Control device, program creation support program, control system, and control method

Abstract

The control device (2) controls a control target device by executing a control program. The control device (2) includes a first storage unit capable of storing the control program, a second storage unit capable of storing the control program and having higher security than the first storage unit, a deployment processing unit (41) that deploys the control program by a deployment method selected from a plurality of deployment methods using the first storage unit or the second storage unit, and a program execution unit (42) that executes the deployed control program.

Description

[Technical Field]

[0001] The present disclosure relates to a control device that controls a control target device, a program creation support program, a control system, and a control method. [Background technology]

[0002] A control program created using a programming support device is input into a control device that controls controlled equipment such as machinery and equipment on a production line. Generally, the control program is stored in a read-only memory (ROM) within the control device. When the control device boots, the control program stored in the ROM is loaded into a random access memory (RAM). The control device then executes the loaded control program.

[0003] Control devices may take measures to prevent information from being leaked to malicious individuals. RAM installed in the microcontroller of a control device has a low risk of information leakage even when the information is handled in plain text. On the other hand, RAM installed outside the microcontroller has a higher risk of information leakage when the information is handled in plain text than RAM installed in the microcontroller. For this reason, information in RAM installed outside the microcontroller may be protected by encryption.

[0004] Patent Document 1 discloses a method for controlling access to a control program stored in a control device from outside the control device using a password. In the method disclosed in Patent Document 1, the password-based access control protects the control program from unauthorized rewriting. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] International Publication No. 2020 / 208791 Summary of the Invention [Problem to be solved by the invention]

[0006] In the method disclosed in Patent Document 1, assuming that the control program and password are stored in RAM implemented in the microcontroller of the control device, the control device can protect the control program. However, if the data size of the control program and password to be protected exceeds the size of the RAM's available storage area, the control device will have to use RAM installed outside the microcontroller to store the control program and password. In this case, it becomes difficult to protect the control program. Furthermore, it is desirable for the control device to minimize the degradation of the control performance of the control device due to the protection of the control program.

[0007] The present disclosure has been made in view of the above, and aims to provide a control device that enables protection of a control program and reduction in deterioration of the control performance of the control device. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems and achieve the object, a control device according to the present disclosure is a control device that controls a control target device by executing a control program. The control device according to the present disclosure includes: a first storage unit capable of storing the control program; a second storage unit capable of storing the control program and having higher security than the first storage unit; a deployment processing unit that deploys the control program using a deployment method selected from a plurality of deployment methods using the first storage unit or the second storage unit; and a program execution unit that executes the deployed control program. [Effects of the Invention]

[0009] The control device according to the present disclosure has the advantage of being able to protect the control program and to reduce deterioration of the control performance of the control device. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing a configuration example of a control system according to a first embodiment; [Figure 2] FIG. 1 is a diagram showing an example of a functional configuration of a control device and a program creation support device according to a first embodiment; [Figure 3] FIG. 10 is a diagram showing an example of selected system program information set in the program creation support device according to the first embodiment; [Figure 4] FIG. 1 is a diagram showing an example of control program information set in the program creation support device according to the first embodiment; [Figure 5] 1 is a flowchart showing an example of an operation procedure of a development method determination unit included in the program creation support device according to the first embodiment. [Figure 6] 10 is a flowchart showing an example of an operation procedure of a decompression processing unit included in the control device according to the first embodiment; [Figure 7] 10 is a flowchart showing an example of an operation procedure of a deployment processing unit and a program execution unit when the control device according to the first embodiment executes a control program. [Figure 8] FIG. 1 is a diagram for explaining the transition of the operation of a control processor included in a control device according to the first embodiment; [Figure 9] FIG. 10 is a diagram showing a configuration example of a control device according to a second embodiment; [Figure 10] 10 is a flowchart showing an example of an operation procedure of a deployment processing unit and a program execution unit when a control device according to a second embodiment executes a control program. [Figure 11] FIG. 10 is a diagram for explaining the transition of operations of a control processor, a transfer processor, and a decoding processor included in a control device according to a second embodiment. [Figure 12] FIG. 11 is a diagram illustrating an example in which the execution order of a plurality of control programs is changed in the third embodiment. [Figure 13] FIG. 11 is a diagram illustrating the transition of operations of the control processor, the transfer processor, and the decoding processor when the execution order of a plurality of control programs is changed in the third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A control device, a program creation support program, a control system, and a control method according to embodiments will be described in detail below with reference to the accompanying drawings.

[0012] Embodiment 1 1 is a diagram showing an example of the configuration of a control system 1 according to embodiment 1. The control system 1 is a system that controls a control target device 4 using a control device 2. The control system 1 includes the control device 2, a program creation support device 3, and the control target device 4.

[0013] The control device 2 is a programmable logic controller (PLC). The control device 2 executes a control program to realize sequence control of the control target device 4. The control target device 4 is, for example, a machine or equipment on a production line. The programming support device 3 and the control device 2 are connected to each other so that they can communicate with each other. The control device 2 and the control target device 4 are connected to each other so that they can communicate with each other.

[0014] The program creation support device 3 supports a user in creating a control program. In the first embodiment, the user is a person who creates a control program. The user creates a control program by operating the program creation support device 3.

[0015] The programming support device 3 is a computer system including a processor 11, a RAM 12, a ROM 13, an input / output interface 14, and a user interface 15. Hereinafter, the interface will be referred to as "I / F."

[0016] The functions of the program creation support device 3 are realized by software, firmware, or a combination of software and firmware. The software or firmware is written as a program and stored in ROM 13. The program creation support program stored in ROM 13 is expanded in RAM 12 and executed by processor 11. The program creation support program causes a computer system to execute the processing procedures and methods of the program creation support device 3.

[0017] The program creation support program according to the first embodiment may be provided by being stored in a recording medium such as a CD (Compact Disc)-ROM or a DVD (Digital Versatile Disc)-ROM. The program creation support program may be provided by being stored in a computer connected to a network such as the Internet and downloaded via the network such as the Internet. The program creation support program may be provided or distributed via a network such as the Internet.

[0018] The processor 11 is a CPU (Central Processing Unit, also called a central processing unit, processing unit, arithmetic unit, microprocessor, microcomputer, processor, or DSP (Digital Signal Processor)).

[0019] The input / output I / F 14 receives data from outside the program creation support device 3 and provides the data to the processor 11. The input / output I / F 14 transmits data from the processor 11 to outside the program creation support device 3. The user I / F 15 accepts information through operation by a user. The user I / F 15 outputs information to be presented to the user. The user I / F 15 includes an input device such as a keyboard, mouse, keypad, or touch panel, and a display device such as an LCD (Liquid Crystal Display) or an organic EL (Electro-Luminescence) display.

[0020] The control device 2 according to the first embodiment includes a RAM with a low risk of information leakage and a RAM with a higher risk of information leakage than the RAM with a low risk of information leakage. Hereinafter, the former will be referred to as a secure RAM 22, and the latter will be referred to as a non-secure RAM 23. The control device 2 includes a control processor 21, the secure RAM 22, the non-secure RAM 23, a ROM 24, and an input / output I / F 25.

[0021] The control processor 21 is a CPU. The control processor 21 includes a control core that executes a control program. The control core also executes a system program that is executed in conjunction with the execution of the control program. The control core is responsible for processing for controlling the control target device 4. Of the control processor 21, other cores shown in FIG. 1 execute programs other than the program executed by the control core. The other cores are responsible for processing other than the control of the control target device 4.

[0022] The control processor 21 and secure RAM 22 are implemented on a common chip. Inside the chip, there is little risk of information leakage even when information is handled in plain text. Here, the area inside the chip is referred to as the secure area. The control processor 21 and secure RAM 22 are located in the secure area.

[0023] The area of ​​the control device 2 other than the secure area is referred to as the non-secure area. The risk of information leakage in the non-secure area when information is handled in plain text is higher than in the secure area. The non-secure RAM 23 is located in the non-secure area. The non-secure RAM 23 is located outside the chip on which the control processor 21 and the secure RAM 22 are implemented.

[0024] The non-secure RAM 23 functions as a first storage unit capable of storing a control program, and the secure RAM 22 functions as a second storage unit capable of storing a control program and having higher security than the first storage unit.

[0025] The ROM 24 stores the control program transmitted from the programming support device 3 to the control device 2. The ROM 24 stores the system program. The system program is classified into a basic system program and an optional system program. The basic system program is a system program, such as an OS (Operating System) and a control program execution engine, that is required for the computer system to function as the control device 2. It can be said that the basic system program causes the computer system to execute the processing procedures and methods of the control device 2. The optional system program is a system program that is required for providing optional functions to the control device 2.

[0026] The input / output I / F 25 receives data from outside the control device 2 and provides the data to the control processor 21. The input / output I / F 25 transmits data from the control processor 21 to outside the control device 2.

[0027] 2 is a diagram showing an example of the functional configuration of the control device 2 and the program creation support device 3 according to the first embodiment. The expansion processing unit 41 and the program execution unit 42 are functional units included in the control device 2. The expansion processing unit 41 and the program execution unit 42 are realized by the control processor 21 shown in FIG. 1 executing the system program expanded in the secure RAM 22. In FIG. 2, the expansion processing unit 41 and the program execution unit 42 are shown in the secure RAM 22. The expansion method determination unit 31 is a functional unit included in the program creation support device 3. The expansion method determination unit 31 is realized by the processor 11 executing the program creation support program expanded in the RAM 12.

[0028] Control program A, control program B, control program C, control program D, and control program E are control programs created by the program creation support device 3. The program creation support device 3 shown in FIG. 2 schematically shows control programs A to E that are created in the program creation support device 3 and stored in the ROM 13 of the program creation support device 3.

[0029] The deployment method determination unit 31 determines a deployment method for each of the control programs A to E in the control device 2 from among a plurality of deployment methods. The plurality of deployment methods includes a deployment method that uses the secure RAM 22 and a deployment method that uses the non-secure RAM 23. In other words, the deployment method determination unit 31 determines a deployment method for each of the control programs A to E from among a plurality of deployment methods that use the secure RAM 22 or the non-secure RAM 23. In the first embodiment, deployment refers to placing a program in the secure RAM 22 or the non-secure RAM 23 in an executable state.

[0030] Selected system program information is set in the program creation support device 3. The selected system program information is information indicating the items set for the selected system program.

[0031] 3 is a diagram showing an example of selected system program information set in the programming support device 3 according to the first embodiment. A table summarizing the selected system program information is stored in the ROM 13 of the programming support device 3. The selected system program information includes information on each of the items "optional function," "whether or not to use," and "related selected system program."

[0032] "Optional functions" indicate functions that can be added to the control device 2. In the example shown in Fig. 3, an FTP (File Transfer Protocol) server function, an FTP client function, and a web server function are each optional functions that can be added.

[0033] "Use or non-use" indicates whether or not an optional function is to be used. The user selects whether or not to use a preset optional function. The user inputs information indicating whether or not to use each of a plurality of optional functions to the user I / F 15. The information input to the user I / F 15 is written to a table in the ROM 13.

[0034] The "related selection system program" refers to a selection system program that is executed in association with an optional function. Each of a plurality of preset optional functions is linked to a related selection system program.

[0035] Control program information is set in the program creation support device 3. The control program information is information indicating items set for the control program.

[0036] 4 is a diagram showing an example of control program information set in the program creation support device 3 according to the first embodiment. A table summarizing control program information about control programs created using the program creation support device 3 is stored in the ROM 13 of the program creation support device 3. The control program information includes information on the following items: "control program," "type," "execution order," "protection attribute," and "deployment method." The control program information is stored in the table.

[0037] "Control program" indicates the name of the control program. "Type" indicates the type of control program. A repetitive type control program is executed repeatedly in an order predetermined by the user. An event type control program is executed in response to a specific event, such as an external interrupt or an internal interrupt. The example shown in Figure 4 assumes preemption when an event type control program needs to be executed while a repetitive type control program is being executed. In other words, it assumes the operation of interrupting a running repetitive type control program and switching to the execution of an event type control program.

[0038] The "execution order" indicates the order in which each control program is executed. The user inputs information indicating the type of control program and information indicating the order in which each control program is executed to the user I / F 15. The information input to the user I / F 15 is written to a table in the ROM 13.

[0039] The "protection attributes" item includes the items "necessity of protection" and "priority." "Necessity of protection" indicates whether protection is required to prevent leakage to malicious parties. The user selects whether or not to protect each control program. The user inputs information indicating whether or not to protect each control program to the user I / F 15. The information input to the user I / F 15 is written to a table in the ROM 13.

[0040] "Priority" indicates the priority for preventing a deterioration in latency due to the protection of a control program. For control programs for which "protection is required" is set, the user inputs information indicating the priority to user I / F 15. The information input to user I / F 15 is written to a table in ROM 13. Here, it is assumed that a number indicating the priority is input. The smaller the priority number, the higher the priority.

[0041] "Expansion method" indicates the expansion method determined by the expansion method determination unit 31. The first expansion method is a expansion method that uses the secure RAM 22. In the first expansion method, the control program is expanded in the secure RAM 22 in plain text.

[0042] The second expansion method is a method that uses the secure RAM 22 and the non-secure RAM 23. In the second expansion method, an encrypted control program is stored in the non-secure RAM 23 when the control program is not being executed. Then, only immediately before the control program is executed, the encrypted control program stored in the non-secure RAM 23 is transferred to the secure RAM 22, and the control program is decrypted in the secure RAM 22. Furthermore, the decrypted control program is expanded in a temporary expansion area in the secure RAM 22. The temporary expansion area is an area used for temporary expansion of the control program immediately before it is executed.

[0043] The third decompression method is a decompression method that uses the non-secure RAM 23. In the third decompression method, the control program is decompressed in the non-secure RAM 23 in plain text.

[0044] Among the first, second, and third expansion methods, the first expansion method has the highest level of protection. Among the three expansion methods, the third expansion method has the lowest level of protection. The level of protection of the second expansion method is equivalent to that of the first expansion method. The second expansion method requires a greater number of control program transfers than the first expansion method and requires decryption processing, which results in worse control performance than the first expansion method. Control performance is expressed by scan time or response time. Scan time is the period from the start of control program execution to the completion of input / output processing.

[0045] The deployment method determination unit 31 determines the deployment method for each of the control programs A to E from among three methods: a first deployment method, a second deployment method, and a third deployment method. The deployment method determination unit 31 determines the deployment method for each of the control programs A to E before the control programs A to E are written from the program creation support device 3 to the control device 2. Information indicating the determined deployment method for each of the control programs A to E is written to a table in the ROM 13.

[0046] The deployment method determination unit 31 determines the deployment method for each of the control programs A to E based on the information on "need for protection" and "priority." In the example shown in Fig. 4, the deployment method determination unit 31 determines the third deployment method as the deployment method for the control program E, for which "need for protection" is set to unnecessary.

[0047] For control programs for which "need for protection" is set to "need for protection," control programs with higher "priority" are given priority as control programs to which the first deployment method is applied. Furthermore, the deployment method determination unit 31 determines the deployment method for each control program so that the deterioration of control performance falls within the range required by the user. The deployment method determination unit 31 determines whether the deterioration of control performance falls within the required range based on the selected system program information and the control program information.

[0048] The basic system program is encrypted and stored in the ROM 24. The selected system program is encrypted and stored in the ROM 24. The deployment method of the basic system program and the deployment method of the selected system program are predetermined, for example, by the manufacturer of the control device 2. The deployment processing unit 41 deploys the basic system program and the selected system program in accordance with the predetermined deployment method.

[0049] In the example shown in Figure 2, the encrypted basic system program and the encrypted selected system program are sent from ROM 24 to secure RAM 22 and decrypted in secure RAM 22. The decrypted basic system program and the decrypted selected system program are expanded in secure RAM 22. Figure 2 schematically shows the encrypted basic system program and the encrypted selected system program when stored in ROM 24, and the basic system program and the selected system program expanded in secure RAM 22. In Figure 2, dashed arrows indicate the transfer of programs or information.

[0050] The selected system program information and the control program information are stored in the ROM 13 of the programming support device 3. Fig. 2 shows a schematic diagram of the selected system program information and the control program information stored in the programming support device 3. The programming support device 3 transmits the encrypted selected system program information and the encrypted control program information to the control device 2. The control program information is transmitted from the programming support device 3 to the control device 2. Upon receiving the control program information, the deployment method determination unit 31 outputs control program information indicating the deployment method determined by the deployment method determination unit 31 to the control device 2.

[0051] The encrypted selected system program information and encrypted control program information are stored in the ROM 24 of the control device 2. The encrypted selected system program information and encrypted control program information are transferred from the ROM 24 to the secure RAM 22 and decrypted in the secure RAM 22. Figure 2 schematically shows the encrypted selected system program information and encrypted control program information when stored in the ROM 24, and the selected system program information and control program information decrypted in the secure RAM 22.

[0052] The control programs A to E are stored in the ROM 13 of the program creation support device 3. FIG. 2 schematically shows the control programs A to E stored in the program creation support device 3. The program creation support device 3 transmits the encrypted control programs A to E to the control device 2. The encrypted control programs A to E are stored in ROM 24. FIG. 2 schematically shows the encrypted control programs A to E when stored in ROM 24. Note that the control program E for which "need for protection" is set to unnecessary may be transmitted in plain text to the control device 2 and stored in plain text in ROM 24.

[0053] The expansion processing unit 41 expands each of the control programs A to E in accordance with the expansion method indicated in the control program information in the secure RAM 22. The expansion processing unit 41 transfers the encrypted control programs A and D to the secure RAM 22 in accordance with the first expansion method, which is the "expansion method" of the control programs A and D. The expansion processing unit 41 decrypts the control programs A and D in the secure RAM 22. The expansion processing unit 41 expands the control programs A and D, which have been decrypted into plain text, in the secure RAM 22. FIG. 2 schematically shows the control programs A and D expanded in the secure RAM 22.

[0054] The decompression processing unit 41 transfers the encrypted control programs B and C to the non-secure RAM 23 in accordance with the second decompression method, which is the "decompression method" for the control programs B and C. The encrypted control program B is transferred to the non-secure RAM 23 when the control program B is not being executed and is held in the non-secure RAM 23. The encrypted control program C is transferred to the non-secure RAM 23 when the control program C is not being executed and is held in the non-secure RAM 23. FIG. 2 schematically shows the control programs B and C when held in the non-secure RAM 23.

[0055] Immediately before control program B is executed, the expansion processing unit 41 transfers the encrypted control program B stored in the non-secure RAM 23 to the secure RAM 22. The expansion processing unit 41 decrypts the control program B in the secure RAM 22. The expansion processing unit 41 expands the control program B, which has been decrypted into plain text, in a temporary expansion area. Immediately before control program C is executed, the expansion processing unit 41 transfers the encrypted control program C, which has been stored in the non-secure RAM 23, to the secure RAM 22. The expansion processing unit 41 decrypts the control program C in the secure RAM 22. The expansion processing unit 41 expands the control program C, which has been decrypted into plain text, in a temporary expansion area.

[0056] The decompression processing unit 41 transfers the encrypted control program E to the non-secure RAM 23 in accordance with the third decompression method, which is the "decompression method" of the control program E. The decompression processing unit 41 decrypts the control program E in the non-secure RAM 23. The decompression processing unit 41 decompresses the control program E, which has been decrypted into plain text, into the non-secure RAM 23. FIG. 2 schematically shows the control program E decompressed into the non-secure RAM 23. Note that if the control program E in plain text is stored in the ROM 24, the control program E in plain text is transferred to the non-secure RAM 23, and the control program E in plain text is decompressed into the non-secure RAM 23.

[0057] The program execution unit 42 executes the control programs A to D loaded in the secure RAM 22 and the control program E loaded in the non-secure RAM 23.

[0058] Next, a description will be given of the operation of the expansion method determination unit 31 included in the program creation support device 3. Fig. 5 is a flowchart showing an example of the operation procedure of the expansion method determination unit 31 included in the program creation support device 3 according to the first embodiment.

[0059] In step S1, the deployment method determination unit 31 requests the user to set whether or not to use optional functions, whether or not to protect each control program, and the priority of each control program. The deployment method determination unit 31 presents information about the request to the user via the user I / F 15. In response to the presented request, the user inputs information indicating whether or not to use optional functions, information indicating whether or not to protect each control program, and information indicating the priority of each control program to the program creation support device 3 using the user I / F 15.

[0060] In step S2, the deployment method determination unit 31 determines a deployment method for each control program based on the control program information. For control programs for which "need for protection" is set to "need for protection," the deployment method determination unit 31 determines the first deployment method or the second deployment method. For control programs for which "need for protection" is set to "not need for protection," the deployment method determination unit 31 determines the third deployment method.

[0061] Here, the determination of the deployment method for a control program for which "protection is required" is set will be described. When the total deployment size of the control program for which the deployment method is determined to be the first deployment method is equal to or larger than the maximum value S max The expansion method is determined under the constraint that the expansion size must not exceed the maximum value S. The expansion size is the size of the area in the secure RAM 22 used to expand the control program in plain text. max is the size S of the maximum area in the secure RAM 22 that can be used to expand the control program. A and the size of the area used to expand the basic system programs, S B In the first embodiment, S max ≦S A -S B holds true.

[0062] The method for determining the deployment method for a control program for which "need for protection" is set to "need for protection" may be any method. The deployment method determination unit 31 determines the deployment method for a control program for which "need for protection" is set to "need for protection" by, for example, the method described below.

[0063] For optional functions whose "Used" field is set to "Yes" in the selected system program information, the deployment method determination unit 31 calculates the total area size s required to deploy the related selected system programs in the secure RAM 22. The initial value of the total s is zero.

[0064] Next, the deployment method determination unit 31 selects the control program with the smallest "priority" number in the control program information, and determines whether the following formula (1) is true for the selected control program. trgt is the size of the area required to develop the selected control program in the secure RAM 22. s+s trgt max ···(1)

[0065] If the formula (1) is satisfied, the deployment method determination unit 31 determines the deployment method of the selected control program to be the first deployment method. trgt The deployment method determination unit 31 updates the total s by adding the formula (1) to the total s. The deployment method determination unit 31 repeats the determination of whether or not formula (1) holds and the updating of the total s, starting with the control program with the smallest "priority" number. Then, when formula (1) does not hold, the deployment method determination unit 31 determines the deployment method of the selected control program to be the second deployment method. After determining the deployment method for each control program, the deployment method determination unit 31 proceeds to step S3.

[0066] In step S3, the deployment method determination unit 31 calculates an estimate of the control performance. The method for calculating the estimate of the control performance is arbitrary. In the first embodiment, the control performance of a repetitive type control program is represented by a scan time. Furthermore, the control performance of an event type control program is represented by a response time.

[0067] The deployment method determination unit 31 determines the estimated value D of the scan time for a repetitive control program, for example, by the following equation (2): scan Calculate d scan0 is an estimate of the sum of the processing time of each iterative control program and other processing times. Other processing times are the time required for input / output processing and other processes. trans _ dec _ scan ​is an estimated value of the total time required for each control program for which the second decompression method has been determined to be used, from the time it is transferred from the non-secure RAM 23 to the secure RAM 22 until decryption is completed. D scan =d scan0 +d trans _ dec _ scan ···(2)

[0068] The deployment method determination unit 31 determines the response time estimate D for the event-type control program, for example, by the following equation (3): ev Calculate d ev0 Let d be the estimated response time for the event. trans _ dec _ ev is an estimated value of the total time required for each control program for which the second decompression method has been determined to be used, from the time it is transferred from the non-secure RAM 23 to the secure RAM 22 until decryption is completed. D ev =d ev0 +d trans _ dec _ ev ···(3)

[0069] Note that the method for calculating the estimated scan time and the estimated response time may be any method. The expansion method determination unit 31 may use, as the estimated scan time or the estimated response time, a value calculated using calculation parameters preset in the program creation support device 3. The expansion method determination unit 31 may also use, as the estimated scan time or the estimated response time, a value measured in advance on an actual device.

[0070] In step S4, the expansion method determination unit 31 presents the estimated value calculated in step S3 to the user and asks the user to determine whether the estimated value falls within the required range. The expansion method determination unit 31 presents the estimated value to the user via the user I / F 15. The user determines whether the presented estimated value falls within the required range. The user inputs information indicating whether the presented estimated value falls within the required range to the program creation support device 3 via the user I / F 15.

[0071] In step S5, the expansion method determination unit 31 determines whether it is determined that the estimated value is included in the requested range. If it is determined that the estimated value is included in the requested range (step S5, Yes), in step S6, the expansion method determination unit 31 encrypts each control program, the selected system program information, and the control program information.

[0072] In step S7, the development method determination unit 31 stores the encrypted control programs, the encrypted selected system program information, and the encrypted control program information in the ROM 24 of the control device 2.

[0073] In step S6, the decompression method determination unit 31 may not encrypt the control program for which the "need for protection" is set to "unnecessary," but may leave the control program in plain text. In this case, the decompression method determination unit 31 stores the control program in plain text in the ROM 24 of the control device 2.

[0074] If it is determined that the estimated value is not included in the required range (No in step S5), in step S8, the expansion method determination unit 31 presents an improvement plan for the control performance to the user. The expansion method determination unit 31 creates the improvement plan. The expansion method determination unit 31 presents information indicating the content of the improvement plan to the user via the user I / F 15.

[0075] For example, the unfolding method determination unit 31 determines the estimated scan time D scan and response time estimate D evIn order to reduce both of these, we propose changing the "usage" setting for optional functions that are set as "usage" in the selected system program information to "not in use." By reducing the number of optional functions used, the number of selected system programs to be executed can be reduced. By reducing the number of selected system programs to be executed, the number of control programs whose deployment method is set to the second deployment method can be increased. This reduces the estimated scan time D scan or response time estimate D ev A reduction in costs can be expected.

[0076] In addition, when the setting of "Use or Not" cannot be changed, the deployment method determination unit 31 determines the estimated value D of the scan time. scan and response time estimate D ev To reduce one of the above, it may be possible to propose a change in the "priority" in the control program information. For example, the estimated response time D ev In order to reduce the scan time, the deployment method determination unit 31 proposes that the "priority" of the event-type control program be set higher than the "priority" of the repeat-type control program. By setting the "priority" of the event-type control program higher than the "priority" of the repeat-type control program, the estimated scan time D scan Of the d trans _ dec _ scan increases. d trans _ dec _ scan The trade-off with increasing ev Our d trans _ dec _ ev It should be noted that the method for creating an improvement plan by the expansion method determination unit 31 is not limited to the above method and may be any method.

[0077] With the above, the expansion method determination unit 31 completes the operation according to the procedure shown in Fig. 5. Note that, in the above, in step S4, the user determines whether or not the estimated value is included in the requested range, but the expansion method determination unit 31 may determine whether or not the estimated value is included in the requested range. In this case, the requested range is set in the expansion method determination unit 31. The expansion method determination unit 31 determines whether or not the estimated value is included in the requested range by comparing the set range with the estimated value.

[0078] Next, a description will be given of the operation of the expansion processing unit 41 included in the control device 2. Fig. 6 is a flowchart showing an example of the operation procedure of the expansion processing unit 41 included in the control device 2 according to embodiment 1. Here, the operation of the expansion processing unit 41 when the control device 2 is booted will be described.

[0079] In step S11, the expansion processing unit 41 expands the basic system program into the secure RAM 22 or the non-secure RAM 23. The expansion processing unit 41 reads the basic system program from the ROM 24. The expansion processing unit 41 expands the basic system program into the secure RAM 22 or the non-secure RAM 23 according to a expansion method predetermined by the manufacturer.

[0080] In step S12, the expansion processing unit 41 expands the selected system program into the secure RAM 22 or the non-secure RAM 23. The expansion processing unit 41 reads the selected system program from the ROM 24. The expansion processing unit 41 expands the selected system program into the secure RAM 22 or the non-secure RAM 23 in accordance with a expansion method predetermined by the manufacturer.

[0081] In step S13, the expansion processing unit 41 expands each control program into the secure RAM 22 or the non-secure RAM 23. The expansion processing unit 41 expands each control program using the expansion method indicated in the "Expansion method" field of the control program information.

[0082] For a control program for which the first decompression method is set, the decompression processing unit 41 decrypts the encrypted control program transferred from the ROM 24 and decompresses the control program in plain text into the secure RAM 22.

[0083] For a control program for which the second extraction method is set, the extraction processing unit 41 stores the encrypted control program in the non-secure RAM 23. The extraction processing unit 41 stores the encrypted control program transferred from the ROM 24 in the non-secure RAM 23. Before executing the control program, the extraction processing unit 41 transfers the encrypted control program to the secure RAM 22. The extraction processing unit 41 decrypts the encrypted control program transferred to the secure RAM 22, and extracts the control program in plain text into a temporary extraction area in the secure RAM 22.

[0084] For a control program for which the third decompression method is set, the decompression processing unit 41 decrypts the encrypted control program and decompresses the control program in plain text into the non-secure RAM 23. Alternatively, for a control program for which the third decompression method is set and which is stored in plain text in the ROM 24, the decompression processing unit 41 decompresses the plain text control program transferred from the ROM 24 into the non-secure RAM 23. With the above, the decompression processing unit 41 completes the operation according to the procedure shown in FIG.

[0085] Next, the operation of the expansion processing unit 41 and the program execution unit 42 when the control device 2 executes a control program will be described. FIG. 7 is a flowchart showing an example of the operation procedure of the expansion processing unit 41 and the program execution unit 42 when the control device 2 according to the first embodiment executes a control program. Here, an example of the operation when executing a repetitive control program, i.e., when executing repetitive processing, will be described. The operation described here is executed every time a program switch of the control processor 21 is performed. It is assumed that the program switch includes input / output processing. Hereinafter, input / output processing will be referred to as "I / O processing."

[0086] In step S21, the program execution unit 42 determines whether or not there is any control program whose execution has not been completed among all the control programs in the repetitive process. The program execution unit 42 determines whether or not there is any control program whose execution has not been completed among the repetitive type control programs. If there is any control program whose execution has not been completed (step S21, Yes), the program execution unit 42 proceeds to step S22. If there is no control program whose execution has not been completed (step S21, No), the program execution unit 42 proceeds to step S27.

[0087] In step S22, the program execution unit 42 determines whether the deployment method of the control program to be executed next is the second deployment method. The control program to be executed next is the control program to be executed next after the control program that has currently completed its execution. The program execution unit 42 identifies the control program to be executed next based on the "execution order" of the control program information. For the identified control program, the program execution unit 42 determines whether the deployment method of the control program is the second deployment method by referring to the deployment method indicated in the control program information.

[0088] If the expansion method for the control program to be executed next is the second expansion method (Yes in step S22), in step S23, the expansion processing unit 41 transfers the encrypted control program from the non-secure RAM 23 to the secure RAM 22. The expansion processing unit 41 transfers the encrypted control program stored in the non-secure RAM 23 to the secure RAM 22.

[0089] In step S24, the decompression processing unit 41 decrypts the control program transferred to the secure RAM 22. The decompression processing unit 41 decompresses the control program in plain text into the secure RAM 22. In step S25, the decompression processing unit 41 executes the control program decompressed in step S24.

[0090] If the expansion method of the control program to be executed next is not the second expansion method (No in step S22), in step S26, the program execution unit 42 executes the control program expanded according to the procedure shown in Fig. 6. The program execution unit 42 executes the control program expanded in the secure RAM 22 according to the first expansion method. Alternatively, the program execution unit 42 executes the control program expanded in the non-secure RAM 23 according to the third expansion method.

[0091] In step S27, the program execution unit 42 executes the I / O process. With the above, the expansion processing unit 41 and the program execution unit 42 complete the operations according to the procedure shown in FIG.

[0092] When executing an event-type control program, the unpacking processing unit 41 and the program executing unit 42 perform operations in the same procedure as steps S22 to S26 when an event occurs.

[0093] A second deployment method may be defined as the deployment method for the system program. In this case, the control device 2 transfers, decrypts, and deploys the system program in the same way as in the case of a control program for which the second deployment method is set.

[0094] FIG. 8 is a diagram for explaining the transition of operation of the control processor 21 included in the control device 2 according to the first embodiment. In FIG. 8, time passes from left to right. Here, the transition of operation when control programs A to C, which are repetitive control programs, are executed will be explained. For example, in FIG. 8, the rectangle marked "Control Program A" represents the period during which control program A is executed. The rectangle marked "Control Program B Transfer / Decode" represents the period during which control program B is transferred and control program B is decoded.

[0095] Control program A is deployed using a first deployment method. At the start of the operation shown in Fig. 8, control program A is deployed in secure RAM 22. Control programs B and C are deployed using a second deployment method. At the start of the operation shown in Fig. 8, control programs B and C are encrypted and stored in non-secure RAM 23.

[0096] The control processor 21 executes the control programs A to C in the order indicated in the "execution order" of the control program information. After executing the control program A, the control processor 21 transfers and decodes the control program B, and then executes the control program B. After executing the control program B, the control processor 21 transfers and decodes the control program C, and then executes the control program C. After executing the control program C, the control processor 21 executes the I / O processing. The period from when the execution of the control program A starts until the I / O processing is completed corresponds to the scan time. The control processor 21 repeatedly executes the control programs A to C and the I / O processing.

[0097] In the above description, the control device 2 deploys each control program using a deployment method designated from among three deployment methods. The deployment methods that can be designated for deploying each control program are not limited to three, and any multiple methods may be used. The deployment method determination unit 31 is not limited to determining the deployment method for each control program from among three deployment methods. The deployment method determination unit 31 may determine the deployment method for each control program from among multiple deployment methods.

[0098] According to the first embodiment, the control device 2 includes a first storage unit capable of storing a control program, a second storage unit capable of storing a control program and having higher security than the first storage unit, a deployment processing unit 41 that deploys the control program using a deployment method selected from a plurality of deployment methods using the first storage unit or the second storage unit, and a program execution unit 42 that executes the deployed control program. When the data size of a control program to be protected exceeds the size of the area in the second storage unit, the control device 2 can protect the control program by selecting the deployment method using the first storage unit. By selecting the deployment method for the control program from a plurality of deployment methods, it is possible to reduce deterioration in the control performance of the control device due to protection of the control program. This allows the control device 2 to protect the control program and reduce deterioration in the control performance of the control device 2.

[0099] The multiple deployment methods may include a first deployment method for deploying the control program in a second storage unit, a second deployment method for storing the encrypted control program in the first storage unit except when the control program is being executed, and for transferring the encrypted control program stored in the first storage unit to the second storage unit and deploying the decrypted control program in the second storage unit when the control program is being executed, and a third deployment method for deploying the control program in the first storage unit. The control device 2 can protect a control program that requires protection by using the first deployment method or the second deployment method.

[0100] According to the first embodiment, the programming support device 3 determines a control program deployment method from among a plurality of deployment methods, and outputs information indicating the determined deployment method to the control device 2. The programming support device 3 may request the setting of protection attributes, including whether or not the control program needs to be protected, and determine a control program deployment method based on the set protection attributes. This enables the programming support device 3 to protect control programs that require protection.

[0101] The program creation support device 3 may request the setting of a protection attribute including a priority for preventing a deterioration in latency due to the protection of the control program. This allows the program creation support device 3 to protect a control program with a high priority while suppressing a deterioration in latency.

[0102] The program creation support device 3 may estimate the control performance of the control device 2 when the control program is executed, and if it determines that the estimated value indicating the estimated control performance is not within a required range, may present an improvement plan that enables improvement of the control performance. In this way, the program creation support device 3 can protect the control program while keeping the control performance of the control device 2 within the required range.

[0103] Embodiment 2 In the second embodiment, an example will be described in which transfer and decoding in the second decompression method are performed in parallel with the execution of the control program. In the second embodiment, the same components as those in the first embodiment are given the same reference numerals, and the description will mainly focus on the configuration that is different from the first embodiment.

[0104] Fig. 9 is a diagram showing an example of the configuration of a control device 2A according to embodiment 2. The control device 2A has the same configuration as the control device 2 shown in Fig. 1. Furthermore, the control device 2A includes a transfer processor 26 and a decryption processor 27. The transfer processor 26 and the decryption processor 27 are located in a secure area.

[0105] The functional configuration of the control device 2A is the same as the functional configuration of the control device 2 shown in Fig. 2. The expansion processing unit 41 of the control device 2A transfers and decodes one of the plurality of control programs in parallel with the execution of one of the plurality of control programs by the program execution unit 42. The function of transferring the control program is realized by using the transfer processor 26. The function of decrypting the control program is realized by using the decryption processor 27. The configuration of the program creation support device 3 according to the second embodiment is the same as the configuration of the program creation support device 3 shown in Figs. 1 and 2.

[0106] 10 is a flowchart showing an example of the operation procedure of the expansion processing unit 41 and the program execution unit 42 when the control device 2A according to the second embodiment executes a control program. Here, an example of the operation when a repetitive control program is executed, i.e., when repetitive processing is executed, is described. The operation described here is executed every time the program of the control processor 21 is switched.

[0107] In step S31, the program execution unit 42 determines whether the deployment method of the control program to be executed next is the second deployment method. The control program to be executed next is the control program to be executed next after the control program that last completed execution at the current time. The program execution unit 42 identifies the control program to be executed next based on the "execution order" of the control program information. For the identified control program, the program execution unit 42 determines whether the deployment method of the control program is the second deployment method by referring to the deployment method indicated in the control program information.

[0108] If the deployment method of the control program to be executed next is the second deployment method (step S31, Yes), in step S32, the program execution unit 42 instructs the deployment processing unit 41 to start transfer and decryption. The deployment processing unit 41 starts transferring and decrypting the control program to be executed next in accordance with the instruction. The deployment processing unit 41 transfers the encrypted control program from the non-secure RAM 23 to the secure RAM 22. The deployment processing unit 41 decrypts the control program transferred to the secure RAM 22. If the deployment method of the control program to be executed next is not the second deployment method (step S31, No), the program execution unit 42 skips step S32.

[0109] Steps S33 and S34 are the same as steps S21 and S22 shown in Fig. 7. If there is any control program whose execution has not been completed among all the control programs in the repetitive processing (Yes in step S33), the program execution unit 42 proceeds to step S34. If there is no control program whose execution has not been completed among all the control programs in the repetitive processing (No in step S33), the program execution unit 42 proceeds to step S38.

[0110] If the expansion method for the control program to be executed next is the second expansion method (Yes in step S34), in step S35 the program execution unit 42 waits until the transfer and decryption started by the instruction in step S32 are completed. When the decryption is completed, the expansion processing unit 41 expands the control program in plain text into the secure RAM 22. In step S36, the program execution unit 42 executes the expanded control program.

[0111] If the expansion method of the control program to be executed next is not the second expansion method (No in step S34), the program execution unit 42 proceeds to step S37. Steps S37 and S38 are the same as steps S26 and S27 shown in Fig. 7. As a result, the expansion processing unit 41 and the program execution unit 42 end the operation according to the procedure shown in Fig. 10.

[0112] When an event-type control program is executed, it is difficult to predict when an event will occur. The expansion processing unit 41 and the program execution unit 42 execute the event-type control program in the same manner as in the first embodiment, without using the transfer processor 26 and the decode processor 27.

[0113] The operation of the unfolding method determination unit 31 in the second embodiment is the same as that in the first embodiment. However, the estimated value D scan When calculating d trans _ dec _ scan is a value that takes into consideration that the transfer by the transfer processor 26 and the decoding by the decoding processor 27 are performed in parallel with the execution of the control program.

[0114] Fig. 11 is a diagram for explaining the transition of operations of the control processor 21, the transfer processor 26, and the decoding processor 27 of the control device 2A according to the second embodiment. In Fig. 11, time passes from left to right. Here, the transition of operations when control programs A to C, which are repetitive control programs, are executed will be explained.

[0115] The control processor 21 executes the control programs A to C in the order indicated in the "execution order" of the control program information. The transfer processor 26 and the decoding processor 27 transfer and decode the control program B in parallel with the execution of the control program A by the control processor 21. After the transfer and decoding of the control program B is completed, the control processor 21 executes the control program B. The transfer processor 26 and the decoding processor 27 transfer and decode the control program C in parallel with the execution of the control program B by the control processor 21.

[0116] 11, it is assumed that the transfer and decoding of control program C is completed before the execution of control program B is completed. After the execution of control program B is completed, control processor 21 starts the execution of control program C. After executing control program C, control processor 21 executes I / O processing.

[0117] According to the second embodiment, the expansion processing unit 41 transfers and decodes one of the control programs in parallel with the execution of one of the control programs by the program execution unit 42. This enables the control device 2 to reduce the scan time for executing the control program and reduce deterioration of the control performance of the control device 2.

[0118] Embodiment 3 In the third embodiment, an example of proposing a change in the order in which control programs are executed will be described. In the third embodiment, the same components as those in the first or second embodiment will be assigned the same reference numerals, and the configuration different from the first or second embodiment will be mainly described.

[0119] The control device 2A according to the third embodiment has the same configuration as the control device 2A shown in Fig. 9. The functional configuration of the control device 2A is the same as the functional configuration of the control device 2 shown in Fig. 2. The configuration of the program creation support device 3 according to the third embodiment is the same as the configuration of the program creation support device 3 shown in Figs. 1 and 2.

[0120] In embodiment 3, when the deployment method determination unit 31 determines that the control performance of the control device 2 will be improved by executing multiple control programs in a different order than specified by the user, the deployment method determination unit 31 suggests to the user that the order in which the multiple control programs are executed be changed.

[0121] The deployment method determination unit 31 operates in a manner similar to that shown in Fig. 5. When creating a proposal for improving control performance, the deployment method determination unit 31 searches for an execution order of multiple control programs that is expected to increase the parallelism of processes executed by the control device 2. Here, it is assumed that the search by the deployment method determination unit 31 results in an order that is different from the order indicated in the "execution order" of the control program information. In this case, the deployment method determination unit 31 suggests to the user that the order in which the multiple control programs are executed be changed from the order specified by the user to the order derived by the deployment method determination unit 31.

[0122] For example, in step S8 shown in Fig. 5, the deployment method determination unit 31 presents to the user an improvement plan including a proposal for changing the execution order of the plurality of control programs. The user can refer to the improvement plan and reset the execution order of the plurality of control programs. Note that the deployment method determination unit 31 may present to the user an improvement plan for the execution order separately from the presentation of the improvement plan in step S8.

[0123] Fig. 12 is a diagram for explaining an example in which the execution order of multiple control programs is changed in the third embodiment. Fig. 12 shows an example of control program information in which the "execution order" has been changed. Here, the execution order shown in the control program information shown in Fig. 4 is the execution order before the change. In the execution order after the change, control program B and control program C have been swapped in the execution order before the change.

[0124] Fig. 13 is a diagram for explaining the transition of operations of the control processor 21, the transfer processor 26, and the decode processor 27 when the execution order of multiple control programs is changed in the third embodiment. Fig. 13 shows the transition of operations of the control processor 21, the transfer processor 26, and the decode processor 27 when the execution order of multiple control programs is changed as shown in Fig. 12. In Fig. 13, time passes from left to right. Fig. 13 shows the transition of operations after the execution order is changed. Also, the transition of operations shown in Fig. 11 is the transition of operations before the execution order is changed.

[0125] As shown in Fig. 11, the execution order before the change is control program A, control program B, and control program C. In contrast, as shown in Fig. 13, the execution order after the change is control program A, control program C, and control program B. By changing the execution order in this way, the scan time in the case shown in Fig. 13 is reduced compared to the scan time in the case shown in Fig. 11. The expansion method determination unit 31 searches for an execution order that enables the scan time to be reduced in this way.

[0126] According to the third embodiment, when the programming support device 3 determines that changing the order specified by the user to execute multiple control programs will improve the control performance of the control device 2, the programming support device 3 presents an improvement plan including a proposal for changing the order. This allows the programming support device 3 to prompt the user to make settings to improve the control performance of the control device 2.

[0127] The configurations shown in the above embodiments are examples of the contents of the present disclosure. The configurations of each embodiment can be combined with other known technologies. The configurations of each embodiment can also be combined as appropriate. Part of the configuration of each embodiment can be omitted or modified without departing from the gist of the present disclosure. [Explanation of symbols]

[0128] 1 control system, 2, 2A control device, 3 program creation support device, 4 controlled device, 11 processor, 12 RAM, 13, 24 ROM, 14, 25 input / output I / F, 15 user I / F, 21 control processor, 22 secure RAM, 23 non-secure RAM, 26 transfer processor, 27 decryption processor, 31 expansion method determination unit, 41 expansion processing unit, 42 program execution unit.

Claims

1. A control device that controls a control target device by executing a control program, a first storage unit capable of storing the control program; a second storage unit capable of storing the control program and having higher security than the first storage unit; a deployment processing unit that deploys the control program using a deployment method selected from a plurality of deployment methods that use the first storage unit or the second storage unit; a program execution unit that executes the expanded control program. A control device characterized by:

2. The plurality of deployment methods include: a first deployment method for deploying the control program in the second storage unit; a second deployment method in which the encrypted control program is stored in the first storage unit except when the control program is being executed, and the encrypted control program stored in the first storage unit is transferred to the second storage unit when the control program is being executed, and the decrypted control program is deployed in the second storage unit; a third deployment method for deploying the control program in the first storage unit.

2. The control device according to claim 1.

3. The decompression processing unit transfers and decodes another one of the plurality of control programs in parallel with the execution of one of the plurality of control programs by the program execution unit.

3. The control device according to claim 1 or 2.

4. A program creation support program for supporting creation of a control program to be executed by a control device that controls a control target device, determining a method for deploying the control program from among a plurality of deployment methods using a first storage unit of the control device that can store the control program, or a second storage unit of the control device that can store the control program and has higher security than the first storage unit; and outputting information indicating the determined deployment method to the control device. A program creation support program characterized by:

5. causing the computer system to execute a step of requesting the setting of a protection attribute including whether or not the control program needs to be protected; In the step of determining the deployment method of the control program, the deployment method is determined based on the protection attribute that has been set.

5. The program creation support program according to claim 4.

6. The step of requesting the setting of the protection attribute includes requesting the setting of the protection attribute including a priority for preventing a deterioration in latency due to the protection of the control program.

6. The program creation support program according to claim 5.

7. a step of estimating the control performance of the control device when the control program is executed; and when it is determined that the estimated value indicating the estimation result of the control performance is not included in a required range, presenting an improvement plan that enables improvement of the control performance.

7. The program creation support program according to claim 5 or 6.

8. In the step of presenting the improvement plan, when it is determined that the control performance of the control device will be improved by changing the order specified by the user and executing the plurality of control programs, the improvement plan including a proposal for changing the order is presented.

8. The program creation support program according to claim 7.

9. a control device that controls a control target device by executing a control program; a program creation support device that supports creation of the control program, The control device a storage unit including a first storage unit capable of storing the control program and a second storage unit capable of storing the control program and having higher security than the first storage unit; a deployment processing unit that deploys the control program in the storage unit; a program execution unit that executes the expanded control program, The program creation support device a deployment method determination unit that determines a deployment method for the control program by the deployment processing unit from among a plurality of deployment methods that use the first storage unit or the second storage unit; The deployment processing unit deploys the control program using the determined deployment method. A control system comprising:

10. A control method for controlling a control target device by a control system including a control device that controls the control target device by executing a control program, and a program creation support device that supports creation of the control program, comprising: determining a method for deploying the control program from among a plurality of deployment methods using a first storage unit capable of storing the control program or a second storage unit capable of storing the control program and having higher security than the first storage unit; deploying the control program according to the determined deployment method; and executing the deployed control program. A control method comprising:

Images