Control device, control method, and computer program

Abstract

This control device comprises a state transition data acquisition unit and a zone determination unit. The state transition data acquisition unit acquires state transition data that indicates a transition between states which can be taken by a system that has a plurality of devices and that executes a plurality of steps. The plurality of steps include a plurality of steps having redundancy. The zone determination unit divides the plurality of steps having redundancy into different zones on the basis of the state transition data and determines a zone to which each of the plurality of devices belongs in the plurality of steps.

Description

Control device, control method, and computer program

[0001] This application claims priority to Japanese Patent Application No. 2024-047851, filed March 25, 2024, and incorporates by reference all of the contents of that application.

[0002] It is described that the relationships between multiple elements are represented by a directed graph, called an ISM structure chart (see Non-Patent Document 1). Industrial control systems, such as production systems and logistics systems, are designed with safety as a priority. However, cyberattacks targeting control systems have recently been increasing rapidly. The establishment of ISA / IEC 62443 introduced the concepts of zones and conduits for fieldbuses and other systems, allowing devices and networks to be divided by security level. ISA / IEC 62443 generally defines a zone as "a grouping of logical or physical assets based on risk or other evaluation criteria (criticality, operational function, physical or logical location, access requirements, and management organization)," and refers to security zones divided based on security considerations simply as zones.

[0003] Takahiro Sato, "ISM Structural Learning Method" pp. 48-52 (7) Hierarchical Directed Graph Creation Algorithm, Meiji Tosho, 1987

[0004] A control device according to one aspect of the present disclosure includes a state transition data acquisition unit and a zone determination unit, wherein the state transition data acquisition unit acquires state transition data indicating transitions between states that can be taken by a system having multiple devices and executing multiple processes, the multiple processes including multiple processes having redundancy, and the zone determination unit divides the multiple processes having redundancy into different zones based on the state transition data and determines the zone to which each of the multiple devices belongs in the multiple processes.

[0005] The present disclosure can be embodied as a control device including such a characteristic processing unit. The present disclosure can be embodied as a control method including such characteristic processing as steps. The present disclosure can be embodied as a computer program for causing a computer to execute such steps. The present disclosure can be embodied as a semiconductor integrated circuit including part or all of the control device. The present disclosure can be embodied as a system including the control device.

[0006] FIG. 1 is a diagram illustrating an example of the overall configuration of a control system according to an embodiment of the present disclosure. FIG. 2 is a diagram illustrating an example of a detailed configuration of the control system illustrated in FIG. 1. FIG. 3 is a diagram illustrating an example of the configuration of a control system including a detailed configuration of an assembly processing line. FIG. 4 is a flowchart illustrating the procedure of processing work in the assembly processing line illustrated in FIG. 3. FIG. 5 is a timing chart illustrating the procedure of processing work in the assembly processing line illustrated in FIG. 3. FIG. 6 is a flowchart illustrating an example of the procedure of a zone division method. FIG. 7 is a diagram for explaining work breakdown and process analysis. FIG. 8 is a diagram illustrating an example of a state transition table for the assembly processing line illustrated in FIG. 3. FIG. 9 is a diagram illustrating an example of a contracted state transition table for the assembly processing line illustrated in FIG. 3. FIG. 10 is a diagram illustrating an example of a directed graph of the state transition table for the assembly processing line illustrated in FIG. 3. FIG. 11 is a diagram illustrating an example of a status table for the assembly processing line and HMI (Human Machine Interface) illustrated in FIG. 3. FIG. 12 is a diagram illustrating an example of a contracted status table for the assembly processing line and HMI illustrated in FIG. 3. FIG. 13 is a diagram illustrating an example of a directed graph of the status table for the assembly processing line and HMI illustrated in FIG. 3. FIG. 14 is a diagram for explaining the risk table creation process. FIG. 15 is a diagram showing an example of a risk table for the assembly processing line and HMI shown in FIG. 3. FIG. 16 is a diagram showing an example of a binarized risk table for the assembly processing line and HMI shown in FIG. 3. FIG. 17 is a diagram showing an example of a condensed risk table for the assembly processing line and HMI shown in FIG. 3. FIG. 18 is a diagram showing an example of a directed graph of the risk table for the assembly processing line and HMI shown in FIG. 3. FIG. 19 is a diagram showing an example of the configuration of a control system including a detailed configuration of the assembly processing line shown in FIG. 3. FIG. 20 is a diagram showing an example of a zone definition table for the assembly processing line and HMI shown in FIG. 3. FIG. 21 is a diagram for explaining the security levels of the assembly processing line and HMI shown in FIG. 3. FIG. 22 is a diagram showing an example of a tagout display. FIG. 23 is a diagram showing an example of the configuration of a control system including a detailed configuration of the assembly processing line shown in FIG. 3. FIG. 24 is a diagram showing an example of the configuration of a field monitoring device.

[0007] [Problem to be Solved by the Present Disclosure] A control system has multiple operation modes (processes) such as startup, load change, shutdown, and maintenance, and the operating state and operating situation change from moment to moment. For this reason, it is necessary to dynamically set zones according to the operating state or operating situation.

[0008] The present disclosure has been made in view of the above circumstances, and aims to provide a control device, a control method, and a computer program that can dynamically divide devices into zones.

[0009] [Advantages of the Present Disclosure] According to the present disclosure, devices can be dynamically divided into zones.

[0010] [Outline of Embodiments of the Present Disclosure] First, an outline of an embodiment of the present disclosure will be listed and described. (1) A control device according to one embodiment of the present disclosure includes a state transition data acquisition unit and a zone determination unit, wherein the state transition data acquisition unit acquires state transition data indicating transitions between states that can be taken by a system having a plurality of devices and executing a plurality of processes, the plurality of processes including a plurality of processes having redundancy, and the zone determination unit divides the plurality of processes having redundancy into different zones based on the state transition data and determines a zone to which each of the plurality of devices belongs in the plurality of processes.

[0011] Multiple processes with redundancy are important from a security perspective. In the above configuration, devices that perform multiple processes with redundancy are divided into different zones depending on the process. Because multiple processes with redundancy require a certain amount of time to complete, at least some of them are executed in parallel to improve work efficiency. This allows devices that perform processes corresponding to each zone to be classified into the same zone, enabling dynamic zone division of devices.

[0012] (2) In the above (1), the zone determination unit may determine a plurality of processes that are not causally related to each other as the plurality of processes having redundancy by condensing the state transition data.

[0013] According to this configuration, by using a structuring method such as the Interpretive Structure Modeling (IMS) method, it is possible to determine a plurality of processes that have no causal relationship as a plurality of processes that have redundancy.

[0014] (3) In the above (1), the zone determination unit may determine a plurality of processes having strong connectivity as the plurality of processes having redundancy by contracting the state transition data.

[0015] According to this configuration, by using a structuring method such as the IMS method, a plurality of processes having strong connectivity can be easily determined as a plurality of processes having redundancy.

[0016] (4) In any of (1) to (3) above, the system may further have a plurality of instruments, and the control device may further include a situation data acquisition unit that acquires situation data indicating interactions between a plurality of elements including at least some of the plurality of devices or at least some of the plurality of instruments, and the zone determination unit may determine a zone to which each combination of each of the plurality of processes and each of the plurality of elements belongs based on the situation data.

[0017] According to this configuration, for example, each element can be divided into zones for each process, taking into consideration the elements that interact with each other.

[0018] (5) In (4) above, the control device may further include a risk data acquisition unit that acquires risk data indicating the relationship between the multiple elements and the risk of an event occurring that poses a safety or security problem, and the zone determination unit may determine the priority of the zone further based on the risk data.

[0019] This configuration makes it possible to determine zones that require intensive monitoring.

[0020] (6) In any of (1) to (5) above, the control device may further include an abnormality detection processing unit that performs at least one of a lockout process that disconnects a switch provided between the device related to the zone in which an abnormality has occurred and the network that constitutes the system, based on a zone definition table that indicates the zone determined by the zone determination unit, and a tagout process that displays an alarm indicating that the device has been disconnected from the network.

[0021] This configuration makes it possible to properly disconnect a zone in which an abnormality has occurred from the network, and to notify the outside world of the zone in which an abnormality has occurred.

[0022] (7) A control method according to another embodiment of the present disclosure includes the steps of acquiring state transition data indicating transitions between states that can be taken by a system that has a plurality of devices and executes a plurality of processes, including a plurality of processes having redundancy, and dividing the plurality of processes having redundancy into different zones based on the state transition data, and determining the zones to which each of the plurality of devices belongs in the plurality of processes.

[0023] This control method allows for dynamic zoning of devices.

[0024] (8) A computer program according to another embodiment of the present disclosure functions as a state transition data acquisition unit that acquires state transition data indicating transitions between states that can be taken by a system that has multiple devices and executes multiple processes, including multiple processes with redundancy, and a zone determination unit that divides the multiple processes with redundancy into different zones based on the state transition data and determines the zone to which each of the multiple devices belongs in the multiple processes.

[0025] This computer program enables a computer to function as the above-mentioned control device, thereby enabling dynamic zone division of devices.

[0026] [Details of the embodiments of the present disclosure] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. Each of the embodiments described below shows a specific example of the present disclosure. The numerical values, shapes, materials, components, component placement and connection forms, steps, and step order shown in the following embodiments are examples and do not limit the present disclosure. Of the components in the following embodiments, components not recited in independent claims are components that can be added arbitrarily. Each figure is a schematic diagram and is not necessarily an exact illustration.

[0027] The same components are denoted by the same reference numerals, and since the functions and names of the same components are similar, the description of the same components will be omitted as appropriate.

[0028] [Overall Configuration of Control System] FIG. 1 is a diagram illustrating an example of the overall configuration of a control system according to an embodiment of the present disclosure.

[0029] The control system is, for example, a production system for a product, and includes, for example, an enterprise resources planning system (ERP) 1, a material requirements planning system (MRP) 2, a manufacturing execution system (MES) 3, a control and monitoring facility 4, and an assembly and processing line 5.

[0030] The core business system 1 is, for example, a system that handles the core business of the head office.

[0031] A production management system 2, a production execution system 3, a control and monitoring facility 4, and an assembly processing line 5 are installed in a factory. The production management system 2 executes overall management of production, such as product production planning and material procurement and supply.

[0032] The production execution system 3 monitors and manages the factory's facilities (hereinafter also referred to as "machines") and the work performed by workers by linking with each part of the factory's production line.

[0033] The control and monitoring equipment 4 monitors and controls the equipment on the factory production line using a PLC (Programmable Logic Controller) or HMI. The assembly and processing line 5 constitutes the production line. Product manufacturing work is carried out on the assembly and processing line 5.

[0034] The core business system 1 and the production management system 2 are connected by an external network (hereinafter referred to as "external NW") 6, which corresponds to a wide area network. The wide area network is configured, for example, by a virtual private network such as a VPN (Virtual Private Network) or a physical private network.

[0035] [Detailed Configuration of Control System] FIG. 2 is a diagram showing an example of a detailed configuration of the control system shown in FIG.

[0036] In the head office network, a firewall 11 is provided between the core business system 1 and the external NW 6. The firewall 11 has software or hardware for protecting the internal network, computers, and production facilities from external attacks or unauthorized access.

[0037] The network connecting the external NW 6 and the production management system 2 is called an information network (hereinafter referred to as the "information NW"). Similar to the core business system 1, a firewall 21 is provided between the production management system 2 and the external NW 6 to prevent external attacks or unauthorized access. Connected to the information NW are an OPC (OLE for Process Control) server 22, a DB (Database) server 23, and a workstation (hereinafter referred to as "WS") 24, which constitute the production management system 2. The OPC server 22 stores production management information such as production plans or purchasing plans. The DB server 23 stores histories of production results or purchasing results. The WS 24 is a terminal that performs operations using the OPC server 22 or the DB server 23.

[0038] The network connecting the production management system 2 and the production execution system 3 is called the control information network (hereinafter referred to as the "control information NW"). A firewall 31 is installed between the production management system 2 and the production execution system 3 to prevent attacks or unauthorized access from the information NW. The OPC server 32, DB server 33, and engineering workstation (hereinafter referred to as the "EWS") 34 that make up the production execution system 3 are connected to the control information NW. The OPC server 32 stores information necessary for production, such as process information or setting information. The DB server 33 stores history such as process results or inspection data. The EWS 34 is a terminal that performs operations using the OPC server 32 or the DB server 33.

[0039] The network connecting the production execution system 3 and the control and monitoring equipment 4 is called a local network (hereinafter referred to as "local NW"). A layer 2 switch 41 is provided between the production execution system 3 and the control and monitoring equipment 4 to connect the local NW and control information NW, which are different network segments. A robot controller (RC) 42, a PLC 43, and an HMI 44, which are included in the control and monitoring equipment 4, are connected to the local NW. The robot controller 42 controls a robot arm 51, which will be described later. The PLC 43 receives sensor information as input from a sensor 52, which will be described later, and controls a conveyor 53 and an indicator light 54, which will be described later. The HMI 44 serves as a control panel for operating the robot controller 42 and PLC 43.

[0040] The network connecting the control and monitoring equipment 4 and the assembly processing line 5 is called a field network (hereinafter referred to as "field NW"). A low-speed communication network including an IO (Input Output) that performs signal control using RS-485 serial communication or two voltage levels consisting of only high and low voltages is provided between the control and monitoring equipment 4 and the assembly processing line 5. A robot arm 51, a sensor 52, a conveyor 53, and an indicator light 54 are connected to the field NW. The robot arm 51 is controlled by a robot controller 42. Sensor information, which is the measurement result of the sensor 52, is input to a PLC 43.

[0041] [Configuration of Assembly Processing Line 5] Next, the assembly processing line 5 will be described in detail.

[0042] 3 is a diagram showing an example of the configuration of a control system including the detailed configuration of an assembly processing line 5. In FIG. 3, the core business system 1 and production control system 2 are not shown. Communication lines for controlling the robot arms 51A, 51B are shown with dashed lines. Communication lines for controlling a remote IO 57, which will be described later, are shown with solid lines. Communication lines for controlling a field monitoring switch 55, which will be described later, are shown with thin dotted lines. Communication lines for controlling a local monitoring switch 45, which will be described later, are shown with thick dotted lines.

[0043] The control system includes a production execution system 3, a control and monitoring facility 4, and an assembly processing line 5. The production execution system 3 and the control and monitoring facility 4 are connected via a Layer 2 switch 41 of Ethernet (registered trademark).

[0044] The assembly processing line 5 is broadly divided into process A, which is responsible for (1) part delivery, process B, which is responsible for (2) press-fitting and (3) welding, and process C, which is responsible for (4) shipping inspection and (5) product shipping. Of these, process B is a bottleneck process that requires a certain amount of work time to perform press-fitting and welding. For this reason, in order to improve work efficiency and ensure redundancy, process B is composed of two sub-processes, process B-1 and process B-2.

[0045] In FIG. 3, the equipment for carrying out process A includes a movable shelf 58A on which materials supplied as materials are stored, and a conveyor 59A for transporting the supplied materials from the movable shelf 58A.

[0046] The equipment that executes step B-1 includes a robot arm 51A, a robot hand for transporting components, and a jig for press-fitting and a jig for welding that are attached to the tip of the robot arm 51A. The robot arm 51A performs press-fitting and welding of components. The robot hand is attached to the tip of the robot arm 51A. The robot arm 51A switches between the jig for press-fitting and the jig for welding for each processing.

[0047] The equipment that executes step B-2 includes a robot arm 51B, a robot hand for transporting components, and a jig for press-fitting and a jig for welding that are attached to the tip of the robot arm 51B. The robot arm 51B performs press-fitting and welding of components. The robot hand is attached to the tip of the robot arm 51B. The robot arm 51B switches between the jig for press-fitting and the jig for welding for each processing.

[0048] The equipment that executes process C includes a conveyor 59B for transport and a movable shelf 58B. The conveyor 59B carries out products after assembly and welding. On the conveyor 59B, a shipping inspection is carried out and products that pass the inspection are sorted from those that fail. The conveyor 59B carries the passed products onto the movable shelf 58B. The movable shelf 58B stores and ships the products that have passed the inspection.

[0049] The assembly processing line 5 is equipped with multiple position sensors 52A and multiple temperature sensors 52B. The multiple position sensors 52A monitor the positions of the tips of the movable parts of the robot hands of the robot arms 51A and 51B. The multiple position sensors 52A are provided at positions (a), (b), (c), and (d). The multiple temperature sensors 52B monitor the temperature of the products during and after welding by the robot arms 51A and 51B. The multiple position sensors 52A that detect components are provided at positions (A), (B), (α), and (γ). An inspection camera 52C that detects and inspects the components is provided at position (β). The position sensor 52A, temperature sensor 52B, and inspection camera 52C are types of the sensors 52 shown in FIG. 2. These sensors 52 are connected to remote IOs 57 for each process and further connected to the PLCs 43 corresponding to the respective remote IOs 57.

[0050] Between the production execution system 3 and the control and monitoring facility 4, the robot controller 42, the PLC 43, and the HMI 44 are connected to the local NW via a local monitoring switch 45. Between the control and monitoring facility 4 and the assembly processing line 5, the robot controller 42, the PLC 43, and the HMI 44 are connected to the field NW via a field monitoring switch 55.

[0051] The local monitoring switch 45 is a device that monitors the facilities (devices) connected to the local NW and connects and disconnects communication lines. The local monitoring switch 45 connects and disconnects communication lines under routing control instructed by the local monitoring device 46, and also monitors communication signals or communication packets flowing through the communication lines and filters out communication signals or communication packets from communication partners that are not registered in the table. If the monitored device sends an abnormal communication signal or communication packet, the local monitoring switch 45 either disconnects and isolates the monitored device from the line or discards the communication packet.

[0052] The local monitoring device 46 transmits a routing instruction to the local monitoring switch 45 via a side channel, which is a path different from the normal path, according to the operation mode of the control system, in accordance with a built-in definition table. In other words, the local monitoring device 46 transmits the routing instruction via an independent communication path. In response to this, the local monitoring device 46 instructs the local monitoring switch 45 to connect or disconnect a path or discard a communication packet.

[0053] The field monitoring switch 55 is a device that monitors the facilities (devices) connected to the field network and connects and disconnects communication lines. The field monitoring switch 55 connects and disconnects communication lines under routing control instructed by the field monitoring device 56, monitors communication signals or communication packets flowing through the communication lines, and filters out communication signals or communication packets from communication partners not registered in the table. If the monitored device sends an abnormal communication signal or communication packet, the field monitoring switch 55 either disconnects and isolates the monitored device from the line or discards the communication packet.

[0054] The field monitoring device 56 communicates routing instructions to the field monitoring switch 55 via a side channel, which is a path different from the normal path, according to the operation mode of the control system in accordance with a built-in definition table. In other words, the field monitoring device 56 communicates routing instructions via an independent communication path. In this way, the field monitoring device 56 instructs the field monitoring switch 55 to connect or disconnect a path or discard a communication packet.

[0055] [Processing Procedures of Assembly Processing Line 5] Next, the processing procedures of the assembly processing line 5 will be described with reference to FIG.

[0056] In process A, movable shelf 58A, which stores materials to be supplied, stops at a predetermined position. Conveyor 59A removes the material from movable shelf 58A. Conveyor 59A carries the material to a position where it can be grasped by a robot hand for material transport attached to robot arm 51A in process B-1. Robot arm 51A grasps the material with its robot hand, transports it to position (a) in process B-1, and places it there.

[0057] In process B-1, the placed component is grasped by the component transport robot hand of robot arm 51A and transported to position (b) where it is positioned for press-fitting. Robot arm 51A then replaces the robot hand with a jig for press-fitting and performs the press-fitting. Robot arm 51A then replaces the jig with a component transport robot hand. Robot arm 51A then grasps the pressed-fit component and transports it to position (c) where it is positioned for welding. Robot arm 51A then replaces the robot hand with a jig for welding and performs welding. Robot arm 51A then replaces the jig with a component transport robot hand. Robot arm 51A then transports the welded component to position (d) and places it on conveyor 59B. Conveyor 59B then transports the component from process B to process C.

[0058] During this time, while the processing work is being carried out in process B-1, the processed material is transported to a position where the robot arm 51B can grasp it in process B-2 in the same manner as described above. When all processing work on the material in process B-2 is completed and the material is delivered to position iv in process B-2, the robot arm 51B places the processed material on the conveyor 59B. The conveyor 59B carries the material out from process B to process C.

[0059] Finally, the processed parts on the conveyor 59B undergo a shipping inspection using the inspection camera 52C located at position (β). After that, products that pass the inspection are stored on the movable shelf 58B for shipping. Processed parts that fail the shipping inspection are removed from the conveyor 59B. After the processing in process B-2 is completed, the transport, inspection, and shipping operations are carried out in the same manner as in process B-1.

[0060] Figure 4 is a flowchart showing the procedure of the processing work in the assembly processing line 5 shown in Figure 3. In the processing work, process A is executed (step S1). Then, process B-1 is executed (step S2). Process B-2 is executed in parallel with process B-1 (step S3). After process B-1 or process B-2 is executed, process C is executed (step S4). The processing from step S1 to step S4 is executed repeatedly.

[0061] Figure 5 is a timing chart showing the procedure of processing work in the assembly processing line 5 shown in Figure 3. (A) and (B) in the figure indicate the positions of members in process A shown in Figure 3. (a), (b), (c), and (d) in the figure indicate positions where members are processed in processes B-1 and B-2 shown in Figure 3. (α), (β), and (γ) in the figure indicate the positions of members in process C shown in Figure 3.

[0062] In step A, the removal of a member for step B-1 and the removal of a member for step B-2 are carried out in order. In steps B-1 and B-2, the removed members are press-fitted and welded in parallel.

[0063] In step C, the workpieces processed in step B-1 are transferred, and then the workpieces processed in step B-2 are transferred in that order.

[0064] [Regarding the Zone Division Method] Next, a zone division method for dividing the devices that make up the control system into zones, and the structuring and contraction for this purpose will be described.

[0065] Figure 6 is a flowchart showing an example of the procedure for the zone division method. The state transition table, situation table, and risk table shown in Figure 6 are generated by the production execution system 3 when the overall process is designed. Zone division is performed in the order of processes [1] to [5] shown in Figure 6 (steps S11 to S17). Each process will be described in detail below.

[0066] [1] From Preparation to Process Design (Step S11)] First, we will explain the process design for building a general production process that is the premise of zone division. Generally, process design refers to "selecting the optimal materials (raw materials, parts) and production resources (equipment, workers) for making a product from product design information, and designing a series of processing steps until the product is completed." At each stage of process design, documents and data are created, including the QC process chart (Quality Control Chart), risk assessment document, work standard, work instructions, and equipment program, as shown below.

[0067] (1) QC Process Chart For example, based on the product design information developed in the upstream product design process, a series of steps from material receipt to product manufacturing, shipping, post-shipment market monitoring, and product disposal are created, along with the design of control items, control methods, and abnormality response measures. A QC process chart is also created detailing the designed production activities. Among the QC process charts, the overall QC process chart shows the quality control process for the entire production. Individual QC process charts are charts that are broken down from the overall QC process chart and detailed down to each individual process.

[0068] (2) Risk Assessment Report In accordance with the individual QC process chart, risks related to safety and quality are identified and their importance is assessed. Based on the assessment results, risks and countermeasures are compiled in a risk assessment report. Based on this, specific countermeasures and work methods are developed in the work standards and work instructions described in the next section.

[0069] (3) Work Standards and Work Instructions Work standards and work instructions are created from the individual QC process chart. In other words, work standards are created from the individual QC process chart, which clearly describe the design and development of manufacturing equipment in each individual process, its installation and maintenance, the purpose of the work, the time required for the work, the parts and equipment used for the work, and the safety of workers. In addition, work instructions are created from the individual QC process chart, breaking down the work standards into specific operations and tasks of manufacturing equipment.

[0070] (4) Equipment Programs Control programs and setting values ​​for the robot arm 51 and PLC 43 used in the process are created based on the parameters or procedures specified in the work standards and work instructions. The combination of control programs and setting values ​​is called an equipment program. Control programs and setting values ​​are managed daily based on manufacturing conditions and various information. If the measured values ​​of the robot arm 51 during a start-of-work inspection are not within the reference values, the setting values ​​are adjusted within the procedures and allowable setting ranges specified for the process. These control programs and setting values ​​used are recorded and saved as quality data, along with the manufacturing conditions or measurement results of quality control items. At this time, this quality data is recorded and saved in the OPC server 32 and DB server 33 that make up the production execution system 3 of the control information network. The EWS 34 is used to record, save, and view this quality data.

[0071] [2] Extraction of tasks and operations from the QC process chart (Step S12)] The extraction of tasks and operations from the QC process chart will be described. Processes, tasks, and operations are extracted from the QC process chart and the associated work standards, work instructions, and equipment programs. Then, work breakdown and process analysis are performed to create information related to states, situations, and risks required to create a state transition chart, a status chart, and a risk chart, which will be described later.

[0072] 7 is a diagram for explaining work breakdown and process analysis. In work breakdown, work is broken down based on the QC process chart or the like, and the status, situation, and risks are clarified.

[0073] In process analysis, a more detailed analysis is conducted, and the status, situation, and risk are further broken down into smaller items. Here, detailed analysis includes (1) work analysis, (2) asset analysis, and (3) risk analysis, which are explained below. (1) Work analysis analyzes the work, equipment, tools, and associated setups that make up the process. Items for the work, equipment, tools, and associated setups that make up the process are listed. (2) Asset analysis analyzes the equipment required for the process to operate, its functions, and its importance. Items for the equipment required for the process to operate, its functions, and its importance are listed. (3) Risk analysis analyzes the risk and importance if the previous state is incorrect, and the need for redundancy. Items for risk, importance, and the need for redundancy are listed.

[0074] [3] Creation of State Transition Table, Situation Table, and Risk Table (Steps S13, S14, S15)] Methods for creating the state transition table, situation table, and risk table that are the targets of structuring and contraction for zone division will be described in order.

[0075] (1) Creating a State Transition Table (Step S13) A method for creating a state transition table will be described.

[0076] A state transition table shows the transitions between possible states of a control system that has multiple devices and executes multiple processes. A state transition table is a table that shows the state of a process and its transitions as a relationship from input (current state) to output (next state) based on work standards and work instructions. In this case, the work in the work instructions is broken down into individual, uniquely identifiable tasks (hereafter referred to as "tasks") through the above-mentioned work breakdown and process analysis. Therefore, a task represents the smallest unit of work in a process.

[0077] 8 is a diagram showing an example of a state transition table for the assembly processing line 5 shown in FIG. Rows of the state transition table 522 indicate input (cause) tasks, and columns correspond to output (result) tasks. The state transition table is an example of state transition data disclosed herein.

[0078] In FIG. 8 , the relationship between input (cause) and output (result) between tasks is indicated by a 0 (no relationship) or 1 (relationship) at the intersection of the rows and columns of the table. A state transition table 522 shows the interactions between these tasks. When performing calculations on a computer, the state transition table 522 can also be expressed in matrix form. Because this matrix indicates the causal relationship between input and output, this matrix will hereafter be referred to as a C-E matrix (Cause-Effect matrix). For example, a "1" is written at the intersection of the second row of the cause (current state) and the third column of the effect (next state), indicating a state transition from the task "Gathering materials" to the task "Transport (to process B)."

[0079] In general, a state transition table 522 expressed by a C-E matrix has information on the state of the system and state transitions (connections between causes (current states) and results (next states)). In general, a state transition table 522 expressed by a C-E matrix is ​​often very complicated. For this reason, the state transition table 522 can be simplified by performing a structural analysis of the state transition table 522 and contracting the states using a structuring method such as the ISM method (see Non-Patent Document 1).

[0080] FIG. 9 is a diagram showing an example of a contracted state transition table for the assembly processing line 5 shown in FIG. 3. The contracted state transition table 522A is called a skeletal matrix. The contracted state transition table 522A shows the skeletal structure of the original state transition table 522 (FIG. 8), and expresses the structure using hierarchies (rows) and elements (columns). The elements (columns) are the same as the tasks shown in the state transition table 522 of FIG. 8. The skeletal matrix is ​​used to express the structure of a graph. A graph is a data structure composed of vertices (nodes) and edges connecting the vertices. The skeletal matrix is ​​used to represent the topology of this graph.

[0081] Fig. 10 is a diagram showing an example of a directed graph of the state transition table 522 of the assembly processing line 5 shown in Fig. 3. The directed graph shown in Fig. 10 is created by combining a skeleton matrix (a contracted state transition table 522A) with a reachability matrix (cause-effect connection information) obtained during the calculation process using the ISM method. The directed graph in Fig. 10 was created using the ISM method.

[0082] A reachability matrix is ​​a matrix that indicates whether there is a path that can be traveled between any two vertices in a graph. The elements of the matrix are 1 if a path between the vertices exists, and 0 if not. The reachability matrix takes into account not only direct paths in the graph, but also indirect paths. Using the reachability matrix, it is possible to efficiently determine the reachability between vertices on a graph.

[0083] FIG. 10 shows that as time progresses from layer 01 to layer 10 of the skeleton matrix, the state progresses from element 1 to element 21. Layers 03, 04, 05, 06, 07, 09, and 10 of this skeleton matrix represent "strong connections" in graph theory. Because strongly connected sections are parallel elements, parallel elements may be contracted under certain conditions, except for areas where intentional duplication is required. Strongly connected sections are indicated by thick borders. Elements 1 and 2 belong to process A. Elements 6, 7, 8, and 9 belong to process B-1. Elements 12, 13, 14, and 15 belong to process B-2. Elements 18, 19, 20, and 21 belong to process C. Elements 4, 5, 10, 11, 16, and 17 can be replaced with other elements.

[0084] Strong connectivity refers to the existence of a bidirectional path between any two vertices in a directed graph. In other words, strong connectivity means that not only does a path exist from one vertex to another, but also a path in the reverse direction. Strong connectivity is an important concept that indicates whether a graph has connectivity. In a strongly connected graph, starting from any vertex, it is possible to reach any other vertex in the graph. For example, elements 3, 5, and 11 in layer 03 have a value of 1 in the skeleton matrix shown in Figure 9. This indicates that there is a mutual path between the vertices corresponding to elements 3, 5, and 11. Therefore, elements 3, 5, and 11 in layer 03 are strongly connected. Conversely, in a graph that is not strongly connected, it may be impossible to reach one vertex from another. More specifically, element S ｉ and matrix R Ｌｉ The relationship with Ｌｋ(S ｉ ) ≠ S ｉ If so, then the element S ｉ and element R Ｌｋ (S ｉ ) is strongly connected. Here, the matrix R Ｌｉ is the adjacent matrix element A and the reachable matrix element R ｉ It is calculated by the intersection of the sets.

[0085] Since the state transition table 522 is contracted using reachability, the contracted state transition table 522 can be used to monitor for abnormalities.

[0086] (2) Creating a Status Table (Step S14) A method for creating a status table will now be described.

[0087] The status table shows the interactions between multiple elements, including machines or instruments. The status table associates the relationships between pieces of equipment installed in a process, between equipment and instruments, and between instruments, based on the specification values, which are design values, or actuator operation information described in the work standard and work instructions. In this embodiment, the equipment is a robot arm 51, a conveyor 53, etc. In this embodiment, the instruments are sensors 52, etc. Generally, a numerical value of 0 (no relationship) or 1 (relationship) indicating a causal relationship between two elements or a correlation coefficient indicating a correlation is described at the intersection.

[0088] Specification values ​​are generally used to judge quality and manage process capability during manufacturing. An actuator is a device that receives energy such as electricity, air pressure, water pressure, or magnetism to cause an action. Actuators are used in control systems and automation systems to perform specific actions according to instructions or requests.

[0089] In the status table, the work in the work instructions is broken down to the level of a uniquely identified task. The status table represents the operating status of each piece of equipment and instrument based on operating information such as standard values ​​for the tasks associated with the work. The operating status can also be determined from (1) the interaction between the input value and intermediate value of the process, (2) the interaction between the intermediate value and output value, or (3) the interaction between the input value and output value. The interaction is at least one of the causal relationship and the correlation between two values. For example, the off and on states of a switch and a position sensor 52A are associated with 0 and 1, respectively. For example, the causal relationship between welding work and a temperature sensor 52B is associated as a correlation function.

[0090] FIG. 11 shows an example of a status table for the assembly processing line 5 and HMI 44 shown in FIG. 3. In this diagram, the numbers at the intersections of columns (causes) and rows (results) represent causal relationships [0 (no relationship) / 1 (relationship)]. The columns (causes) and rows (results) correspond to equipment and instruments. A, B, a, b, c, d, α, β, and γ in the status table 523 correspond to the position sensors 52A or inspection cameras 52C installed at positions (A), (B), (a), (b), (c), (d), (α), (β), and (γ), respectively. Sensor 1-1 and sensor 1-3 belong to process A. Sensor 2-1, sensor 2-2, sensor 2-3, sensor 2-4, and sensor 2-1 temperature belong to process B-1. Sensor positions 3-1, 3-2, 3-3, 3-4, and the temperature of sensor 3-1 belong to process B-2. Sensor positions 4-1, 4-2, and 4-3 belong to process C. The same applies to the tables shown in Figures 12, 15, 16, 17, and 20. Status table 523 is an example of status data of the present disclosure.

[0091] This status table 523 shows the interaction between the operating status of each piece of equipment and instrument in the process, and can also be expressed in matrix form when performing calculations on a computer. For example, in FIG. 11, the relationship between the third element (cause), "RC process B-1," and the sixth element (result), "sensor 1-1 position," is marked with a "0" at the intersection. This shows that in process B-1, the operation of the robot controller 42 does not affect the position sensor 52A at position (A). This shows that in process A, the operation of the PLC 43 affects the position sensor 52A at position (A).

[0092] Thereafter, the situation table 523 expressed by the CE matrix is ​​subjected to structural analysis and reduction using the ISM method, and a reduced situation table (skeleton matrix) is created.

[0093] FIG. 12 is a diagram showing an example of a contracted status table for the assembly processing line 5 and HMI 44 shown in FIG. 3. The contracted status table 523A is called a skeleton matrix and shows the skeleton structure of the original status table 523. The status table 523A expresses its structure using layers (columns) and elements (rows). Here, the vertical axis (rows) of the skeleton matrix corresponds to the order of equipment use in the processing process in this embodiment. The horizontal axis (columns) of the skeleton column indicates each piece of equipment and instrument in the process of the status table 523 shown in FIG. 11.

[0094] Fig. 13 is a diagram showing an example of a directed graph of the status table 523 of the assembly processing line 5 and the HMI 44 shown in Fig. 3. The directed graph shown in Fig. 13 is created by combining the condensed status table 523A (skeleton matrix) shown in Fig. 12 with the reachability matrix (cause-effect connection information) obtained during the calculation process using the ISM method. The directed graph in Fig. 13 is created using the ISM method.

[0095] FIG. 13 shows that as the process progresses from layer 01 to layer 13 of the skeleton matrix, each piece of equipment and instrument from element 1 to element 20 operates. Layers 05 to 09 of this skeleton matrix represent "strong connections" in graph theory. Since the strongly connected parts are parallel elements, parallel elements may be contracted under certain conditions, except for areas where they are intentionally multiplexed. Since the status table 523 is contracted using reachability, the contracted status table 523 can be used to monitor for abnormalities. In FIG. 13, the strongly connected parts are indicated by thick borders.

[0096] (3) Creating a Risk Table (Step S15) A risk table shows the relationship between multiple elements, including equipment or instruments, and the risk of an event causing a safety or security problem. The risk assessment that forms the basis for creating a risk table will be explained below. Risk assessment is carried out as a safety assessment and a security assessment during process design. Risk assessment is carried out by calculating and evaluating the risks of unsafe events and economic losses caused by hazards to safety and the environment and cyber attacks (including not only direct but also indirect impacts on the surrounding area).

[0097] Risk assessment is generally performed using analytical techniques such as Fault Tree Analysis (FTA), Failure Mode and Effects Analysis (FMEA), Threat Assessment and Remediation Analysis (TARA), etc. Depending on the results of this risk assessment, safety and security measures are added to the control system.

[0098] This section explains how to create a risk table that summarizes the results of risk assessment for a target process. FIG. 14 is a diagram for explaining the process of creating a risk table. The risk table is created from (1) the risk causal relationship table, (2) the risk impact table, and (3) the risk countermeasure table shown in FIG. 14. These three tables are created during the risk assessment process described above. (1) The risk causal relationship table shows the causes of risks and their consequences (harm or loss). (2) The risk impact table shows risk factors and their risk impact values. The risk impact value is a relative value that indicates the magnitude of the impact of harm, including threats and economic loss. (3) The risk countermeasure table shows risks, countermeasures, and countermeasure costs.

[0099] A risk table is created by linking (1) the risk causal relationship table with (2) the risk impact value and (3) the evaluation results of the risk countermeasure table, calculating the impact from the risk and its evaluation results (harm, loss, countermeasure costs, etc.), and recording the magnitude of the relationship. A risk table is created for each of multiple damage scenarios. By using multiple risk tables in a comprehensive manner, it is possible to get an overview of all the information related to risk.

[0100] 15 is a diagram showing an example of a risk table for the assembly processing line 5 and HMI 44 shown in FIG. 3. The rows (causes) and columns (results) of the risk table 524 indicate each piece of equipment and instrument in the process and the risks that arise. The risk table 524 is an example of risk data in the present disclosure.

[0101] The risk table 524 shows, from among multiple damage scenarios, an example in which a cyberattack tampers with the temperature sensor 52B (process B-1), causing the welding temperature to be erroneously set to a high temperature and resulting in a fire. Based on the relationships shown in (1) the risk causal relationship table, (2) the risk impact table, and (3) the risk countermeasure table, the strength of the relationship between the items of equipment, instruments, hazards, and impact is indicated at the intersections of the rows and columns between the items using relative numerical values ​​ranging from 0.0 to 1.0. The vertical axis represents the cause and the horizontal axis represents the result, with the items of equipment, instruments, hazards, and impact arranged. To facilitate subsequent handling, the risk table 524 in Figure 15 is binarized using a certain threshold.

[0102] FIG. 16 is a diagram showing an example of a binarized risk table for the assembly processing line 5 and HMI 44 shown in FIG. 3. FIG. 16 shows a binarized risk table 524A when the threshold is set to 0.5. At this point, the binarized risk table 524A has not been structured or reduced, and therefore, if it is complex and has many related items, it is difficult to understand the structure and relationships. Here, the structure is analyzed and reduced using the ISM method, as with the state transition table 522 and situation table 523 described above.

[0103] Figure 17 is a diagram showing an example of a condensed risk table for the assembly processing line 5 and HMI 44 shown in Figure 3. The condensed risk table 524B is called a skeletal matrix. The skeletal matrix shows the skeletal structure of the original risk tables 524 and 524A, and expresses the structure using hierarchies (columns) and factors (rows). According to Figure 17, the states and risks are structured, and the attack procedures of the attack scenarios are shown as a structure.

[0104] FIG. 18 is a diagram showing an example of the directed graph of the risk tables 524, 524A of the assembly processing line 5 and HMI 44 shown in FIG. 3. The directed graph in FIG. 18 was created using the ISM method. Refer to FIG. 18. If a physical cyber-attack is carried out at layer 01 to replace the temperature sensor 52B (sensor 2-1 temperature) in process B-1, and the temperature data is tampered with, the robot controller 42 (robot-controlled RC process B-1), which is operating unsafely, will erroneously recognize the temperature data at layer 02. The robot controller 42 will then reset the welding temperature to a high temperature. At layer 03, a fire has broken out at process B-1, which is deemed a hazard. The HMI is caused to erroneously display a normal temperature.

[0105] Therefore, it is necessary to prioritize management of the PLC 43 and remote IO 57 connected to the temperature sensor 52B (sensor 2-1 temperature) of process B-1 on layer 01, which is the cause of the problem, and their wiring. The robot controller 42 (robot control RC process B-1) on layer 02 also requires priority management because it is an energy-supplying facility. In Figure 18, strong connections are indicated by thick borders.

[0106] Here is some additional information about the main analytical methods used to create the risk table 524. Fault tree analysis is a method for analyzing the causes of product failures and resulting accidents. Failure mode and effect analysis is a method for predicting possible failure modes in the components of a system or process, analyzing and evaluating the expected causes and effects in advance to identify design and planning problems, and preventing problems before they occur by implementing proactive measures. TARA refers to a series of activities for risk management carried out in the concept phase. TARA is an engineering method for identifying and evaluating cybersecurity vulnerabilities, including the three processes of "asset identification," "threat identification," and "risk assessment," and selecting measures to mitigate those vulnerabilities.

[0107] [4] Linking of each C-E matrix (Step S16)] The (1) state transition table 522, (2) situation table 523, and (3) risk tables 524 and 524A created up to this point are compiled and analyzed. Based on the analysis results of the risk table 524, weights (security levels) are assigned to the states and situations, and they are organized. Furthermore, particularly important equipment and instruments are clarified for each process and sub-process.

[0108] FIG. 19 is a diagram illustrating an example of a control system configuration, including a detailed configuration of the assembly processing line 5 shown in FIG. 3 . FIG. 19 is a diagram similar to FIG. 3 . Communication lines for controlling the robot arms 51A and 51B are indicated by dashed lines. Communication lines for controlling the remote IO 57 are indicated by solid lines. Communication lines for controlling the field monitoring switch 55 are indicated by thin dotted lines. Communication lines for controlling the local monitoring switch 45 are indicated by thick dotted lines. The wiring enclosed by lines 61, 62, 63, and 64 are key management points among the areas requiring enhanced security, as described in "(3) Creating a Risk Table (Step S15)." In this way, the risk table 524 is utilized to organize the equipment, instruments, and communication lines by priority, focusing on the equipment, instruments, and communication lines that provide the cause or energy. This hierarchy can be used as a factor for determining the zone priority (security level) required when creating the zone definition table described in the next section.

[0109] [5] Creating a Zone Definition Table (Step S17) Creating a zone definition table will now be described. When creating the state transition table 522, the situation table 523, and the risk table 524 in steps S13, S14, and S15, structuring and contraction are performed as necessary and sufficiently.

[0110] According to the condensed status table 523A shown in Figure 12 and the condensed risk table 524B shown in Figure 17, the redundancy and risk importance of equipment are summarized in each table. For this reason, a zone definition table is created to identify important elements in the process according to the status and to perform distributed zone allocation. In distributed zone allocation, equipment and communication lines identified as important elements are allocated so as to be dispersed, avoiding concentration of these elements in each other.

[0111] 20 is a diagram showing an example of a zone definition table for the assembly processing line 5 and HMI 44 shown in FIG. 3. The rows of the zone definition table 525 indicate processes and tasks into which each process is subdivided. The columns of the zone definition table 525 indicate factors. The factors indicate the equipment or instruments operating in each task.

[0112] In the zone definition table 525, equipment zones are divided among process A, process B-1, process B-2, and process C executed by the assembly processing line 5. This determines the zone to which the equipment included in the assembly processing line 5 belongs for each of process A, process B-1, process B-2, and process C. The HMI 44 operates in all processes of the assembly processing line 5 (process A, process B-1, process B-2, and process C). Therefore, the HMI 44 is divided into one zone. Here, for convenience, the process including process A, process B-1, process B-2, and process C is referred to as process Z. In other words, the HMI 44 belongs to process Z. Process B-1 and process B-2, which have no causal relationship, are redundant processes. Alternatively, process B-1 and process B-2, which have strong connectivity, are redundant processes, and therefore the equipment included in process B-1 and process B-2 are classified into different zones. Each task is associated with a security level. For example, process B-1 is associated with three security levels (B1-1 to B1-3). If all devices belong to one zone and do not belong to multiple zones, the devices can be exclusively divided between zones. However, this does not exclude some devices from belonging to multiple zones. For example, devices that belong to process B-1 do not belong to process B-2, and devices that belong to process B-2 do not belong to process B-1. However, in processes other than process B-1 and process B-2, there may be devices that belong to multiple processes.

[0113] Fig. 21 is a diagram for explaining the security levels of the assembly processing line 5 and the HMI 44 shown in Fig. 3. Here, three security levels are assumed.

[0114] For example, B1-3 and B2-3 are the highest security level. For example, B1-2, B2-2 and Z are the next highest security level. For example, B1-1, B2-1, Z and C are the lowest security level.

[0115] 3 and 19, it is assumed that security is improved by turning a physical communication switch ON or OFF. However, security can also be improved by performing communications using encryption or scrambling between opposing local monitoring switches or field monitoring switches.

[0116] [Regarding Zone Division Instructions] The following describes zone division instructions. The zone division instructions are issued by the monitoring device of each network based on the zone definition table 525. The monitoring device transmits the zone division instructions to the monitoring switch of each network, which then connects and disconnects the communication paths. In this embodiment, the local monitoring device 46 of the local NW transmits instructions to connect and disconnect the communication paths to the local monitoring switch 45 based on the zone definition table 525. This causes the communication paths of the local NW to be connected and disconnected. The field monitoring device 56 of the field NW transmits instructions to connect and disconnect the communication paths to the field monitoring switch 55 based on the zone definition table 525. This causes the communication paths of the field NW to be connected and disconnected.

[0117] [Regarding Abnormality Detection] Anomaly detection will now be described. The above-described zone definition table 525 includes zones, states, situations, communication paths, and connection states. The local monitoring device 46 of the local network or the field monitoring device 56 of the field network monitors whether there are any discrepancies between the states and situations defined in the zone definition table 525 and the state of the equipment and input values ​​from the sensors. The local monitoring device 46 of the local network or the field monitoring device 56 of the field network then detects abnormalities by autocorrelation based on time-series relationships (inconsistencies in state transitions and situation transitions) and cross-correlation based on relationships with other equipment (inconsistencies due to mutual comparisons of instrumentation device outputs). In this case, abnormalities can be detected, for example, by network analysis of a directed graph created from the state transition table 522, the situation table 523, and the risk table 524 (differences in time-series changes in the vertices, edges, and directions of the directed graph).

[0118] [Regarding Tagout and Lockout Instructions] Tagout and lockout instructions will now be explained. When an abnormality as described in the previous section is detected, the zone in which the abnormality occurred is disconnected and isolated (locked out) by the monitoring switch of each network based on the zone definition table 525. At the same time, an alarm is displayed on the display provided on the monitoring switch to notify the user of the isolation (tagout). These lockout and tagout instructions are issued by the local monitoring device 46 of the local network or the field monitoring device 56 of the field network. Tagout information is also reported to the control panel and server to issue a warning.

[0119] Figure 22 is a diagram showing an example of a tagout display. Figure 22 shows an example of a display on a field monitoring switch 55. An alarm of normal (green), abnormal (orange), or isolation (red) is displayed by illuminating one of the LEDs (light-emitting diodes) arranged on the surface of the field monitoring switch 55. A display example on the local monitoring switch 45 is similar to that shown in Figure 22. In this way, an alarm display is provided on each monitoring switch. To improve visibility of the overall alarm display and to efficiently call attention, the alarm may be displayed as a centralized display or a partial display on a display (not shown) connected to each monitoring device.

[0120] [About the formation of sandboxes] This section explains the formation of sandboxes (protected areas). Sandboxes are areas within a zone or a combination of multiple zones that are used to check for any security threats in equipment (devices) when a new device is launched or when a device is launched for maintenance. Sandboxes are also used to check for any security threats when an anomaly is detected, as described in the explanation of anomaly detection.

[0121] A sandbox is formed by connecting the network of the zone where an abnormality occurred or the zone to be inspected based on the zone definition table 525 with a monitoring switch and disconnecting the networks of other zones with the monitoring switch. In this case, as with tagout and lockout, a display provided on the monitoring switch displays that the zone is isolated. When the sandbox is formed, the communication log of the communication path to be inspected is accumulated in the network monitoring device. The monitoring device then inspects for abnormalities based on the zone definition table 525.

[0122] Figure 23 is a diagram showing an example of the configuration of a control system including a detailed configuration of the assembly processing line 5 shown in Figure 3. Figure 23 is a diagram similar to Figure 3. Communication lines for controlling the robot arms 51A, 51B are shown with dashed lines. Communication lines for controlling the remote IO 57 are shown with solid lines. Communication lines for controlling the field monitoring switch 55 are shown with thin dotted lines. Communication lines for controlling the local monitoring switch 45 are shown with thick dotted lines.

[0123] For example, when inspecting process B-2, the local monitoring switch 45 is switched so that only processes A, B-1, and C of the assembly processing line 5 can operate. For example, by turning off the local monitoring switch 45 for process B-2, the PLC 43 and robot controller are isolated from the robot arm, remote IO 57, and sensors of process B-2. This makes it possible to inspect process B-2 in an independent state. Here, the communication lines 71 and 72 indicated by the thick lines are used for inspection. If communication between the PLC 43 and the robot controller 42 is required in the local network, an inspection local monitoring switch 45 and a Layer 2 switch (not shown) may be additionally provided to connect only the PLC 43 and the robot controller 42.

[0124] 24 is a diagram showing an example of the configuration of the field monitoring device 56. The field monitoring device 56 includes a communication I / F (interface) unit 510, a storage unit 520, and a control unit 530.

[0125] The communication I / F unit 510 is connected to the field monitoring switch 55 and performs communication with the field monitoring switch 55 .

[0126] The storage unit 520 is composed of a volatile memory element such as an SRAM (Static Random Access Memory) or a DRAM (Dynamic Random Access Memory), a non-volatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read-Only Memory), or a magnetic storage device such as a hard disk.

[0127] The storage unit 520 stores a computer program 521 executed by the control unit 530. The control unit 530 stores the state transition table 522, the situation table 523, the risk table 524, and the zone definition table 525 described above.

[0128] The control unit 530 is configured with various processors suitable for controlling the field monitoring device 56, such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), and a GPU (Graphics Processing Unit). The control unit 530 reads and executes a computer program 521 from the storage unit 520. The control unit 530 may be a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), or an ASIC (Application Specific Integrated Circuit) configured to execute the processing procedures indicated by the computer program 521.

[0129] The control unit 530 includes processing units that are functionally implemented by executing the computer program 521, such as a state transition table acquisition unit 531, a status table acquisition unit 532, a risk table acquisition unit 533, a zone determination unit 534, and an abnormality detection processing unit 535.

[0130] The state transition table acquisition unit 531 acquires the state transition table 522 from the storage unit 520. The process executed by the state transition table acquisition unit 531 is similar to step S13 in Fig. 6. The state transition table acquisition unit 531 is an example of a state transition data acquisition unit of the present disclosure.

[0131] The status table acquisition unit 532 acquires the status table 523 from the storage unit 520. The process executed by the status table acquisition unit 532 is similar to step S14 in Fig. 6. The status table acquisition unit 532 is an example of a status data acquisition unit of the present disclosure.

[0132] The risk table acquisition unit 533 acquires the risk table 524 from the storage unit 520. The process executed by the risk table acquisition unit 533 is similar to step S15 in Fig. 6. The risk table acquisition unit 533 is an example of a risk data acquisition unit of the present disclosure.

[0133] The zone determination unit 534 divides the zones between the processes based on the acquired state transition table 522, status table 523, and risk table 524. The processing executed by the zone determination unit 534 is as described in steps S16 and S17 of Fig. 6. The zone determination unit 534 transmits a zone division instruction to the field monitoring switch 55 of the field NW based on the zone definition table. The zone division instruction is as described above.

[0134] The abnormality detection processing unit 535 monitors whether an abnormality has occurred in the field network based on the zone definition table. If the abnormality detection processing unit 535 detects an abnormality, it executes tagout and lockout processing. The detection of abnormality, tagout, and lockout are as described above.

[0135] The anomaly detection processing unit 535 may form a sandbox, as described above.

[0136] Multiple processes with redundancy are important from a security perspective. According to this embodiment, multiple processes with redundancy are divided into different zones. Multiple processes with redundancy require a certain amount of work time, and at least some of them are executed in parallel to improve work efficiency. According to this embodiment, devices that execute processes corresponding to each zone are classified into the same zone, and devices can be dynamically divided into zones.

[0137] Each process (each function) in the above-described embodiments is executed by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit that combines one or more processors with one or more memories, various analog circuits, and various digital circuits. The one or more memories store programs (instructions) that cause the one or more processors to execute each process. The one or more processors may execute each process according to a program read from one or more memories, or according to a logic circuit designed in advance to execute each process. The processor may be various processors suitable for computer control, such as a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a field programmable gate array (FPGA), or an application-specific integrated circuit (ASIC). Multiple physically separated processors may also execute each process in cooperation with each other. For example, processors installed on multiple physically separated computers may cooperate with each other to execute each process via a network such as a local area network (LAN), a wide area network (WAN), or the Internet. To avoid simultaneous damage from lateral movement, multiplexing may be performed using multiple physically separated monitoring devices installed in independent zones, or multiple processors and storage media. Furthermore, multiplexing may be performed using multiple monitoring devices or multiple processors and storage media virtualized in separate independent zones. The program may be installed in the memory from an external server device via a network. The program may be distributed stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and then installed in the memory from the recording medium.

[0138] The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims.

[0139] 1 Core business system 2 Production management system 3 Production execution system 4 Control and monitoring equipment 5 Assembly processing line 6 External NW 11 Firewall 21 Firewall 22 OPC server 23 DB server 24 WS 31 Firewall 32 OPC server 33 DB server 34 EWS 41 Layer 2 switch 42 Robot controller 43 PLC 44 HMI 45 Local monitoring switch 46 Local monitoring device 51 Robot arm 51A Arm 51B Arm 52 Sensor 52A Position sensor 52B Temperature sensor 52C Inspection camera 53 Conveyor 54 Indicator light 55 Field monitoring switch 56 Field monitoring device (control device) 57 Remote IO 58A Mobile shelf 58B Mobile shelf 59A Conveyor 59B Conveyor 61 Line 62 Line 63 Line 64 Line 71 Communication line 72 Communication line 510 Communication I / F unit 520 Storage unit 521 Computer program 522 State transition table (state transition data) 522A Contracted state transition table 523 Situation table (situation data) 523A Contracted situation table 524 Risk table (risk data) 524A Binarized risk table 524B Contracted risk table 525 Zone definition table 530 Control unit 531 State transition table acquisition unit (state transition data acquisition unit) 532 Situation table acquisition unit (situation data acquisition unit) 533 Risk table acquisition unit (risk data acquisition unit) 534 Zone determination unit 535 Abnormality detection processing unit

Claims

1. A control device comprising: a state transition data acquisition unit; and a zone determination unit, wherein the state transition data acquisition unit acquires state transition data indicating transitions between states that can be taken by a system having multiple devices and executing multiple processes, the multiple processes including multiple processes having redundancy, and the zone determination unit divides the multiple processes having redundancy into different zones based on the state transition data, and determines the zone to which each of the multiple devices belongs in the multiple processes.

2. The control device according to claim 1, wherein the zone determination unit determines a plurality of processes that are not causally related as the plurality of processes having redundancy by condensing the state transition data.

3. A control device according to claim 1 or claim 2, wherein the zone determination unit determines a plurality of processes having strong connectivity as the plurality of processes having redundancy by contracting the state transition data.

4. A control device according to any one of claims 1 to 3, wherein the system further has a plurality of instruments and further comprises a situation data acquisition unit that acquires situation data indicating interactions of a plurality of elements including at least some of the plurality of devices or at least some of the plurality of instruments, and the zone determination unit determines a zone to which each combination of each of the plurality of processes and each of the plurality of elements belongs based further on the situation data.

5. The control device described in claim 4, further comprising a risk data acquisition unit that acquires risk data indicating the relationship between the multiple elements and the risk of an event occurring that poses a safety or security problem, and the zone determination unit determines the priority of the zone based further on the risk data.

6. A control device as claimed in any one of claims 1 to 5, further comprising an abnormality detection processing unit that executes at least one of a lockout process that disconnects a switch provided between the device associated with the zone in which an abnormality has occurred and the network that constitutes the system, based on a zone definition table indicating the zone determined by the zone determination unit, and a tagout process that displays an alarm indicating that the device has been disconnected from the network.

7. A control method comprising the steps of: acquiring state transition data indicating transitions between states that can be taken by a system that has a plurality of devices and executes a plurality of processes, including a plurality of processes with redundancy; and dividing the plurality of processes with redundancy into different zones based on the state transition data, and determining the zone to which each of the plurality of devices belongs in the plurality of processes.

8. A computer program that causes a computer to function as: a state transition data acquisition unit that acquires state transition data indicating transitions between states that can be taken by a system that has multiple devices and executes multiple processes, including multiple processes with redundancy; and a zone determination unit that divides the multiple processes with redundancy into different zones based on the state transition data and determines the zone to which each of the multiple devices belongs in the multiple processes.

Images