user program related to the control of an object and first setting information indicating settings related to the control; an acceptance unit that accepts a second user program related to the control of an object and second setting information indicating settings related to the control; and a control engine that uses the first setting information to execute the first user program. The management method includes the following steps: verifying whether the identity of the programs is satisfied for the first user program and the second user program; evaluating the appropriateness of the settings indicated by the second setting information; and determining whether to cause the control device to implement a change process of changing the first user program and the first setting information in the storage unit using the second user program and the second setting information, respectively, based on the verification result in the verification step and the evaluation in the evaluation step.

[0028] According to another example disclosed above, when the accepted second user program and second setting information are used to change the first user program and first setting information of the storage unit executed by the control engine, verification of the identity of the first user program and the second user program and evaluation of the appropriateness of the settings represented by the second setting information can also be implemented, and based on the verification results and evaluation, the implementation of the above-mentioned changes can be permitted or prohibited.

[0029] Therefore, without requiring special input from the user, it is possible to control whether to prohibit or permit changes to the first user program executed by the control engine and the first setting information. As a result, the burden on the user can be reduced, and accidents caused by improper tampering with the control program or setting information can be avoided, thereby ensuring the safety of the control device.

[0030] The foregoing and other objects, features, aspects and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a diagram showing an example of a scenario to which the control device 1 according to the embodiment is applied.

[0032] Figure 2 1 is a schematic diagram showing the overall configuration of a control system 10 including the control device 1 according to the present embodiment.

[0033] Figure 3 is a schematic diagram showing a hardware structure example of the control unit 100 that constitutes the control device 1 of the present embodiment.

[0034] Figure 4 is a schematic diagram showing a hardware structure example of the security protection unit 200 that constitutes the control device 1 of the present embodiment.

[0035] Figure 5 is a diagram schematically showing the hardware structure of the support device 520 of the present embodiment.

[0036] Figure 6 is a diagram explaining the relationship between the production plan information and the machine constraint information of the present embodiment.

[0037] Figure 7 is a schematic flowchart of the installation process of the control program 140 and the machine constraint information 53 of the present embodiment.

[0038] Figure 8 is a diagram schematically illustrating a tampering method of the control program of the present embodiment.

[0039] <00目标]] Figure 9 is a diagram schematically illustrating a tampering method of the control program of the present embodiment.

[0040] Figure 10 is a diagram schematically illustrating a tampering method of the control program of the present embodiment.

[0041] Figure 11 is a diagram schematically illustrating a tampering method of the control program of the present embodiment.

[0042] Figure 12 is a diagram schematically illustrating a tampering method of the control program of the present embodiment.

[0043] Figure 13 is a diagram schematically illustrating a tampering method of the control program of the present embodiment. Detailed Embodiment

[0044] Hereinafter, each embodiment of the present invention will be described with reference to the drawings. In the following description, the same reference numerals are given to the same components and structural elements. Their names and functions are also the same. Therefore, detailed descriptions thereof will not be repeated.

[0045] <A. Application Example>

[0046] First, refer to Figure 1 , and an example of a scenario to which the present invention is applied will be described. Figure 1The diagram shows an example of a scenario in which the control device 1 of the embodiment is applied. The control device 1 executes a user program including a stored control program using setting information including control parameters, thereby controlling field devices 90 such as manufacturing equipment or production equipment as an example of a control target.

[0047] In this embodiment, the control device 1 can modify the stored user program and setting information using the user program and setting information received from the outside. This "modification" includes changing part or all of the user program or setting information to other content, or modifying part or all of the user program or setting information.

[0048] Maintenance personnel at the manufacturing site modify the settings based on the properties of field devices 90, the actual equipment on the production line, in accordance with specifications. They then use this modified setting information to modify the settings stored in control device 1 to align with the changes to the user program. In contrast, malicious individuals (not benevolent users like maintenance personnel) cannot know the properties or specifications of field devices 90, the actual equipment. Therefore, the settings from these malicious individuals violate these properties or specifications. Based on this context, control device 1 can evaluate the setting information received along with the user program to determine whether changes to the stored user program should be implemented through malicious or benevolent tampering.

[0049] More specifically, the control device 1 verifies the identity of the stored user program with the externally received user program, and evaluates the setting information received from the external user program. Hereinafter, the identity of the user program is simply referred to as "program identity."

[0050] Based on the program identity verification results and evaluation, the control device 1 performs a so-called permission / disapproval determination to determine whether to allow or prohibit the use of an externally received user program to modify a stored user program. This allows the control device 1 to perform this permission / disapproval determination without requesting identification data, password rules, or the like from the user.

[0051] Reference Figure 1The control device 1 includes a control engine 142 that executes the control program 140 using the mechanical constraint information 53 corresponding to each field device 90; a security engine 230 that refers to information in a storage unit 236; a receiving unit 231 having an internal buffer 235 as a temporary storage area; and a change unit 240. The storage unit 236 is configured to include a secondary storage device 208, which will be described later. The secondary storage device 208 stores various information including information 505 and hash value information 20. The information 505 includes production plan information 52, which includes a schedule consisting of the types of workpieces produced by the production line using the FA, production quantities, production times (production start and end times), and production changeover adjustment periods; and specification information 54 corresponding to each field device 90.

[0052] Mechanical constraint information 53 includes control parameters for the control program 140, an example of a user program, and is an example of setting information indicating control-related settings. Mechanical constraint information 53 indicates the mechanical conditions of the corresponding field device 90. Conditions can be expressed using thresholds (target values) related to the properties of the field device 90. For example, if the field device 90 is a servo motor, the constraint condition indicates that the motor's rotational speed (speed, angle) does not exceed the threshold based on the mechanical properties of the field device 90. Alternatively, if the field device 90 is a device (such as a heater) that performs PID (Proportional-Integral-Differential) control, the constraint condition indicates that the target value of the heater temperature does not exceed the threshold. Furthermore, conditions are not limited to mechanical properties and can also be based on physical properties such as friction coefficient and elasticity. Here, mechanical conditions are explained.

[0053] The specification information 54 indicates the mechanical constraints of the field device 90. The threshold value related to the mechanical property is set so as not to exceed the upper limit value or lower limit value indicated by the mechanical constraints specified in the specification information 54.

[0054] The hash value information 20 includes a program hash value 201 for the control program 140 to be executed by the control engine 142, and a constraint information hash value 203 for each piece of machine constraint information 53 used by the control engine 142 when executing the control program 140. The control program 140 and each piece of machine constraint information 53 are stored in the control device 1 as executable binary data. Therefore, the security engine 230 generates a hash value by calculating a hash value from this binary data using a predetermined algorithm. The hash value generation algorithm may be the same or different between the control program 140 and the machine constraint information 53.

[0055] The change unit 240 performs a change process for changing the control program 141 and the mechanical constraint information 531 of the field device 90 respectively received by the reception unit 231. This change process may include a process of rewriting the control program 140 and the mechanical constraint information 53 respectively using the control program 141 and the mechanical constraint information 531 received by the reception unit 231, or a process of replacing the control program 140 and the mechanical constraint information 53 respectively using the control program 141 and the mechanical constraint information 531 received by the reception unit 231.

[0056] The control engine 142 uses the mechanical constraint information 53 as, for example, a control parameter to execute the control program 140. Thus, the control engine 142 executes the control program 140 before or after the change using the mechanical constraint information 53 corresponding to each field device 90, and controls the field device 90 according to the execution result.

[0057] In this embodiment, the safety engine 230 manages the safety of the control program 140 executed by the control engine 142 and one or more pieces of machine constraint information 53 used in the control, thereby preventing accidents related to the control from occurring.

[0058] More specifically, the security protection engine 230 has: a verification unit 232, which verifies the program identity between the control program 140 and the accepted control program 141; an evaluation unit 238, which evaluates the appropriateness of whether the setting of the mechanical constraint information 531 accepted together with the control program 141 is appropriate for control; and a change control unit 234, which permits or prohibits the change unit 240 from implementing the above-mentioned change processing based on the verification result of the program identity and the evaluation result of the appropriateness.

[0059] The verification unit 232 compares the program hash value 201 of the control program 140 with a hash value generated based on the control program 141 received from the outside, and verifies the program identity based on the comparison result.

[0060] Evaluation unit 238 includes a constraint information verification unit 239 and a constraint information check unit 242. Constraint information verification unit 239 compares the stored constraint information hash value 203 with the hash value generated based on the externally received mechanical constraint information 531, and based on the comparison result, verifies the identity of the two. Constraint information check unit 242 checks whether the received mechanical constraint information 531 satisfies the constraint conditions related to the control of the object. More specifically, constraint information check unit 242 compares the threshold value associated with the condition indicated by mechanical constraint information 531 with the limit value of the constraint condition indicated by specification information 54. If the comparison result indicates that the threshold value does not exceed the limit value of the constraint condition, the threshold condition set in mechanical constraint information 531 satisfies the constraint condition of specification information 54, and the control setting is determined to be appropriate. Otherwise, the setting is determined to be inappropriate. When the constraint information verification unit 239 verifies that the hash values ​​of the two match and thus verifies the identity of the mechanical constraint information, or when the constraint information check unit 242 detects that the mechanical constraint information 531 is appropriate, the evaluation unit 238 outputs that the mechanical constraint information 531 is appropriate.

[0061] The change control unit 234 determines whether or not to permit the change process based on the program identity verification result of the verification unit 232 and the evaluation result of the evaluation unit 238 .

[0062] More specifically, (i) when there is program identity and the constraint information verification unit 239 detects the identity of the mechanical constraint information, the change control unit 234 outputs a permission instruction for the change process to the change unit 240, (ii) when there is no program identity but the constraint information check unit 242 detects that the mechanical constraint information 531 is appropriate, the change control unit 234 outputs a permission instruction for the change process to the change unit 240, and (iii) when there is no program identity and the constraint information check unit 242 does not detect that the mechanical constraint information 531 is appropriate, the change control unit 234 outputs a prohibition instruction for the change process to the change unit 240.

[0063] In addition, in the present embodiment, "tampering" may include善意 tampering and malicious tampering. To determine malicious tampering, the control device 1 uses the production plan information 52. Usually, in the production line on-site, the type or production volume of the workpiece is changed according to the period indicated by the time information of the schedule represented by the production plan information 52, and the production line changeover adjustment, etc. is carried out. As a result, the model type of the on-site equipment 90 possessed by the production line is changed. If the model type of the on-site equipment 90 is changed, then along with this change, it is necessary to change the control program 140 or the mechanical constraint information 53 of the on-site equipment 90. A malicious person does not know this schedule. Therefore, when the control device 1 receives the control program 141 or the mechanical constraint information 531 from the reception unit 231, it compares the received period with the schedule shown in the production plan information 52. In the case where the result of the comparison indicates that the received period violates the schedule, it can be determined that there is a possibility of malicious tampering.

[0064] In the present embodiment, "violating the schedule" means, for example, a situation where the period of receiving the control program 141 or the mechanical constraint information 531 is inconsistent with the schedule shown in the production plan information 52. In addition, the situation where the period is consistent with the schedule shown in the production plan information 52 is called "matched with the schedule".

[0065] In addition, in the present embodiment, as the verification code for the identity of the control program 141 or the mechanical constraint information 53, a hash value generated according to a predetermined algorithm is used, but it is not limited thereto. As such a verification code, for example, a checksum value may also be used.

[0066] <B. Control System>

[0067] Figure 2 is a schematic diagram showing the overall structure of the control system 10 including the control device 1 in the present embodiment. Refer to Figure 2 The control system 10 has one or more control devices 1 connected to the network 2. The control system 10 is applied to a production line having multiple processes, and the multiple processes include, for example, a workpiece conveying process, an assembly process of the conveyed workpiece, a painting process of the assembled workpiece, a workpiece inspection process, etc. The control system 10 constitutes a distributed control system having a control device 1 for each process. The control devices 1 for each process are connected to the network 2 and exchange data with each other. The network 2 is, for example, a network that follows EtherNET / IP (registered trademark) or OPC UA (Object Linking and Embedding for Process Control Unified Architecture: object linking and embedding for process control unified architecture) that can achieve data exchange regardless of the type of the vendor or the OS (Operating System).

[0068] Control device 1 controls a controlled object. The controlled object includes various industrial devices used to automate production processes, including devices that provide some physical effect on manufacturing equipment, production lines, etc. (hereinafter collectively referred to as "sites"), and input / output devices that exchange information with the sites.

[0069] The control device 1 communicates with other information processing devices via a relay device 3 connected to the network 2. Other information processing devices include, for example, a manufacturing execution system MES (Manufacturing Execution System) 500, a cloud-based web server 510, a support device 520, and an HMI device 530. The MES 500 centrally monitors and manages the production line. The MES 500 manages the schedule for production changes and adjustments of the production line, the schedule for changes in the types and quantities of workpieces to be produced, etc. The MES 500 stores production plan information 52 and specification information 54 linked to these schedules in the storage 501. The HMI (Human Machine Interface) 530 may include the following HMI (Human Machine Interface): it prompts the operator with various information obtained through the control operation based on the control program 140 in the control device 1, and generates internal commands to the control device 1 according to the operation from the operator. The support device 520 provides a UI (User Interface) tool for interactive communication with each control device 1 of the production line, a UI tool for developing user programs such as the control program 140, and a UI tool for creating production plan information 52 or mechanical constraint information 53 of the field device 90. The support device 520 can also communicate directly with the relay device 3 or communicate with the relay device 3 via a cloud environment. Furthermore, the support device 520 and the HMI device 530 can also be connected to the network 2. The web server 510 stores and manages data collected and transmitted by the control system 10 in a DB (Data Base) 511. The storage unit 236 of each control device 1 stores the production plan information 52 transmitted from the MES 500, as well as the control program 141 and mechanical constraint information 531 of the field device 90 transmitted from the MES 500, the support device 520, or the HMI device 530.

[0070] The control device 1 includes one or more devices. Figure 2 In the example shown, the control device 1 is composed of a control unit 100, a safety protection unit 200, an I / O (Input / Output) unit 300, etc. The control device 1 may also include a power supply unit.

[0071] The control unit 100 is an example of a control device constituting the control apparatus 1, and executes a user program such as a control program 140 for controlling a control object, and performs central processing in the control apparatus 1. The control unit 100 is composed of Figure 1 Control engine 142 is shown.

[0072] The safety guard unit 200 is an example of a safety guard device constituting the control device 1. Figure 1 The security engine 230 is shown. A portable support device 520 is detachably connected to the security unit 200.

[0073] The control unit 100 is connected to the security unit 200 via, for example, an arbitrary data transmission path (for example, PCI Express or Ethernet / IP (registered trademark)).

[0074] The I / O unit 300 is an example of a device constituting the control apparatus 1 and is a unit related to normal input / output processing. The I / O unit 300 collects detection values ​​from IO devices including various sensors, various switches, encoders, and the like.

[0075] The control unit 100 is communicably connected to the I / O unit 300 via an internal bus. The control unit 100 executes operations of a control program using detection values ​​collected by the I / O unit 300 and outputs the values ​​of the operation results to the I / O unit 300.

[0076] The control unit 100 communicates with multiple field devices 90 via the field network 11. The control unit 100 collects status values ​​from the field devices 90 via the field network 11, executes the control program 140 based on the collected status values, and outputs control commands as the execution results to the field devices 90 via the field network 11. The field devices 90 change their own status values ​​according to the control commands.

[0077] Typically, various industrial Ethernet (registered trademark) can be used as the field network 11. For example, EtherCAT (registered trademark) can be used as the industrial Ethernet (registered trademark). In addition, field networks other than industrial Ethernet (registered trademark) can also be used.

[0078] In addition, the devices constituting the control device 1 are not limited to Figure 2 The devices constituting the control device 1 may include, for example, a special unit having functions not supported by the I / O unit 300 and a safety unit providing a safety function for preventing human safety from being threatened by equipment or machinery.

[0079] The control device 1 can also be configured as a PLC or an industrial computer (so-called IPC: Industrial Personal Computer).

[0080] <C. Structure of the control device 1>

[0081] A hardware structure example of the main devices constituting the control device 1 of this embodiment will be described.

[0082] (c1. Control unit)

[0083] Figure 3 It is a schematic diagram showing a hardware structure example of the control unit 100 of the control device 1 of this embodiment. Refer to Figure 3 , as the main components, the control unit 100 includes a processor 102 such as a CPU (Central Processing Unit) or a GPU (Graphical Processing Unit), a chipset 104, a main storage device 106, a secondary storage device 108, a communication controller 110, a USB (Universal Serial Bus) controller 112, a memory card interface 114, a field network controller 116, an internal bus controller 118, and a network controller 120.

[0084] The processor 102 reads out the user program including the control program 140 stored in the secondary storage device 108 or the memory card 115 and expands and executes it in the main storage device 106, thereby realizing the control operation for controlling the control object.

[0085] The main storage device 106 is composed of a volatile storage device such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory). The secondary storage device 108 is composed of a non-volatile storage device such as an HDD (Hard Disc Drive) or an SSD (Solid State Drive), for example.

[0086] The chipset 104 realizes the processing of the control unit 100 as a whole by mediating the data exchange between the processor 102 and each component.

[0087] In addition to a system program 1082 including a real-time operating system (OS) 130 and an installer 135 for implementing the basic functions of the control unit 100, the secondary storage device 108 also stores a control program 140 created based on a control target, such as a device or machine; a refresh program 40 for exchanging control commands and status values ​​with each field device 90; and machine constraint information 53 corresponding to each field device 90 being controlled. The control unit 100 periodically controls the field devices 90 by repeatedly executing the control program 140 and the refresh program 40 at a predetermined cycle (e.g., a control cycle). The control program 140 can be composed of any control program executed by the real-time OS 130. If the real-time OS 130 provides an interpreter function, the control program 140 can be stored in source code or intermediate code format, or in an executable form, such as an object format. The refresh program 40 can constitute a user program together with the control program 140. However, in this embodiment, for simplicity of description, the refresh program 40 is not included in the tampering check targets of the security guard unit 200. The system program 1082 provides the function of the control engine 142 that executes the control program 140 based on the real-time OS 130.

[0088] The communication controller 110 is responsible for exchanging data with other units. For example, a communication chip compatible with PCI Express or Ethernet (registered trademark) can be used as the communication controller 110. If the security protection unit 200 implementing the security protection engine 230 is external to the control device 1, the aforementioned other units include the external security protection unit 200.

[0089] The USB controller 112 is responsible for exchanging data with any information processing device via a USB connection. The arbitrary information processing device includes, for example, a support device 520 or an HMI device 530 that provides users with functions such as creating or editing the control program 140, debugging, and setting various parameters.

[0090] The memory card interface 114 is configured to be removable with a memory card 115 as an example of a storage medium. The memory card interface 114 can write the control program 140 and various setting data to and read the control program 140 and various setting data from the memory card 115 .

[0091] The field network controller 116 controls data exchange with other devices including the field device 90 via the field network 11 .

[0092] The internal bus controller 118 controls data exchange with other devices (such as the I / O unit 300) via the internal bus. The internal bus may use a manufacturer-specific communication protocol or a communication protocol that is the same as or complies with any industrial network protocol.

[0093] The network controller 120 controls data exchange with other control devices 1 or relay devices 3 via the network 2 .

[0094] exist Figure 3 , an example of a structure in which the required functions are provided by executing a program by the processor 102 is shown, but a dedicated hardware circuit (for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array)) may be used to install part or all of these provided functions. Alternatively, the main part of the control unit 100 may be implemented using hardware that follows a general-purpose architecture (for example, an industrial personal computer based on a general-purpose personal computer). In this case, processing can be performed in parallel by applying multi-core technology. Alternatively, virtualization technology may be used to execute multiple OSs with different purposes in parallel, and the required applications may be executed on each OS.

[0095] (c2. Safety protection unit)

[0096] Figure 4 1 is a schematic diagram showing an example of the hardware configuration of the safety unit 200 constituting the control device 1 of this embodiment. Figure 4 As main components, the security protection unit 200 includes a processor 202 such as a CPU or GPU, a chipset 204, a primary storage device 206, a secondary storage device 208, a communication controller 210, a USB controller 212, a memory card interface 214 and a network controller 220.

[0097] Processor 202 reads various programs stored in secondary storage device 208 or memory card 215, expands and executes them in main storage device 206, thereby implementing security functions related to control device 1. Main storage device 206 is composed of volatile storage devices such as DRAM and SRAM. Secondary storage device 208 is composed of non-volatile storage devices such as HDD and SSD.

[0098] The chipset 204 implements the overall processing of the security protection unit 200 by mediating the data exchange between the processor 202 and various components.

[0099] The secondary storage device 208 stores hash value information and management information 30 in addition to a system program 2082 such as an OS for realizing the basic functions of the security unit 200 .

[0100] A security program 243 including a hash value generation program 250 is incorporated into the system program 2082. The security program 243 manages security related to the control device 1 and is executed by the security engine 230. The hash value generation program 250 generates a program hash value 201 for the control program 140 and a constraint information hash value 203 corresponding to each piece of machine constraint information 53 according to a predetermined algorithm. The security unit 200 provides the function of the security engine 230 for executing the security program 243 on the OS.

[0101] The management information 30 includes production plan information 52 transmitted from the MES 500 and specification information 54 on each field device 90 .

[0102] The communication controller 210 is responsible for data exchange between the security unit 200 and the control unit 100. As the communication controller 210, similar to the communication controller 110 of the control unit 100, a communication chip compatible with PCI Express or Ethernet (registered trademark) can be used.

[0103] The USB controller 212 is responsible for exchanging data with any information processing device via a USB connection. The arbitrary information processing device includes, for example, a support device 520 or an HMI device 530. The support device 520 or the HMI device 530 provides the user with functions such as setting the security program 243.

[0104] The memory card interface 214 is configured to be removable from a memory card 215 as an example of a storage medium. The memory card interface 214 can write programs, various settings, and other data to the memory card 215 , and read programs, various settings, and other data from the memory card 215 .

[0105] The network controller 220 controls data exchange with various devices including other control devices 1 via the network 2. The network controller 220 may use a general-purpose network protocol such as Ethernet (registered trademark).

[0106] exist Figure 4In [the figure], a structural example of providing required functions by executing a program by processor 202 is shown. However, dedicated hardware circuits (such as ASIC or FPGA, etc.) can also be used to install a part or all of these provided functions. Alternatively, hardware following a general architecture (such as an industrial personal computer based on a general personal computer) can also be used to implement the main part of the security protection unit 200. In this case, processor 202 can also be composed of multiple cores to execute applications in parallel. Or, the security protection unit 200 can also use virtualization technology to execute multiple OSs with different purposes in parallel, and execute required applications on each OS.

[0107] In addition, in Figure 3 and Figure 4 the control device 1 can be connected to the network 2 via the network controller 120 of the control unit 100, and can also be connected to the network 2 via the network controller 220 of the security protection unit 200. In the present embodiment, the case where the control device 1 is connected via the network controller 220 of the security protection unit 200 will be described.

[0108] <Structure of Support Device 五十

[0109] Figure 5 is a diagram schematically showing the hardware structure of the support device 520 of the present embodiment. Referring to Figure 5 , the support device 520 has a CPU 521, a ROM (Read Only Memory) 522, a RAM (Random Access Memory) 523, a flash ROM 524 for non-volatilely storing various programs and data, a clock 525, an operation key 526 for accepting user operations, a data reader / writer 527, a touch screen 528, and a communication interface 529. In addition, these respective parts are interconnected via an internal bus.

[0110] The touch screen 528 includes a display 5281 and a touch panel 5282 for accepting the input of an operator. The communication interface 529 controls the communication between the support device 520 and the relay device 3 or the USB controller 112. The data reader / writer 527 mediates the data transmission between the CPU 521 and the memory card 5271 as an external storage medium. The HMI device 530 also has the same structure as the support device 520.

[0111] <Transmission of Setting Information

[0112] Figure 6This is a diagram showing the relationship between the production plan information and the mechanical constraint information of this embodiment. In this embodiment, the MES 500 stores the production plan information 52 and the specification information 54 of each field device 90 in the storage 501. The MES 500 transmits the production plan information 52 and the specification information 54 to the safety protection unit 200 of the control device 1. The control device 1 uses the mechanical constraint information 53 of each field device 90 to execute the control program 140, thereby controlling these field devices 90. In Figure 6 for each field device 90, mechanical constraint information (1), mechanical constraint information (2), and mechanical constraint information (3) are shown.

[0113] These mechanical constraint information 53 and the control program 140 are generated, for example, by user operations in the HMI device 530 or the support device 520, and are transmitted to the control device 1 via the network 2. The reception unit 231 receives the transmitted mechanical constraint information 53 and the control program 140. In addition, the path for transmitting the mechanical constraint information 53 and the control program 140 from an external device to the control device 1 is not limited to the path via the network 2. For example, it may also be a path via the USB controller 112, or a path from the memory cards 115, 215 via the memory card interfaces 114, 214.

[0114] <F. Outline of the process>

[0115] The process of installing the control program 140 and the mechanical constraint information 53 in the control device 1 will be described. Figure 7 This is a schematic flowchart of the installation process of the control program 140 and the mechanical constraint information 53 of this embodiment. In Figure 7 an example is shown of the scenario where the control program 141 and the mechanical constraint information 531 corresponding to each field device 90 are transmitted from the HMI device 530 to the control device 1, the installation program 135 is executed, and the transmitted control program 141 and mechanical constraint information 531 are installed in the control device 1. In addition, in the installation of this embodiment, the reception unit 231 receives the control program 141 and the mechanical constraint information 531 of each field device 90 transmitted from an external device, and the storage unit 236 converts the received control program 141 and mechanical constraint information 531 into an executable form and stores them in a predetermined area of the secondary storage device 108. By executing the installation program 135, the storage unit 236 and the change unit 240 are realized. [[ID=I6]]

[0116] Refer to [[ID=1I9]] Figure 7 and the processor 202 of the safety protection unit 200, as the reception unit 231, receives the control program 141 and the mechanical constraint information 531 of each field device 90 transmitted from the HMI device 530 and temporarily stores them in the internal buffer 235 (step S3).

[0117] Based on the set parameters, the processor 202 determines whether the security engine 230 is enabled for the control device 1 (step S5). If it is determined that it is not enabled ("No" in step S5), the storage unit 236 reads the control program 141 and the mechanical constraint information 531 for each field device 90 stored in the internal buffer 235 and stores them in the secondary storage device 108 (step S17). As a result, the control program 141 and the mechanical constraint information 531 for each field device 90 are stored in executable form in the secondary storage device 108 as the control program 140 and the mechanical constraint information 53 for each field device 90, respectively. Furthermore, the processor 202 generates a program hash value 201 for the stored control program 140 and a constraint information hash value 203 for each mechanical constraint information 53, and stores them in the secondary storage device 208.

[0118] When the processor 202 determines that the use of the security engine 230 is set in the control device 1 (YES in step S5 ), the processor 202 activates the security engine 230 .

[0119] When the security engine 230 is activated, the processor 202, acting as the verification unit 232, converts the control program 141 and each piece of mechanical constraint information 531 stored in the internal buffer 235 into an executable format. The processor 202 generates a program hash value and a constraint information hash value for the converted control program 141 and each piece of mechanical constraint information 531, respectively (step S7). The processor 202 compares the generated hash value with the hash value stored in the secondary storage device 208 (step S9).

[0120] More specifically, the processor 202, acting as the verification unit 232, compares the generated program hash value with the stored program hash value 201 and, based on the comparison result, determines whether the two match (step S11). If the two match ("YES" in step S11), the processor 202, acting as the constraint information verification unit 239, compares the constraint information hash value generated based on the mechanical constraint information 531 corresponding to each field device 90 with the stored constraint information hash value 203 of the mechanical constraint information 53 of the field device 90 and, based on the comparison result, determines whether the two match (step S13). If the two match ("YES" in step S13), the processor 202 outputs a notification to the user indicating that the control program 140 and the mechanical constraint information 53 have not been changed (step S15). Furthermore, at this time, the processor 202, acting as the change control unit 234, may output a permission instruction permitting execution of the change process based on the output of the verification unit 232 and the output of the constraint information verification unit 239, thereby causing the change unit 240 to execute the change process.

[0121] On the other hand, if the generated program hash value is determined to be inconsistent with the program hash value 201 ("No" in step S11), the processor 202 outputs a notification to the user indicating that the control program 140 has been changed (step S20), and the process proceeds to step S21. Furthermore, if the generated constraint information hash value is determined to be inconsistent with the stored constraint information hash value 203 for any field device 90's mechanical constraint information 531 ("No" in step S13), the processor 202 outputs a notification to the user indicating that the mechanical constraint information 53 has been changed (step S19), and the process proceeds to step S21. These notifications are output to a display, for example, via the HMI device 530 or the support device 520. When the user operates the HMI device 530 or the support device 520 to input an instruction regarding whether to change the control program 140 or the mechanical constraint information 53, the HMI device 530 or the support device 520 transmits the instruction based on the user's operation to the control device 1.

[0122] The processor 202 determines whether to permit (OK) or disallow (NG) the implementation of the change to the control program 140 or the machine constraint information 53 based on a user instruction from the HMI device 530 or the support device 520 (step S21). If the input indicates that the change is NG ("NG" in step S21), the process ends. If the input indicates that the change is OK ("OK" in step S21), the process proceeds to step S23.

[0123] The processor 202 determines whether the production plan information 52 and the mechanical constraint information 53 of each field device 90 are stored in the secondary storage device 208 (step S23). If it is determined that such information is not stored ("No" in step S23), the process proceeds to step S29. On the other hand, if it is determined that such information is stored ("Yes" in step S23), the processor 202 determines whether the installation time does not violate the schedule of the production plan information 52 or whether the information to be installed satisfies the constraints of the specification information 54 (step S25).

[0124] More specifically, the processor 202 compares the current installation time with the schedule in the production plan information 52 and, based on the comparison result, determines whether the installation time matches the schedule (step S25). If the installation time is determined to be inconsistent with the schedule ("No" in step S25), the processor 202 transmits a violation message to the HMI device 530 and the support device 520 indicating that the change to the control program 140 will be implemented inconsistent with the schedule, and displays (outputs) the message to the user via the HMI device 530 and the support device 520 (step S27). Alternatively, the processor 202, acting as the constraint information checker 242, compares the thresholds and other conditions of each machine constraint information 531 with the constraints of the specification information 54 and, based on the comparison result, determines whether the thresholds and other conditions violate the specification constraints (step S25). For example, the processor 202 determines whether the thresholds of the machine constraint information 531 exceed the limit values ​​of the constraints of the specification information 54.

[0125] When it is determined that the mechanical constraint information 531 violates the constraint condition of the specification information 54 because the threshold of the condition exceeds the limit value ("No" in step S25), the processor 202 transmits violation information indicating that the change of the control program 140 is to be implemented in violation of the specification to the HMI device 530 and the support device 520, and prompts (outputs) it to the user via the HMI device 530 and the support device 520 (step S27).

[0126] On the other hand, when it is determined that the installation period matches the schedule of the production plan information 52, and the constraints of the mechanical constraint information 531 match the specification information 54 ("Yes" in step S25), the processor 202 acts as the change control unit 234 and outputs the change permission instruction to the change unit 240.

[0127] In accordance with the change permission instruction, the processor 202 uses the hash value of the control program 141 and the hash value of each machine constraint information 531 calculated in step S7 to change (overwrite) the program hash value 201 and the hash value of each constraint information 203 in the secondary storage device 208. As a result, the hash value of the control program 141 and the hash value of each machine constraint information 531 are stored in the secondary storage device 208 as hash value information 20 (step S29).

[0128] Furthermore, the processor 102 , as the change unit 240 , changes the control program 141 and the machine constraint information 531 of each field device 90 in accordance with the change permission command to the control program 141 and the machine constraint information 531 of each field device 90 (step S31 ).

[0129] Thus, when the control device 1 receives a tampered control program 141 (a control program 141 with inconsistent program hash values) from the outside during installation, the security protection unit 200 checks the mechanical restriction information 531 received together with the control program 141 according to the specification information 54, and based on the result of this check, evaluates whether the setting of the threshold value and other conditions indicated by the mechanical restriction information 531 of the field device 90 is appropriate for the control of this field device 90. When it is evaluated as appropriate, the security protection unit 200 permits the control device 1 to install the control program 141 and the mechanical restriction information 531 as the control program 140 and the mechanical restriction information 53.

[0130] <G. Modes of Tampering>

[0131] Figures 8 to 13 FIG. is a diagram schematically illustrating modes of tampering with the control program of the present embodiment. Tampering means performing the above-described change process, for example, including installation. In addition, tampering includes tampering by a well-intentioned person and tampering by a malicious person.

[0132] Figure 8 It shows a situation where a maintenance person operates the UI tool of the operation support device 520 at the company or home, and thus tampers with the control program 140 of the control device 1 from the support device 520 via the cloud, the relay device 3, and the network 2. In contrast, <( Figure 9 and Figure 10 show a situation where a maintenance person in the factory tampers with the control program 140 of the control device 1, showing the operation of the support device 520 (refer to Figure 9 ) with a USB connected to the control device 1, or the case of installing the memory card 215 storing the control program in the control device 1 (refer to Figure 10 ) to tamper with the control program 140 of the control device 1.

[0133] Figure 11 and Figure 12 show a situation where, along with the replacement of the field device 90 accompanying the production change adjustment, a change process of the mechanical restriction information 53 is implemented. When a maintenance person operates the support device 520 to create and install the mechanical restriction information 531 for the replaced field device 90, Figure 11 shows a situation where the security protection engine 230 determines that the mechanical restriction information 531 satisfies the restriction conditions (conditions such as limit values) of the specification information 54. In contrast, Figure 12 shows a situation where, due to a setting error by the maintenance person, the security protection engine 230 determines that the mechanical restriction information 531 does not satisfy the restriction conditions of the specification information 54. [[ID=X]]

[0134] Figure 13This represents a situation where a malicious person intends to install mechanical constraint information 531 together with the control program 140 onto the production line for a malicious purpose. In this situation, the malicious person sets an abnormal value for the threshold represented by the conditions of the mechanical constraint information 531, that is, a value exceeding the limit value represented by the constraint conditions of the specification information 54. The security protection engine 230 determines that this mechanical constraint information 531 does not meet the constraint conditions of the specification information 54, and outputs a prohibition instruction for prohibiting the execution of the change process to the change unit 240.

[0135] In addition, in Figure 11 's situation, after the change process is executed, the control device 1 starts in a manner that executes the control program 140 using the installed mechanical constraint information 531, while in Figure 12 and Figure 13 's situations, an abnormal value is detected in the condition threshold of the mechanical constraint information 53, and thus the execution of the change process is prohibited, and the control device 1 does not start.

[0136] <H. Variation Example>

[0137] In the above-described embodiment, the following variation examples can be applied.

[0138] (h1. Variation Example 1)

[0139] In Figure 2In a control system 10, one of the multiple control devices 1 can also assume the functions of the security engine 230 of the control device 1 itself and the functions of the security engine 230 for other control devices 1. In this case, the control device 1 verifies the control program 140 and mechanical constraint information 53 received from the other control devices 1 using hash value information and checks the mechanical constraint information 53, respectively. Based on the results of the verification and check, the control device 1 transmits a command to the other control device 1 to permit or prohibit the implementation of the change process. Specifically, the control device 1 receives the first user program (control program 140), the second user program (control program 141), the second setting information (mechanical constraint information 531), and the constraint conditions (specification information 54) from the other control device 1. The control device 1 includes a security engine that manages the security of the first setting information (mechanical constraint information 53) and the first user program (control program 140) for each of the multiple control devices 1, including the control device 1 itself. The security protection engine has: a program verification unit, which verifies whether the first user program (control program 140) and the second user program (control program 141) of each control device 1 satisfy the program identity; an evaluation unit, which evaluates the appropriateness of the settings represented by the second setting information (mechanical constraint information 531) of each control device 1; and a change control unit, which transmits an instruction to permit or prohibit the implementation of the above-mentioned changes to the change unit of each control device 1 including this control device 1 based on the verification results of the program verification unit and the evaluation of the evaluation unit.

[0140] In the first modification, the evaluation unit checks whether the second setting information (mechanical constraint information 531 ) of each control device 1 satisfies the constraint condition (specification information 54 ) related to the target control corresponding to the control device 1 .

[0141] (h2. Modification 2)

[0142] In the above embodiment, the security engine 230 is configured as being provided within the security unit 200, which is a unit independent of the control unit 100. However, this is not limiting. For example, the security engine 230 may be built into the control unit 100. In this case, the control unit 100 supports both the security engine 230 and the control engine 142.

[0143] (h3. Modification 3)

[0144] In the above embodiment, the security engine 230 is started when the control program 141 is installed, but the security engine 230 may be started when the control program 141 is downloaded. Alternatively, the security engine 230 may be started when the control device 1 is started.

[0145] I. Procedure

[0146] The processor 202 of the security unit 200 executes the program in the secondary storage device 208 to realize the security function of detecting and notifying the control program 140 and the mechanical restriction information 53 described above of improper tampering.

[0147] The security protection function is primarily implemented by executing the security protection program 243, but such programs and data can also be downloaded from an external device to the secondary storage device 208. More specifically, they can be downloaded from the memory card 215 via the memory card interface 214, from an external device connected to the network 2 via the network controller 220, or from the support device 520 or HMI device 530 via the USB controller 212. The memory card 215 is a medium that stores information such as programs, etc., through electrical, magnetic, optical, mechanical, or chemical processes, in a manner that enables computers, other devices, or machines to read the stored information.

[0148] The program can be executed by one or more processor circuits such as a CPU, or by a combination of a processor circuit and a circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array).

[0149] Furthermore, at least a portion of the program may be implemented by a circuit such as an ASIC or an FPGA.

[0150] While the embodiments of the present invention have been described, the embodiments disclosed herein are to be construed in all respects as illustrative and non-restrictive. The scope of the present invention is indicated by the claims, and is intended to encompass all modifications within the meaning and scope of the claims and equivalents thereof.

Claims

1. A control device, wherein: The control device has: a storage unit that stores a first user program related to control of an object and first setting information indicating settings related to the control; a receiving unit that receives a second user program related to control of the object and second setting information indicating settings related to the control; a changing unit that changes the first user program and the first setting information in the storage unit using the second user program and the second setting information, respectively; a control engine that executes the first user program using the first setting information; as well as A security protection engine that manages the security protection of the first setting information and the first user program, The security protection engine has: a program verification unit configured to verify whether the first user program and the second user program satisfy program identity; an evaluation unit that evaluates the validity of the setting indicated by the second setting information; as well as A change control unit, which permits or prohibits the change unit from implementing the change based on the verification result of the program verification unit and the evaluation of the evaluation unit, wherein: The evaluation unit includes a check unit configured to check whether the second setting information satisfies a constraint condition related to control of the object. The second setting information includes a threshold value related to the control of the object, The inspection by the inspection unit includes comparing the threshold value of the second setting information with a predetermined value indicated by the constraint condition.

2. The control device according to claim 1, wherein: The control device further permits or prohibits implementation of the change based on time information indicated by production plan information including a production changeover adjustment period of the target production line.

3. The control device according to claim 1 or 2, wherein: The program verification unit generates program verification codes for verifying the identity of the first user program and the second user program, respectively, and verifies the identity by comparing the program verification codes with each other.

4. The control device according to claim 3, wherein: The program verification code includes hash values ​​generated based on the first user program and the second user program, respectively.

5. The control device according to claim 4, wherein: When the change is performed by the change unit, the hash value generated based on the second user program is stored as the hash value of the first user program after the change.

6. The control device according to claim 1 or 2, wherein: The control device further comprises a safety protection unit and a control unit independent of the safety protection unit. The security protection engine is included in the security protection unit, The control engine is included in the control unit.

7. A control system, wherein: The control system has a plurality of control devices connected to a network, Each of the plurality of control devices comprises: a storage unit that stores a first user program related to control of an object and first setting information indicating settings related to the control; a receiving unit that receives a second user program related to control of the object and second setting information indicating settings related to the control; a changing unit that changes the first user program and the first setting information in the storage unit using the second user program and the second setting information, respectively; as well as a control engine that executes the first user program using the first setting information, One of the plurality of control devices further includes a security engine for managing security of the first setting information and the first user program of each control device. The security protection engine has: a program verification unit for verifying whether the first user program and the second user program of each of the control devices satisfy program identity; an evaluation unit that evaluates the validity of the setting indicated by the second setting information of each of the control devices; as well as a change control unit that permits or prohibits the change unit of each control device from implementing the change based on the verification result of the program verification unit and the evaluation of the evaluation unit, wherein: The evaluation unit includes a check unit configured to check whether the second setting information satisfies a constraint condition related to control of the object. The second setting information includes a threshold value related to the control of the object, The inspection by the inspection unit includes comparing the threshold value of the second setting information with a predetermined value indicated by the constraint condition.

8. A management method for managing the safety protection of a control device, wherein: The control device has: a storage unit that stores a first user program related to control of an object and first setting information indicating settings related to the control; a receiving unit that receives a second user program related to control of the object and second setting information indicating settings related to the control; as well as a control engine that executes the first user program using the first setting information, The management method comprises the following steps: Verifying, for the first user program and the second user program, whether program identity is satisfied; evaluating the validity of the setting indicated by the second setting information; as well as Based on the verification result in the step of verifying and the evaluation in the step of evaluating, it is determined whether to cause the control device to perform a change process of changing the first user program and the first setting information in the storage unit using the second user program and the second setting information, respectively, wherein The evaluation includes checking whether the second setting information satisfies the constraints related to the control of the object, The second setting information includes a threshold value related to the control of the object, The checking includes comparing the threshold value of the second setting information with a predetermined value indicated by the constraint condition.

9. A storage medium storing a program for causing a computer to execute a management method for managing safety protection of a control device, wherein: The control device has: a storage unit that stores a first user program related to control of an object and first setting information indicating settings related to the control; a receiving unit that receives a second user program related to control of the object and second setting information indicating settings related to the control; as well as a control engine that executes the first user program using the first setting information, The management method comprises the following steps: Verifying, for the first user program and the second user program, whether program identity is satisfied; evaluating the validity of the setting indicated by the second setting information; as well as Based on the verification result in the step of verifying and the evaluation in the step of evaluating, it is determined whether to cause the control device to perform a change process of changing the first user program and the first setting information in the storage unit using the second user program and the second setting information, respectively, wherein The evaluation includes checking whether the second setting information satisfies the constraints related to the control of the object, The second setting information includes a threshold value related to the control of the object, The checking includes comparing the threshold value of the second setting information with a predetermined value indicated by the constraint condition.

Images