Physical model generating device, control method, and program

Abstract

The physical model generating device (2000) acquires structure information (10), state information (20), and template information (30). The structure information (10) represents physical components (52) included in a target control system (50) and connections (54) for each physical component (52). The state information (20) represents the correspondence between a state of a physical component and one or more operation connections through which a signal passes in the corresponding state. The template information (30) represents the correspondence between a behavior template and a connection condition. The behavior template represents a behavior common to the physical components (52) having operation connections that satisfy the corresponding connection condition. The physical model generating device (2000) generates a physical model (40) including behavior information (42) representing the behavior of the physical component (52) in each possible state for each physical component (52).

Description

[Technical field]

[0001] This disclosure relates generally to physical models of control systems. [Background technology]

[0002] Physical models of control systems are used in various applications. A control system includes physical components such as sensors, actuators, controllers, etc. For example, to perform security risk assessment of a control system, various simulations are performed on the physical models.

[0003] Patent Document 1 discloses a technique for automatically generating a physical model. Specifically, Patent Document 1 discloses a technique for obtaining an input model that describes a normal operating mode of a system and generating an extended model that represents an abnormal operating mode of the system. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] European Patent Application Publication No. 2838016 Summary of the Invention [Problem to be solved by the invention]

[0005] The technology disclosed in Patent Document 1 assumes that an input model is prepared in advance. Therefore, it is considered that an engineer must manually create a model that represents the normal operating mode of the system. The purpose of this disclosure is to disclose a technology that facilitates the generation of a physical model of a control system. [Means for solving the problem]

[0006] The physical model generating device of the present disclosure includes at least one processor and a memory for storing instructions, and is configured to execute the instructions to obtain structural information representing a plurality of physical components included in a target control system and, for each of the plurality of physical components, one or more connections to other physical components, obtain state information representing one or more correspondences between a state of the physical component and one or more operation connections that are the connections through which a signal passes in the corresponding state, for each of the plurality of physical components represented in the structural information, obtain template information representing a plurality of correspondences between behavior templates and connection conditions, the behavior templates representing one or more behaviors common to the physical components having operation connections that satisfy the corresponding connection conditions, and generate behavior information representing one or more behaviors of the physical component in each of the states of the physical component for each of the plurality of physical components represented in the structural information based on the structural information, the state information, and the template information, thereby generating a physical model of the target control system including behavior information for each of the plurality of physical components included in the target control system.

[0007] The control method of the present disclosure is executed by a computer. The control method includes: acquiring structural information representing a plurality of physical components included in a target control system and, for each of the plurality of physical components, one or more connections to other physical components; acquiring state information representing one or more correspondences between a state of the physical component and one or more operation connections that are the connections through which a signal passes in the corresponding state, for each of the plurality of physical components represented in the structural information; acquiring template information representing a plurality of correspondences between behavior templates and connection conditions, the behavior templates representing one or more behaviors common to the physical components having operation connections that satisfy the corresponding connection conditions, and generating, for each of the plurality of physical components represented in the structural information, behavior information representing one or more behaviors of the physical component in each of the states of the physical component based on the structural information, the state information, and the template information, thereby generating a physical model of the target control system including behavior information for each of the plurality of physical components included in the target control system.

[0008] The computer-readable storage medium of the present disclosure stores a program that causes a computer to execute each step of the control method described above. Effect of the Invention

[0009] According to the present disclosure, it is possible to provide a technique that facilitates the generation of a physical model of a control system. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram illustrating an example of a functional configuration of a physical model generating device according to the first embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of a hardware configuration of a computer that realizes the physical model generating device. [Diagram 3] FIG. 3 is a flowchart showing the flow of processing executed by the physical model generating device of the first embodiment. [Figure 4] FIG. 4 shows an example of the structure of a target control system. [Diagram 5] FIG. 5 shows an example of the structure information in table format. [Figure 6] FIG. 6 shows an example of state information in table format. [Figure 7] FIG. 7 shows an example of the connection conditions. [Figure 8] FIG. 8 shows an example of template information in table format. [Figure 9] FIG. 9 shows an example of a physical model in tabular form. [Figure 10] FIG. 10 is a flow diagram showing an example of a specific process flow for generating a physical model. [Figure 11] FIG. 11 shows the structure of the second example object control system. [Figure 12A] FIG. 12A shows the structure information of the target control system of the second example. [Figure 12B] FIG. 12B shows the structure information of the target control system of the second example. [Figure 13] FIG. 13 shows state information in which possible states of a push button included in the target control system of the second example are shown. [Figure 14] FIG. 14 shows state information in which possible states of an operator included in the target control system of the second example are shown. [Figure 15A] FIG. 15A illustrates a physical model generated for the target control system of the second example. [Figure 15B] FIG. 15B illustrates a physical model generated for the target control system of the second example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. The same elements are designated by the same reference numerals throughout the drawings, and redundant descriptions are omitted as necessary. Furthermore, unless otherwise specified, the predetermined information (e.g., a predetermined value or a predetermined threshold value) is stored in advance in a storage device accessible from a computer that uses the information.

[0012] EMBODIMENT 1 1 is a block diagram showing an example of a functional configuration of a physical model generating device 2000 according to a first embodiment. The physical model generating device 2000 generates a physical model 40 of a control system to be modeled (hereinafter, a target control system 50). The target control system 50 includes a plurality of physical components 52. The physical components 52 may include sensors, indicators, actuators, controllers, and other devices. For example, a conveyor belt system may include push buttons, indicators, controllers, and a conveyor belt. The controller may include a programmable logic controller (PLC) and a distributed control system (DCS) that monitors and controls the other physical components 52.

[0013] The physical model 40 needs to represent the behavior of each physical component 52 of the target control system 50. However, manually defining the behavior of each physical component 52 takes a long time. In particular, a physical component 52 can be in multiple states, such as working or abnormal, and the behavior of each physical component 52 can depend on the states. This fact makes manually defining the behavior of each physical component 52 more time-consuming.

[0014] Therefore, the physical model generation device 2000 automatically generates a physical model 40 representing the behavior of each physical component 52, based on the states that each physical component 52 can take and the behavior template information. To this end, the physical model generation device 2000 has an acquisition unit 2020 and a generation unit 2040, and these components can operate as follows.

[0015] The acquiring unit 2020 acquires structural information 10 that represents the structure of the target control system 50. Specifically, the structural information 10 represents each physical component 52 included in the target control system 50. Furthermore, for each physical component 52, the structural information 10 represents one or more connections 54 that represent connections between the physical component 52 and other physical components 52.

[0016] The acquiring unit 2020 acquires state information 20 for each physical component 52. The state information 20 represents possible states of one or more physical components. Here, the possible states of a physical component may depend on its type (e.g., "controller" or "conveyor belt"). Therefore, the state information 20 may be defined for each type of physical component. The type of each physical component 52 may be indicated in the structure information 10. The physical model generating device 2000 acquires the state information 20 for each type of physical component 52.

[0017] The state information 20 further includes, for each state of the physical component, a signal that Sending A physical component connection indicates one or more connections of a physical component in which a signal may be transmitted in a particular state. Hereinafter, a connection of a physical component in which a signal is transmitted in a particular state is referred to as an "operational connection" corresponding to that state. Thus, for example, state information 20 indicates, for each type of physical component, a correspondence between the state of the physical component and one or more operational connections of the physical component in the corresponding state.

[0018] Based on the structure information 10 and the state information 20, the physical model generation device 2000 can grasp the possible states of each physical component 52 in the target control system 50. Furthermore, the physical model generation device 2000 can grasp which connections 54 of each physical component 52 are used for transmission or reception in each state.

[0019] The acquiring unit 2020 further acquires template information 30 representing a template of a behavior of a physical component. Specifically, the template information 30 includes a behavior template for each connection condition. In other words, the template information 30 includes an association between the behavior template and the connection condition.

[0020] A connection condition indicates one or more conditions regarding one or more behavior connections. A behavior template represents one or more behaviors common to physical components having behavior connections for which the connection condition corresponding to the behavior template is satisfied. This means that for each set of conditions regarding the behavior connections of a physical component 52, the template information 30 indicates one or more behaviors of the physical component 52.

[0021] By using the structure information 10, the state information 20, and the template information 30, the generator 2040 generates a physical model 40 including behavior information 42 for each physical component 52 of the target control system 50. The behavior information 42 of a physical component 52 represents the behavior of the physical component 52 for each state of the physical component 52 shown in the state information 20. The behavior of the physical component 52 in that state is determined based on a behavior template corresponding to a connection condition that is satisfied by the operational connections of the physical component 52 in that state.

[0022] <Examples of effects> The physical model generating device 2000 generates a model representing the behavior of each physical component 52. subject A physical model 40 of the control system 50 is generated. The physical model 40 is generated using the structure information 10, the state information 20, and the template information 30. The physical model generation device 2000 does not require the user to prepare a physical model that represents the operation of the target control system 50 in normal mode. Therefore, it is easy for the user to generate a physical model of the target control system 50.

[0023] Furthermore, by utilizing the structure information 10, the state information 20, and the template information 30, a behavior template can be obtained for each combination of the physical component 52 and its state. Therefore, the physical model generation device 2000 can identify the behavior for each of the multiple states of the physical component 52, and thereby generate the physical model 40 that indicates the behavior for each of the multiple states of the physical component 52.

[0024] The physical model generating device 2000 of the first embodiment will be described in detail below.

[0025] <Example of hardware configuration> The physical model generating device 2000 may be realized by one or more computers. 000 The computer may be a dedicated computer created for implementing the above, or may be a general-purpose computer such as a personal computer (PC), a server machine, or a mobile device.

[0026] The physical model generating device 2000 can be realized by installing an application on a computer. The application is realized by a program that causes the computer to function as the physical model generating device 2000. In other words, the program implements the functional components of the physical model generating device 2000.

[0027] 2 is a block diagram showing an example of a hardware configuration of a computer 1000 that realizes the physical model generating device 2000. In FIG. 2, the computer 1000 includes a bus 1020, a processor 1040, a memory 1060, a storage device 1080, an input / output interface 1100, and a network interface 1120.

[0028] The bus 1020 is a data communication path for the processor 1040, the memory 1060, the storage device 1080, the input / output interface 1100, and the network interface 1120 to transmit and receive data to and from each other. The processor 1040 is a processor such as a central processing unit (CPU), a graphics processing unit (GPU), or a field-programmable gate array (FPGA). The memory 1060 is a main storage element such as a random access memory (RAM) or a read only memory (ROM). The storage device 1080 is an auxiliary storage element such as a hard disk, a solid state drive (SSD), or a memory card. The input / output interface 1100 is an interface between the computer 1000 and a peripheral device (such as a keyboard, a mouse, or a display device). The network interface 1120 is an interface between the computer 1000 and a network. The network may be a local area network (LAN) or a wide area network (WAN). The storage device 1080 may store the programs described above. Processor The program 1040 executes the program to realize each functional component of the physical model generating device 2000 .

[0029] The hardware configuration of the computer 1000 is not limited to the configuration shown in Fig. 2. For example, as described above, the physical model generation device 2000 may be realized by a plurality of computers. In this case, the computers may be connected to each other via a network.

[0030] <Processing flow> 3 is a flow diagram showing the flow of processing executed by the physical model generating device 2000 of the first embodiment. The acquiring unit 2020 acquires the structure information 10 (S102). The acquiring unit 2020 further acquires the state information 20 for each physical component 52 (S104). 。Next, the acquisition unit 2020 acquires the template information 30 (S106). The generation unit 2040 generates a physical model 40 including behavior information 42 for each physical component 52 of the target control system 50.

[0031] Here, the flow of the process executed by the physical model generating device 2000 is not limited to that shown in Fig. 3. For example, each piece of information may be acquired at any timing as long as it is acquired before it is used. For example, the template information 30 may be acquired before the state information 20 is acquired.

[0032] <Obtaining structural information: S102> The acquiring unit 2020 acquires the structure information 10 (S102). The structure information 10 represents the structure of the target control system 50. Specifically, it represents the physical components 52 that constitute the target control system 50, and the connections 54 that connect the physical components 52 to other physical components 52.

[0033] 4 shows an example of the structure of the target control system 50. The target control system 50 includes seven physical components: three push buttons "B101", "B102", and "SW10 1 4 includes a physical component 52 ("PHYSICAL COMPONENT 52" in FIG. 4), two indicators "FI101" and "CR101", a conveyor belt "CB1", and a controller "PLC1"). In FIG. 4, each oval represents a port through which a physical component 52 is connected to another physical component 52. Furthermore, arrows represent signal flow. For example, push button B101 has an output port "STATE". This output port connects push button B101 to controller PLC1 through an input port "I01" of controller PLC1.

[0034] Fig. 5 shows an example of the structure information 10 in the form of a table. Table 100 in Fig. 5 is an example of the structure information 10, and shows the structure of the target control system 50 shown in Fig. 4. The table 100 has columns of "identifier 102," "type 104," and "connection 106." Characteristics of the physical components 52 are represented by one or more rows of the table 100.

[0035] The value of the identifier 102 indicates the identifier of the corresponding physical component 52. The value of the type 104 indicates the type of the physical component 52. For example, the first row of the table 100 in Figure 5 indicates that the target control system 50 includes a physical component 52 whose identifier is "B101" and whose type is "PUSH BUTTON." The value of the connection 106 indicates one of the connections 54 that connect the physical component 52 to another physical component 52.

[0036] The connection 106 is further divided into columns of "Port 108," "Direction 110," and "Component 112." The value of the port 108 indicates the identifier of the port of the physical component 52. For example, the first row of the table 100 in Figure 5 indicates that the physical component B 101 has a connection 54 with a port "STATE."

[0037] The value of direction 110 indicates the direction of connection 54. Specifically, a value of "SIGNAL-OUT" of direction 110 indicates that port 108 is an output port and a signal is output from physical component 52 through that port. On the other hand, a value of "SIGNAL-IN" of direction 110 indicates that port 108 is an input port and a signal is input to physical component 52 through that port. For example, the first row of table 100 in FIG. 5 indicates that port STATE of push button B101 is an output port.

[0038] The value of component 112 indicates the other end of connection 54. For example, the first row of table 100 in Figure 5 indicates that connection 54 connects push button B101 to controller PLC1.

[0039] There may be various methods for acquiring the structural information 10. For example, the structural information 10 to be acquired by the acquisition unit 2020 may be physics The structural information 10 is stored in advance in a storage device accessible from the model generating device 2000. In this case, the acquiring unit 2020 reads out the structural information 10 from the storage device. Alternatively, for example, the acquiring unit 2020 may receive the structural information 10 transmitted from another device. Alternatively, for example, the structural information 10 is manually input by a user to the physical model generating device 2000, and the acquiring unit 2020 acquires the structural information 10 input by the user.

[0040] <Getting status information 20: S104> The acquisition unit 2020 acquires status information 20 for each physical component 52 (S104). The status information 20 represents the possible states of each physical component 52. As described above, the possible states of a physical component 52 may depend on its type. For example, a target control system 50 having the structure shown in FIG. 5 has three push buttons, and the possible states of these push buttons are the same. Therefore, status information 20 may be created for each type of physical component.

[0041] FIG. 6 shows an example of the state information 20 in table format. The table 200 shown in FIG. 6 shows possible states of a physical component 52 of type CONVEYOR BELT. situation information 2 This is an example of 0.

[0042] The table 200 has columns of "identifier 202," "input port 204," "output port 206," "value 208," and "initial value 210." Each row of the table 200 200 indicates information regarding one of the states that a physical component 52 belonging to a type corresponding to 00 can be in.

[0043] The value of identifier 202 indicates the identifier of the corresponding state. The value of input port 204 indicates the identifier of the input port of a physical component 52 operating in that state. Note that the term "operating" here means that the port is being used for communication. For example, the first row of table 200 in FIG. 6 indicates that when a physical component 52 of type CONVEYOR BELT is in the WORKING state, the input port CMD of that physical component 52 is operating (in other words, is being used to receive signals transmitted from other physical components 52).

[0044] Similarly, the value of output port 206 indicates the identifier of the output port of the physical component 52 operating in that state. For example, the first row of table 200 in Fig. 6 indicates that when the state of a physical component 52 of type CONVEYOR BELT is WORKING, the output port STATE of that physical component 52 is operating (in other words, is used to receive signals transmitted from other physical components 52).

[0045] Value 208 indicates a value that can be represented by a signal output from physical component 52. For example, the first row of table 200 in Fig. 6 indicates that when physical component 52 of type CONVEYOR BELT is in a WORKING state, its output signal can represent "OFF" or "ON." Here, the notation [0: OFF, 1: ON] shown in table 200 indicates that values ​​OFF and ON are treated as the 0th value and the 1st value, respectively.

[0046] The value of the initial value 210 indicates the initial value indicated by the signal output from the physical component 52. For example, ,figureThe first row of table 200 in FIG. 6 indicates that when the state of physical component 52 of type CONVEYOR BELT is WORKING, the initial value indicated by the output signal is OFF.

[0047] There are various methods for acquiring the state information 20. For example, the state information 20 to be acquired by the acquisition unit 2020 may be physics The state information 20 is stored in advance in a storage device accessible from the model generating device 2000. In this case, the acquiring unit 2020 reads out the state information 20 from the storage device. Alternatively, for example, the acquiring unit 2020 may receive the state information 20 transmitted from another device. Alternatively, for example, the state information 20 is manually input by a user to the physical model generating device 2000, and the acquiring unit 2020 acquires the state information 20 input by the user.

[0048] Here, when the state information 20 is prepared for each type of physical component, it is sufficient for the acquisition unit 2020 to acquire one piece of state information 20 for multiple physical components 52 classified into the same type. For example, when the structure of the target control system 50 is shown by the table 100 in FIG. 5, the target control system 50 includes three push Bo Although there is a button, the acquisition unit 2020 acquires the state information 20 for the type PUSH BUTTON once.

[0049] <Getting template information 30: S106> The acquisition unit 2020 acquires the template information 30 (S106). 。 The template information 30 describes the behavior of the physical components 52 for each given connection condition. A connection condition is defined by a condition or a set of conditions on an active connection 54. Before describing the template information 30 in detail, a more detailed description of a connection condition will now be provided.

[0050] FIG. 7 shows an example of a connection condition. Table 300 in FIG. 7 is an example of a set of predetermined connection conditions. Table 300 has columns of "identifier 302", "condition C1", "condition C2", and "condition C3". Condition C1 indicates a condition that "the operation connection has an input port, and the other end of the operation connection is not a controller". Condition C2 indicates a condition that "the operation connection has an input port, and the other end of the operation connection is a controller". Condition C3 indicates a condition that "the operation connection has an output port, and the other end of the operation connection is a controller". Here, the set of conditions used to define the connection conditions is not limited to the above-mentioned conditions C1 to C3.

[0051] Each connection condition is represented by one row in the table 300. The value of the identifier 302 indicates the identifier of the connection condition. A connection condition is represented by a set of conditions C1 to C3 that are satisfied or not satisfied. For example, a connection condition "S" is a set of conditions C1 and C3 that are satisfied or not satisfied. 3 While satisfying condition C 2 is not satisfied.

[0052] The template information 30 represents the behavior of the physical components for each connection condition (e.g., connection conditions S, S2, A, and AS shown in FIG. 7). FIG. 8 shows an example of the template information 30 in the form of a table. Table 400 in FIG. 8 shows the correspondence between a connection condition and a behavior common to physical components having operational connections that satisfy the corresponding connection condition.

[0053] Table 400 has columns labeled "Connection Condition 402" and "Behavior Template 404." The value of connection condition 402 indicates one of the predefined connection conditions. The value of behavior template 404 indicates the behavior of physical components having operational connections for which the connection condition is satisfied. For example, the first row of table 400 indicates the behavior common to physical components 52 having operational connections for which connection condition S is satisfied (i.e., conditions C1 and C3 are satisfied while condition C2 is not satisfied).

[0054] The behavior represented by the behavior template 404 is calculated by using the table 400. 2 In this way, a behavior template 404 common to multiple cases can be converted into a description specific to one case.

[0055] For example, table 400 includes the keywords "$CN$", "$SN$", "$SV{i}$"", and "$INPUT-CN$". The keyword "$CN$" is used to represent any physical component and is replaced with an identifier of a specific physical component. The keyword "$SN$" is used to represent any state of a physical component and is replaced with an identifier of a specific state of a physical component.

[0056] Suppose the identifier of the physical component 52 is CB1 and the state of the physical component 52 is WORKING. In this case, the phrase "$CN$.send_$SN$[t]" is replaced by "CB1.send_WORKING[t]", where CB1.send_WORKING[t] denotes the value sent at time instant t by the physical component CB1 whose state is WORKING.

[0057] The keyword "$SV{i}$" is used to represent one or more values ​​output or input to a physical component in a certain state. If the state information 20 of the physical component 52 in that state indicates one or more values ​​output from the physical component 52 in that state, the keyword "$SV{i}$" is replaced with those values. On the other hand, if the state information 20 of the physical component 52 in that state does not indicate any values ​​output from the physical component 52 in that state, the keyword "$SV{i}$" is replaced with one or more values ​​input to the physical component 52 (i.e., values ​​output from the other end of the connection 54).

[0058] Here, if the state information 20 indicates multiple values ​​output from the physical components of the state, multiple expressions are generated and linked together using "or".

[0059] For example, assume that the identifier of the physical component 52 is CB1 and the state of the physical component 52 is WORKING. Furthermore, assume that the state information 20 corresponding to the physical component CB1 indicates values ​​of "0: OFF, 1: ON" for the state WORKING. In this case, the phrase "$CN$.send_$SN$[t]=$SV{i}" is converted to "CB1.send_WORKING[t]=OFF or CB1.send_WORKING[t]=ON".

[0060] The keyword "$INPUT-CN$" is behavior information 4 2 is used to represent the physical component at the other end of the connection for the physical component 52 on which it is generated.

[0061] The behavior template 404 in FIG. Broken Not only in cases where BrokenFor example, in the first row of the table 400, the description in the first row of the behavior template 404 includes the phrase "not in compromised," so Broken On the other hand, in the first row of the table 400, the description in the second row of the behavior template 404 includes the phrase "in compromised", so Broken The behavior template 404 indicates the behavior of the physical component. Broken Since the behavior of the physical components is also included, the behavior information 40 generated using the template information 30 is used to Broken However, the behavior template 404 can simulate the operation of the target control system 50 in a certain state. Broken The behavior of the physical components may not be included.

[0062] There may be various methods for acquiring the template information 30. For example, the template information 30 to be acquired by the acquisition unit 2020 may be physics The template information 30 is stored in advance in a storage device accessible from the model generating device 2000. In this case, the acquiring unit 2020 reads out the template information 30 from the storage device. Alternatively, for example, the acquiring unit 2020 may receive the template information 30 transmitted from another device. Alternatively, for example, the template information 30 is manually input by a user to the physical model generating device 2000, and the acquiring unit 2020 acquires the template information 30 input by the user.

[0063] <Generation of physical model 40: S108> The generator 2040 generates a physical model 40 including behavior information 42 for each physical component 52 of the target control system 50 based on the structure information 10, the state information 20, and the template information 30 (S108). The behavior information 42 of the physical component 52 represents the association between the state of the physical component 52 and the behavior of the physical component 52 in the corresponding state.

[0064] Figure 9 shows the physical model. 4 9 is a table showing an example of a physical model generated using the structure information 10 shown in FIG. 5, the state information 20 shown in FIG. 6, and the template information 30 shown in FIG. 4 This is an example of 0.

[0065] The table 500 includes a “component identifier 502,” a “type identifier 504,” and a “behavior information 50 6 The value of the component identifier 502 indicates an identifier of the physical component 52. The value of the type identifier 504 indicates an identifier of the type of the physical component 52. 6 The value of is the behavior information 4 generated for the physical component 52. 2 Shows.

[0066] The behavior information 506 is further divided into three columns: "State Identifier 508," "Matching Condition 510," and "Behavior 512." The value of the state identifier 508 indicates one of the possible states of the physical component 52. The value of the matching condition 510 indicates the condition that is satisfied by the operational connections of the physical component 52 in that state. The value of the behavior 512 indicates the behavior of the physical component 52 in that state, based on the behavior template 404 that corresponds to the connection condition indicated in the matching condition 510.

[0067] To generate the physical model 40, the generation unit 2040 refers to the structure information 10, the state information 20, and the template information 30. A specific method of generating the physical model 40 will be described with reference to Fig. 10. Fig. 10 is a flow diagram showing an example of a specific process flow for generating the physical model 40.

[0068] The generating unit 2040 initializes the table 500 to an empty state (S202). Steps S204 to S220 constitute a loop process L1. The loop process L1 is a set of processes to be executed for each physical component 52 indicated in the structure information 10. In step S204, the generating unit 2040 judges whether the loop process L1 has been executed for all physical components 52. If it is judged that the loop process L1 has been executed for all physical components 52, the process of FIG. 10 ends. This means that the generation of the physical model 40 is completed. On the other hand, if it is judged that the loop process L1 has not been executed for all physical components 52, the generating unit 2040 selects one of the physical components 52 for which the loop process L1 has not yet been executed. The physical component 52 selected here is called a "selected component."

[0069] Steps S206 to S218 constitute a loop process L2. The loop process L2 is executed for each state of the selected component represented by the state information 20 of the type corresponding to the selected component. In step S206, the generation unit 2040 judges whether the loop process L2 has been executed for all possible states of the selected component. If it is judged that the loop process L2 has been executed for all possible states of the selected component, the loop process L2 ends. On the other hand, if it is judged that the loop process L2 has not been executed for all possible states of the selected component, the generation unit 2040 selects one of the possible states of the selected component for which the loop process L2 has not yet been executed. The state of the selected component selected here is called the "selected state."

[0070] In step S208, the generating unit 2040 determines which connection condition is satisfied by the operation connection of the selected component in the selected state. Furthermore, the generating unit 2040 acquires a behavior template 404 corresponding to the connection condition 402 determined to be satisfied by the operation connection of the selected component in the selected state (S210). The generating unit 2040 generates a behavior 512 for the selected component in the selected state by replacing the keyword of the acquired behavior template 404 (S212). Note that the method of replacing the keyword of the behavior template 404 has been described above. The generating unit 2040 generates a row of the table 500 for the selected component in the selected state by using the behavior 512 generated in step S212 (S214). The generating unit 2040 adds the row to the table 500 (S216). Step S218 is the end of the loop process L2. Therefore, step S206 is executed next.

[0071] For example, suppose the selected component is CB1, defined in table 100 shown in Figure 5, and the selected state is WORKING. For state WORKING, table 200 shows CMD and STATE as the input and output ports, respectively. Thus, the operational connections of physical component CB1 in state WORKING are connection 54 with input port CMD and connection 54 with output port STATE.

[0072] The generator 2040 determines which connection conditions are satisfied by the aforementioned operation connection. In this case, the operation connection includes an input port CMD, which is connected to the controller PLC1. Therefore, condition C1 is satisfied, while condition C2 is not satisfied. Furthermore, the operation connection includes an output port STATE, which is connected to the controller PLC1. Therefore, condition C3 is satisfied. The table 300 in FIG. 7 shows the connection conditions. matter Sindicates a connection condition where conditions C1 and C3 are satisfied and condition C2 is not satisfied.

[0073] Connection Conditions S Since the above condition is satisfied, the generation unit 2040 generates the connection condition matter S The generation unit 2040 then replaces the keywords in the behavior template 404 that has been obtained.

[0074] In this case, the keywords "$CN$" and " $ "SN$" is replaced by "CB1" and "WORKING" respectively. For the keyword "SV{i}", there are two possible values ​​"OFF" and "ON" that can be output by the physical component CB1 of the state WORKING. Therefore, one expression with the keyword "SV{i}" is transformed into two expressions. In the first expression, SV{i} is replaced by OFF, and in the second expression, SV{i} is replaced by ON. Then, these two expressions are concatenated with "or".

[0075] < physics Model 40 Output> The generating unit 2040 may be configured in various ways. physics For example, the generation unit 2040 stores the model 40 in a storage device. physics In addition, for example, the generation unit 2040 may store the model 40 on a display device. physics For display devices that display Model 40 physics The generation unit 2040 may output the model 40. physics The model 40 may be transmitted to any device.

[0076] physics There are various possible uses for the model 40. One possible use for the physical model 40 is the simulation of a target control system 50. physics Simulation using the model 40 allows, for example, a security risk assessment of the target control system 50 to be performed.

[0077] <Target control system and physics Other examples of models> Here, the target control system 50 and the generated physics Another example of the model 40 will be described. The target control system 50 of the first example has a structure shown in FIG. 4 and does not include any physical components 52 having operational connections that satisfy the connection condition S shown in FIG. 8. Therefore, the first example shown in FIG. physics For the model 40, a behavior template corresponding to the connection condition S is used. On the other hand, the target control system 50 of the second example described below includes a physical component 52 having an operation connection that satisfies the connection condition S shown in FIG. 8. Therefore, physics The model 40 includes behaviors generated from behavior templates corresponding to the connection conditions S.

[0078] 11 shows the structure of the target control system 50 of the second example. The target control system 50 of the second example differs from the target control system 50 of the first example in that it includes three operators "OP101", "OP102", and "OP103". A physical component of type "operator" is a person who operates other physical components such as buttons. To simulate the behavior of the operator, the operator is treated as a physical component in this example.

[0079] 12A and 12B show the configuration information 10 of the target control system 50 of the second example. The table 600 of FIG. 12 differs from the table 100 of FIG. 5 in that it has additional rows defining the operators OP101, 102, 103. Furthermore, in this example, the push buttons operate in response to receiving signals output from the operators connected to them. Thus, each push button has an input port for receiving a signal from the operator connected to it.

[0080] Fig. 13 shows state information 20 in which possible states of a push button included in the target control system 50 of the second example are represented. Fig. 14 shows state information 20 in which possible states of an operator included in the target control system 50 of the second example are represented. Figs. 15A and 15B show a physical model generated for the target control system 50 of the second example. 4 Represents 0.

[0081] In this example, the push button in state WORKING has an input port connected to an operator (not a controller) and an output port connected to the controller. Therefore, the behavioral connection of the push button in state WORKING satisfies connection condition S. As a result, the behavior of push buttons B101, B102, and SW101 is generated based on the behavior template corresponding to connection condition S shown in Figure 8.

[0082] 8 shows that the behavior template 404 corresponding to the connection condition S includes the keyword "$INPUT-CN$". As described above, this keyword is included in the behavior information 4 2 The $INPUT-CN$ keyword is used to represent the physical component at the other end of the connection of the physical component 52 for which the behavior template is generated. For example, as shown in the fifth row of table 600 in Fig. 12A, the input port of push button B101 in state WORKING is connected to the operator OP101. Therefore, as shown in the fourth row of table 900 in Fig. 15A, for push button B101 in state WORKING, the keyword $INPUT-CN$ in the behavior template is replaced with the identifier OP101.

[0083] Although the present disclosure has been described with reference to the embodiments, the present disclosure is not limited to the above-mentioned embodiments. Various modifications that are understandable to those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the invention.

[0084] In the above-described embodiment, the program can be stored and provided to the computer using various types of non-transitory computer readable media. The non-transitory computer readable medium includes various types of tangible storage media. Examples of the non-transitory computer readable medium include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs, CD-Rs, CD-R / Ws, and semiconductor memories (e.g., mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs). The program may also be provided to the computer by various types of transitory computer readable media. Examples of the transitory computer readable medium include electric signals, optical signals, and electromagnetic waves. The transitory computer readable medium can provide the program to the computer via a wired communication path such as an electric wire and an optical fiber, or via a wireless communication path.

[0085] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. <Additional Notes> (Appendix 1) At least one processor; A memory for storing instructions; The at least one processor executes the instructions to: Obtaining structural information representing a plurality of physical components included in a target control system and, for each of the plurality of physical components, one or more connections to other physical components; acquiring, for each of the plurality of physical components represented in the structural information, state information representing one or more correspondences between a state of the physical component and one or more operational connections which are the connections through which a signal passes in the corresponding state; acquiring template information representing a plurality of correspondences between behavior templates and connection conditions, the behavior templates representing one or more behaviors common to the physical components having operation connections that satisfy the corresponding connection conditions; a physical model generation device configured to generate, for each of the plurality of physical components represented by the structural information based on the structural information, the state information, and the template information, behavior information representing one or more behaviors of the physical component in each of the states of the physical component, thereby generating a physical model of the target control system including behavior information for each of the plurality of physical components included in the target control system. (Appendix 2) the representation of the behavior information includes a first keyword to be replaced with an identifier of the physical component, a second keyword to be replaced with an identifier of the state of the physical component, or a third keyword to be replaced by one or more values ​​output from the physical component; 2. The physical model generation device of claim 1, wherein for a physical component in a state, the generation of the behavior information includes replacing the first keyword represented in the behavior template with an identifier of the physical component, replacing the second keyword represented in the behavior template with an identifier of the state, or replacing the third keyword represented in the behavior template with one or more values ​​output by the physical component in the state. (Appendix 3) 3. The physical model generation device according to claim 1, wherein the connection condition is defined by a combination of whether an input port connected to a controller is operating, whether an input port connected to a physical component other than the controller is operating, and whether an output port connected to the controller is operating. (Appendix 4) the state information is defined for each type of the physical component; 4. The physical model generation device according to claim 1, wherein the acquiring of the state information includes acquiring, for each of the plurality of physical components represented by the structural information, the state information corresponding to the type of the physical component. (Appendix 5) 5. The physical model generation device according to claim 1, wherein the behavior template includes one or more behaviors of the physical component that is compromised and one or more behaviors of the physical component that is not compromised. (Appendix 6) acquiring structural information representing a plurality of physical components included in a target control system and, for each of the plurality of physical components, one or more connections to other physical components; acquiring, for each of the plurality of physical components represented in the structural information, state information representing one or more correspondences between a state of the physical component and one or more operational connections which are the connections through which a signal passes in the corresponding state; and acquiring template information representing a plurality of correspondences between behavior templates and connection conditions, the behavior templates representing one or more behaviors common to the physical components having operation connections that satisfy the corresponding connection conditions; A control method executed by a computer, comprising: generating behavior information representing one or more behaviors of each of the plurality of physical components represented by the structural information based on the structural information, the state information, and the template information, for each of the plurality of physical components represented by the structural information, the behavior information representing one or more behaviors of the physical component in each of the states of the physical component, thereby generating a physical model of the target control system including behavior information for each of the plurality of physical components included in the target control system. (Appendix 7) the representation of the behavior information includes a first keyword to be replaced with an identifier of the physical component, a second keyword to be replaced with an identifier of the state of the physical component, or a third keyword to be replaced by one or more values ​​output from the physical component; The control method of claim 6, wherein for a physical component in a state, the generation of the behavior information includes replacing the first keyword represented in the behavior template with an identifier of the physical component, replacing the second keyword represented in the behavior template with an identifier of the state, or replacing the third keyword represented in the behavior template with one or more values ​​output by the physical component in the state. (Appendix 8) The control method described in Appendix 6 or 7, wherein the connection condition is defined by a combination of whether an input port connected to a controller is operating, whether an input port connected to a physical component other than the controller is operating, and whether an output port connected to the controller is operating. (Appendix 9) the state information is defined for each type of the physical component; The control method according to any one of appendixes 6 to 8, wherein the acquisition of the status information includes acquiring, for each of the plurality of physical components represented by the structural information, the status information corresponding to the type of the physical component. (Appendix 10) 10. The control method according to any one of claims 6 to 9, wherein the behavior template includes one or more behaviors of the physical component that are compromised and one or more behaviors of the physical component that are not compromised. (Appendix 11) acquiring structural information representing a plurality of physical components included in a target control system and, for each of the plurality of physical components, one or more connections to other physical components; acquiring, for each of the plurality of physical components represented in the structural information, state information representing one or more correspondences between a state of the physical component and one or more operational connections which are the connections through which a signal passes in the corresponding state; and acquiring template information representing a plurality of correspondences between behavior templates and connection conditions, the behavior templates representing one or more behaviors common to the physical components having operation connections that satisfy the corresponding connection conditions; A computer-readable storage medium storing a program that causes a computer to execute the following: generate behavior information for each of the plurality of physical components represented by the structural information based on the structural information, the state information, and the template information, the behavior information representing one or more behaviors of the physical component in each of the states of the physical component, thereby generating a physical model of the target control system that includes behavior information for each of the plurality of physical components included in the target control system. (Appendix 12) the representation of the behavior information includes a first keyword to be replaced with an identifier of the physical component, a second keyword to be replaced with an identifier of the state of the physical component, or a third keyword to be replaced by one or more values ​​output from the physical component; A storage medium as described in Appendix 11, wherein for a physical component in a state, the generation of the behavior information includes replacing the first keyword represented in the behavior template with an identifier of the physical component, replacing the second keyword represented in the behavior template with an identifier of the state, or replacing the third keyword represented in the behavior template with one or more values ​​output by the physical component in the state. (Appendix 13) A storage medium described in Appendix 11 or 12, wherein the connection condition is defined by a combination of whether an input port connected to the controller is operating, whether an input port connected to the physical component other than the controller is operating, and whether an output port connected to the controller is operating. (Appendix 14) the state information is defined for each type of the physical component; A storage medium according to any one of appendices 11 to 13, wherein the acquisition of the status information includes acquiring, for each of the plurality of physical components represented by the structural information, the status information corresponding to the type of the physical component. (Appendix 15) 15. A storage medium according to any one of claims 11 to 14, wherein the behavior template includes one or more behaviors of the physical component that are compromised and one or more behaviors of the physical component that are not compromised. [Explanation of symbols]

[0086] 10 Structural information 20 Status Information 30 Template Information 40 Physical Models 42 Behavioral Information 50 Target Control System 52 Physical Components 54 Connections 100 Table R 102 Identifier 104 Type 106 Connections 108 Port 110 directions 112 Components 200 Tables 202 Identifier 204 Input Port 206 Output Port 208 Value 210 Initial value 300 Tables 302 Identifier 304 Condition C1 306 Condition C2 308 Condition C3 400 Tables 402 Connection Condition 404 Behavior Template 500 Tables 502 Component Identifier 504 Type Identifier 506 Behavior Information 508 Status Identifier 510 Matching Conditions 512 Behavior 600 Tables 602 Identifier 604 Type 606 Connections 608 Port 610 directions 612 Components 700 2nd Identification Model 702 Identifier 704 Input Port 706 Output Port 708 Value 710 Initial value 800 tables 802 Identifier 804 input port 806 output port 808 Value 810 Initial value 900 Table 902 Component Identifier 904 Type Identifier 906 Behavior Information 908 State Identifier 910 Matching Conditions 912 Behavior 1000 Computers 1020 Bus 1040 Processor 1060 Memory 1080 Storage Device 1100 Input / Output Interface 1120 Network Interface 2000 Physical model generator 2020 Acquisition Department 2040 Generation part

Claims

1. Obtaining structural information representing a plurality of physical components included in a target control system and, for each of the plurality of physical components, one or more connections to other of the physical components; acquiring, for each of the plurality of physical components represented in the structural information, state information representing one or more correspondences between a state of the physical component and one or more operational connections which are the connections through which a signal passes in that state; acquiring template information representing a plurality of correspondences between behavior templates and connection conditions; the behavior template represents one or more behaviors common to the physical components having operational connections for which the corresponding connection conditions are satisfied; a physical model generation device that generates behavior information representing one or more behaviors of each of the plurality of physical components represented by the structural information based on the structural information, the state information, and the template information, for each of the plurality of physical components represented by the structural information, the physical model generation device generating a physical model of the target control system including behavior information for each of the plurality of physical components included in the target control system.

2. the behavior information includes a first keyword to be replaced with an identifier of the physical component, a second keyword to be replaced with an identifier of the state of the physical component, or a third keyword to be replaced by one or more values ​​output from the physical component; 2. The physical model generation device of claim 1, wherein for a physical component in a state, the generation of the behavior information includes replacing the first keyword represented in the behavior template with an identifier of the physical component, replacing the second keyword represented in the behavior template with an identifier of the state, or replacing the third keyword represented in the behavior template with one or more values ​​output by the physical component in the state.

3. 3. The physical model generating device according to claim 1, wherein the connection condition is defined by a combination of whether or not an input port connected to a controller is operating, whether or not an input port connected to the physical component other than the controller is operating, and whether or not an output port connected to the controller is operating.

4. the state information is defined for each type of the physical component; The physical model generating device according to claim 1 , wherein the acquiring of the state information includes acquiring, for each of the plurality of physical components represented by the structure information, the state information corresponding to the type of the physical component.

5. The physical model generating apparatus according to claim 1 , wherein the behavior template includes one or more behaviors of the physical component that has failed and one or more behaviors of the physical component that has not failed.

6. acquiring structural information representing a plurality of physical components included in a target control system and, for each of the plurality of physical components, one or more connections to other of the physical components; acquiring, for each of the plurality of physical components represented in the structural information, state information representing one or more correspondences between a state of the physical component and one or more operational connections which are the connections through which a signal passes in that state; acquiring template information representing a plurality of correspondence relationships between behavior templates and connection conditions; the behavior template represents one or more behaviors common to the physical components having operational connections for which the corresponding connection conditions are satisfied; A control method executed by a computer, comprising: generating behavior information for each of the plurality of physical components represented by the structural information based on the structural information, the state information, and the template information, the behavior information representing one or more behaviors of the physical component in each of the states of the physical component, thereby generating a physical model of the target control system including behavior information for each of the plurality of physical components included in the target control system.

7. the behavior information includes a first keyword to be replaced with an identifier of the physical component, a second keyword to be replaced with an identifier of the state of the physical component, or a third keyword to be replaced by one or more values ​​output from the physical component; 7. The control method of claim 6, wherein for a physical component in a state, the generating of the behavior information includes replacing the first keyword represented in the behavior template with an identifier of the physical component, replacing the second keyword represented in the behavior template with an identifier of the state, or replacing the third keyword represented in the behavior template with one or more values ​​output by the physical component in that state.

8. 8. The control method according to claim 6 or 7, wherein the connection condition is defined by a combination of whether an input port connected to a controller is operating, whether an input port connected to a physical component other than the controller is operating, and whether an output port connected to the controller is operating.

9. the state information is defined for each type of the physical component; The control method according to claim 6 , wherein the acquiring of the state information includes acquiring, for each of the plurality of physical components represented by the structure information, the state information corresponding to the type of the physical component.

10. The control method according to claim 6 , wherein the behavior template includes one or more behaviors of the physical component that has failed and one or more behaviors of the physical component that has not failed.

11. acquiring structural information representing a plurality of physical components included in a target control system and, for each of the plurality of physical components, one or more connections to other of the physical components; acquiring, for each of the plurality of physical components represented in the structural information, state information representing one or more correspondences between a state of the physical component and one or more operational connections which are the connections through which a signal passes in that state; acquiring template information representing a plurality of correspondence relationships between behavior templates and connection conditions; the behavior template represents one or more behaviors common to the physical components having operational connections for which the corresponding connection conditions are satisfied; A program that causes a computer to execute the following steps: generate behavior information for each of the plurality of physical components represented by the structural information based on the structural information, the state information, and the template information, the behavior information representing one or more behaviors of the physical component in each of the states of the physical component, thereby generating a physical model of the target control system that includes behavior information for each of the plurality of physical components included in the target control system.

12. the behavior information includes a first keyword to be replaced with an identifier of the physical component, a second keyword to be replaced with an identifier of the state of the physical component, or a third keyword to be replaced by one or more values ​​output from the physical component; 12. The program of claim 11, wherein for a physical component in a state, the generating of the behavior information includes replacing the first keyword represented in the behavior template with an identifier of the physical component, replacing the second keyword represented in the behavior template with an identifier of the state, or replacing the third keyword represented in the behavior template with one or more values ​​output by the physical component in the state.

13. 13. The program according to claim 11 or 12, wherein the connection condition is defined by a combination of whether an input port connected to a controller is operating, whether an input port connected to a physical component other than the controller is operating, and whether an output port connected to the controller is operating.

14. the state information is defined for each type of the physical component; The computer-readable medium according to claim 11 , wherein the acquiring of the state information includes acquiring, for each of the plurality of physical components represented by the structure information, the state information corresponding to the type of the physical component.

15. The program of claim 11 , wherein the behavior template includes one or more behaviors of the physical component that has failed and one or more behaviors of the physical component that has not failed.

Images