Control device, program creation assistance program, control system, and control method

Abstract

A control device (2) controls equipment to be controlled by executing a control program. The control device (2) comprises: a first holding unit that is capable of holding the control program; a second holding unit that is capable of holding the control program and in which security is ensured to a greater extent than in the first holding unit; a loading processing unit (41) that loads the control program by a loading method selected from among a plurality of loading methods using the first holding unit or the second holding unit; and a program execution unit (42) that executes the loaded control program.

Description

Control device, program creation support program, control system, and control method

[0001] This disclosure relates to a control device for controlling a controlled device, a program creation support program, a control system, and a control method.

[0002] Control devices that control target equipment such as machinery on a manufacturing line receive control programs created using program creation support devices. Generally, control programs are stored in the ROM (Read Only Memory) within the control device. When the control device boots up, the control programs stored in the ROM are loaded into the RAM (Random Access Memory). The control device then executes the loaded control programs.

[0003] Control devices may employ measures to prevent information leakage to malicious actors. RAM implemented in the microcontroller of a control device poses a low risk of information leakage even when the information is handled in plain text. On the other hand, RAM located outside the microcontroller poses a higher risk of information leakage when the information is handled in plain text compared to RAM implemented in the microcontroller. Therefore, RAM located outside the microcontroller may be protected by encryption.

[0004] Patent Document 1 discloses a method for performing password-based access control to a control program stored in a control device from external access to the control device. In the method described in Patent Document 1, password-based access control protects the control program from unauthorized rewriting and other unauthorized modifications.

[0005] International Publication No. 2020 / 208791

[0006] In the method described in Patent Document 1, assuming that the control program and password are deployed in the RAM implemented in the microcontroller of the control device, the control device can protect the control program. However, if the data size of the control program and password to be protected exceeds the size of the deployable area in the RAM, the control device will have no choice but to use RAM installed outside the microcontroller to deploy the control program and password. In this case, protecting the control program becomes difficult. Furthermore, it is desirable for the control device to minimize the deterioration of the control performance of the control device due to the protection of the control program.

[0007] This disclosure has been made in view of the above, and aims to provide a control device that enables protection of the control program and reduction of deterioration of the control performance of the control device.

[0008] To solve the above-mentioned problems and achieve the objective, the control device according to this disclosure is a control device that controls a controlled device by executing a control program. The control device according to this disclosure comprises a first holding unit capable of holding a control program, a second holding unit capable of holding a control program and having greater security than the first holding unit, an unpacking processing unit that unpacks the control program using an unpacking method determined from among a plurality of unpacking methods using the first holding unit or the second holding unit, and a program execution unit that executes the unpacked control program.

[0009] The control device described herein has the effect of protecting the control program and reducing the deterioration of the control performance of the control device.

[0010] Figures showing an example configuration of the control system according to Embodiment 1 Figures showing an example of the functional configuration of the control device and program creation support device according to Embodiment 1 Figures showing an example of selection system program information set in the program creation support device according to Embodiment 1 Figures showing an example of control program information set in the program creation support device according to Embodiment 1 Figures showing an example of the operation procedure of the expansion method determination unit of the program creation support device according to Embodiment 1 Flowchart showing an example of the operation procedure of the expansion processing unit of the control and program execution unit when the control device according to Embodiment 1 executes a control program Figures for explaining the operation transitions of the control processor of the control device according to Embodiment 1 Figures showing an example configuration of the control device according to Embodiment 2 Flowchart showing an example of the operation procedure of the expansion processing unit and program execution unit when the control device according to Embodiment 2 executes a control program Figures for explaining the operation transitions of the control processor, transfer processor and decoding processor of the control device according to Embodiment 2 Figures for explaining an example in which the execution order of multiple control programs is changed in Embodiment 3 Figures for explaining the operation transitions of the control processor, transfer processor and decoding processor when the execution order of multiple control programs is changed in Embodiment 3

[0011] The control device, program creation support program, control system, and control method according to the embodiment will be described in detail below with reference to the drawings.

[0012] Embodiment 1. Figure 1 shows an example of the configuration of a control system 1 according to Embodiment 1. The control system 1 is a system that controls a device to be controlled 4 using a control device 2. The control system 1 comprises a control device 2, a program creation support device 3, and a device to be controlled 4.

[0013] The control device 2 is a Programmable Logic Controller (PLC). The control device 2 performs sequence control of the controlled device 4 by executing a control program. The controlled device 4 is, for example, machinery on a manufacturing line. The program creation support device 3 and the control device 2 are connected to each other so as to be able to communicate with each other. The control device 2 and the controlled device 4 are connected to each other so as to be able to communicate with each other.

[0014] The program creation support device 3 assists the user in creating a control program. In Embodiment 1, the user is defined as the person who creates the control program. The user creates the control program by operating the program creation support device 3.

[0015] The program creation support device 3 is a computer system comprising a processor 11, RAM 12, ROM 13, input / output interface 14, and user interface 15. Hereafter, interfaces will be referred to as "I / F".

[0016] The functions of the program creation support device 3 are realized by software, firmware, or a combination of software and firmware. The software or firmware is written as a program and stored in ROM 13. The program creation support program stored in ROM 13 is loaded into RAM 12 and executed by processor 11. The program creation support program causes the computer system to execute the processing procedures and methods of the program creation support device 3.

[0017] The program creation support program according to Embodiment 1 may be provided on a recording medium such as a CD (Compact Disc)-ROM or DVD (Digital Versatile Disc)-ROM. The program creation support program may also be provided by being stored on a computer connected to a network such as the Internet and downloaded via the Internet or other network. The program creation support program may also be provided or distributed via a network such as the Internet.

[0018] The processor 11 is a CPU (Central Processing Unit, also referred to as a central processing unit, processing device, arithmetic device, microprocessor, microcomputer, processor, or DSP (Digital Signal Processor)).

[0019] The input / output I / F 14 receives data from the outside of the program creation support device 3 and supplies the data to the processor 11. The input / output I / F 14 transmits data from the processor 11 to the outside of the program creation support device 3. The user I / F 15 receives information by being operated by a user. The user I / F 15 outputs information to be presented to the user. The user I / F 15 includes an input device such as a keyboard, a mouse, a keypad, or a touch panel, and a display device such as an LCD (Liquid Crystal Display) or an organic EL (Electro-Luminescence) display.

[0020] The control device 2 according to the first embodiment includes a RAM with a low risk of information leakage, and a RAM with a higher risk of information leakage than the RAM. Hereinafter, the former is referred to as a secure RAM 22, and the latter is referred to as a non-secure RAM 23. The control device 2 includes a control processor 21, the secure RAM 22, the non-secure RAM 23, a ROM 24, and an input / output I / F 25.

[0021] The control processor 21 is a CPU. The control processor 21 includes a control core that executes a control program. The control core also executes a system program that is executed in accordance with the execution of the control program. The control core is responsible for processing for controlling the control target device 4. Among the control processor 21, the other cores shown in FIG. 1 execute programs other than the program executed by the control core. The other cores are responsible for processing other than the control of the control target device 4.

[0022] The control processor 21 and secure RAM 22 are mounted on a common chip. The risk of information leakage is small even when information is handled in plain text within the chip. Here, the area representing the inside of the chip is referred to as the secure area. The control processor 21 and secure RAM 22 are located in the secure area.

[0023] Areas of the control device 2 other than the secure area are referred to as the non-secure area. The risk of information leakage in the non-secure area is higher than in the secure area when information is handled in plain text. The non-secure RAM 23 is located in the non-secure area. The non-secure RAM 23 is located outside the chip on which the control processor 21 and secure RAM 22 are implemented.

[0024] The non-secure RAM 23 functions as a first storage unit capable of holding the control program. The secure RAM 22 functions as a second storage unit capable of holding the control program and having greater security than the first storage unit.

[0025] ROM24 stores the control program transmitted from the program creation support device 3 to the control device 2. ROM24 also stores the system program. The system program is classified into basic system programs and optional system programs. The basic system program is the system program necessary for the computer system to function as the control device 2, including the OS (Operating System) and the control program execution engine. The basic system program can be said to cause the computer system to execute the processing procedures and methods of the control device 2. The optional system program is the system program necessary to provide optional functions to the control device 2.

[0026] The input / output interface 25 receives data from outside the control device 2 and provides the data to the control processor 21. The input / output interface 25 also transmits data from the control processor 21 to the outside of the control device 2.

[0027] Figure 2 is a diagram showing an example of the functional configuration of the control device 2 and program creation support device 3 according to Embodiment 1. The unpacking processing unit 41 and the program execution unit 42 are functional units of the control device 2. The unpacking processing unit 41 and the program execution unit 42 are realized by the control processor 21 shown in Figure 1 executing the system program unpacked in the secure RAM 22. In Figure 2, the unpacking processing unit 41 and the program execution unit 42 are shown within the secure RAM 22. The unpacking method determination unit 31 is a functional unit of the program creation support device 3. The unpacking method determination unit 31 is realized by the processor 11 executing the program creation support program unpacked in the RAM 12.

[0028] Control programs A, B, C, D, and E are control programs created by the program creation support device 3. The program creation support device 3 shown in Figure 2 schematically represents control programs A to E, which are created by the program creation support device 3 and stored in the ROM 13 of the program creation support device 3.

[0029] The deployment method determination unit 31 determines the deployment method for each control program A to E in the control device 2 from among a plurality of deployment methods. The plurality of deployment methods include deployment methods using secure RAM 22 and deployment methods using non-secure RAM 23. That is, the deployment method determination unit 31 determines the deployment method for each control program A to E from among a plurality of deployment methods using either secure RAM 22 or non-secure RAM 23. In Embodiment 1, deployment refers to placing the program in secure RAM 22 or non-secure RAM 23 in an executable state.

[0030] The program creation support device 3 is configured with selected system program information. This selected system program information indicates the settings configured for the selected system program.

[0031] Figure 3 shows an example of selected system program information set in the program creation support device 3 according to Embodiment 1. The ROM 13 of the program creation support device 3 stores a table summarizing the selected system program information. The selected system program information includes information on the following items: "optional function," "whether or not it is used," and "related selected system programs."

[0032] "Optional functions" refer to functions that can be added to the control unit 2. In the example shown in Figure 3, the FTP (File Transfer Protocol) server function, FTP client function, and web server function are each optional functions that can be added.

[0033] "Usage Status" indicates whether or not to use the optional features. Users select whether or not to use the pre-configured optional features. Users input information indicating whether or not to use each of the multiple optional features into the user interface 15. The information entered into the user interface 15 is written to a table in ROM 13.

[0034] "Related selection system programs" refer to selection system programs that are executed in relation to optional functions. Each of the pre-configured optional functions has a related selection system program associated with it.

[0035] The program creation support device 3 is configured with control program information. This control program information indicates the settings configured for the control program.

[0036] Figure 4 shows an example of control program information set in the program creation support device 3 according to Embodiment 1. The ROM 13 of the program creation support device 3 stores a table that summarizes control program information for control programs created using the program creation support device 3. The control program information includes information on the following items: "control program," "type," "execution order," "protection attributes," and "deployment method." The table stores the control program information.

[0037] "Control Program" refers to the name of the control program. "Type" refers to the type of control program. A repetitive type control program is executed iteratively in an order predetermined by the user. An event type control program is executed in response to a specific event, such as an external or internal interrupt. The example shown in Figure 4 assumes preemption when it is necessary to execute an event type control program while a repetitive type control program is running. In other words, it assumes the operation of interrupting the running repetitive type control program and switching to the execution of an event type control program.

[0038] The "execution order" indicates the order in which each control program is executed. The user inputs information indicating the type of control program and information indicating the order in which each control program is executed into the user interface 15. The information input into the user interface 15 is written to a table in ROM 13.

[0039] The "Protection Attributes" field includes the fields "Protection Needed" and "Priority." "Protection Needed" indicates whether protection is needed to prevent leakage to malicious actors. The user selects whether or not to protect each control program. The user inputs information indicating whether or not to protect each control program into the user interface 15. The information entered into the user interface 15 is written to a table in ROM 13.

[0040] "Priority" indicates the priority for preventing latency degradation associated with protecting control programs. For control programs where "Protection is required" is set as required, the user inputs information indicating the priority into the user interface 15. The information input into the user interface 15 is written to a table in ROM 13. Here, a number indicating priority is entered. A smaller number indicates a higher priority.

[0041] "Deployment method" refers to the deployment method determined by the deployment method determination unit 31. The first deployment method is a deployment method that uses the secure RAM 22. In the first deployment method, the control program is deployed in plain text in the secure RAM 22.

[0042] The second deployment method uses secure RAM 22 and non-secure RAM 23. In the second deployment method, the encrypted control program is stored in non-secure RAM 23 when it is not being executed. Then, only immediately before the control program is executed, the encrypted control program stored in non-secure RAM 23 is transferred to secure RAM 22, where the control program is decrypted. Furthermore, the decrypted control program is deployed to the temporary deployment area of ​​secure RAM 22. The temporary deployment area is the area used for temporary deployment immediately before the execution of the control program.

[0043] The third deployment method is one that uses non-secure RAM 23. In the third deployment method, the control program is deployed in plain text in the non-secure RAM 23.

[0044] Of the first, second, and third deployment methods, the first deployment method offers the highest level of protection. Of the three deployment methods, the third deployment method offers the lowest level of protection. The second deployment method offers the same level of protection as the first deployment method. The second deployment method degrades control performance compared to the first deployment method because it requires more transfers of the control program and decryption processing. Control performance is expressed by scan time or response time. Scan time is the period from the start of control program execution until input / output processing is completed.

[0045] The deployment method determination unit 31 determines the deployment method for each control program A to E from among three options: the first deployment method, the second deployment method, and the third deployment method. The deployment method determination unit 31 determines the deployment method for each control program A to E before the control program A to E is written from the program creation support device 3 to the control device 2. For each control program A to E, information indicating the determined deployment method is written to a table in the ROM 13.

[0046] The deployment method determination unit 31 determines the deployment method for each control program A to E based on the information regarding "necessity of protection" and "priority." In the example shown in Figure 4, the deployment method determination unit 31 determines the deployment method for control program E, which is set as not requiring protection, to be the third deployment method.

[0047] For control programs where "protection is required" is set as required, control programs with a higher "priority" are given priority as the control programs to which the first deployment method is applied. The deployment method determination unit 31 also determines the deployment method for each control program so that the deterioration of control performance falls within the range required by the user. The deployment method determination unit 31 determines whether the deterioration of control performance falls within the required range based on the selected system program information and the control program information.

[0048] The basic system program is encrypted and stored in ROM 24. The selected system program is encrypted and stored in ROM 24. The method for unpacking the basic system program and the method for unpacking the selected system program are predetermined by, for example, the manufacturer of the control device 2. The unpacking processing unit 41 unpacks the basic system program and the selected system program according to the predetermined unpacking method.

[0049] In the example shown in Figure 2, the encrypted basic system program and the encrypted optional system program are sent from ROM 24 to secure RAM 22, where they are decrypted. The decrypted basic system program and the decrypted optional system program are then expanded in secure RAM 22. Figure 2 schematically shows the encrypted basic system program and the encrypted optional system program as they are stored in ROM 24, and the basic system program and the optional system program as they are expanded in secure RAM 22. In Figure 2, dashed arrows represent the transfer of programs or information.

[0050] The selected system program information and control program information are stored in the ROM 13 of the program creation support device 3. Figure 2 schematically shows the selected system program information and control program information stored in the program creation support device 3. The program creation support device 3 transmits the encrypted selected system program information and encrypted control program information to the control device 2. The control program information is transmitted from the program creation support device 3 to the control device 2. Upon transmission of the control program information, the deployment method determination unit 31 outputs control program information indicating the deployment method determined by the deployment method determination unit 31 to the control device 2.

[0051] The encrypted selection system program information and encrypted control program information are stored in the ROM 24 of the control device 2. The encrypted selection system program information and encrypted control program information are transferred from the ROM 24 to the secure RAM 22 and decrypted in the secure RAM 22. Figure 2 schematically shows the encrypted selection system program information and encrypted control program information as stored in the ROM 24 and the selection system program information and control program information decrypted in the secure RAM 22.

[0052] Control programs A to E are stored in ROM 13 of the program creation support device 3. Figure 2 schematically shows control programs A to E stored in the program creation support device 3. The program creation support device 3 transmits the encrypted control programs A to E to the control device 2. The encrypted control programs A to E are stored in ROM 24. Figure 2 schematically shows the encrypted control programs A to E when stored in ROM 24. Note that control program E, for which "Protection is not required" is set to be unnecessary, may be transmitted to the control device 2 in plain text and stored in ROM 24 in plain text.

[0053] The decompression processing unit 41 decompresses each control program A to E according to the decompression method indicated in the control program information in the secure RAM 22. The decompression processing unit 41 transfers the encrypted control programs A and D to the secure RAM 22 according to the first decompression method, which is the "decompression method" for control programs A and D. The decompression processing unit 41 decrypts control programs A and D in the secure RAM 22. The decompression processing unit 41 decompresses the plaintext control programs A and D into the secure RAM 22. Figure 2 schematically shows the control programs A and D decompressed into the secure RAM 22.

[0054] The decryption processing unit 41 transfers the encrypted control programs B and C to the non-secure RAM 23 according to the second decryption method, which is the "decryption method" for control programs B and C. The encrypted control program B is transferred to the non-secure RAM 23 during a non-execution period before control program B is executed and is held in the non-secure RAM 23. The encrypted control program C is transferred to the non-secure RAM 23 during a non-execution period before control program C is executed and is held in the non-secure RAM 23. Figure 2 schematically shows control programs B and C when they are held in the non-secure RAM 23.

[0055] Immediately before control program B is executed, the decompression processing unit 41 transfers the encrypted control program B stored in the non-secure RAM 23 to the secure RAM 22. The decompression processing unit 41 decrypts control program B in the secure RAM 22. The decompression processing unit 41 expands the plaintext control program B, which has been decrypted, into a temporary expansion area. Immediately before control program C is executed, the decompression processing unit 41 transfers the encrypted control program C stored in the non-secure RAM 23 to the secure RAM 22. The decompression processing unit 41 decrypts control program C in the secure RAM 22. The decompression processing unit 41 expands the plaintext control program C, which has been decrypted, into a temporary expansion area.

[0056] The decryption processing unit 41 transfers the encrypted control program E to the non-secure RAM 23 according to the third decryption method, which is the "decryption method" for the control program E. The decryption processing unit 41 decrypts the control program E in the non-secure RAM 23. The decryption processing unit 41 then expands the control program E, which has been converted to plaintext by the decryption, into the non-secure RAM 23. Figure 2 schematically shows the control program E expanded into the non-secure RAM 23. Note that if the control program E is stored in plaintext in the ROM 24, the control program E in plaintext is transferred to the non-secure RAM 23 and then expanded into the non-secure RAM 23.

[0057] The program execution unit 42 executes control programs A to D deployed in the secure RAM 22 and control program E deployed in the non-secure RAM 23.

[0058] Next, the operation of the deployment method determination unit 31 of the program creation support device 3 will be described. Figure 5 is a flowchart showing an example of the operation procedure of the deployment method determination unit 31 of the program creation support device 3 according to Embodiment 1.

[0059] In step S1, the deployment method determination unit 31 requests the user whether or not to use optional functions, whether or not to protect each control program, and to set the priority of each control program. The deployment method determination unit 31 presents information regarding these requests to the user via the user interface 15. The user then inputs information indicating whether or not to use optional functions, whether or not to protect each control program, and the priority of each control program into the program creation support device 3 using the user interface 15.

[0060] In step S2, the deployment method determination unit 31 determines the deployment method for each control program based on the control program information. For control programs where "protection is required" is set to be required, the deployment method is determined to be either the first deployment method or the second deployment method. For control programs where "protection is required" is set to be unnecessary, the deployment method is determined to be the third deployment method.

[0061] Here, we will explain how to determine the deployment method for control programs where "protection is required" is set as required. The total deployment size of the control programs for which the deployment method is determined to be the first deployment method is the maximum value S. max A constraint is imposed on the determination of the deployment method: it must not exceed a certain limit. The deployment size is the size of the area in the secure RAM 22 used for deploying the control program, which is in plain text. Maximum value S max S is the size of the largest area of ​​the secure RAM 22 that can be used for deploying the control program. A The size S of the area used for deploying the basic system program. B It is determined based on the above. In Embodiment 1, S max ≤S A -S B This holds true.

[0062] The method for determining how to deploy a control program for which "protection is required" has been set is arbitrary. The deployment method determination unit 31 determines how to deploy a control program for which "protection is required" has been set, for example, by the method described below.

[0063] The deployment method determination unit 31 calculates the total s of the area sizes required to deploy the relevant selected system program in the secure RAM 22 for the optional functions set to "present" for "use status" in the selected system program information. The initial value of the total s is zero.

[0064] Next, the deployment method determination unit 31 selects the control program with the smallest "priority" number in the control program information, and determines whether the following expression (1) holds for the selected control program. Note that s trgt is the size of the area required to deploy the selected control program in the secure RAM 22. s + s trgt < S max ... (1)

[0065] When expression (1) holds, the deployment method determination unit 31 determines the deployment method of the selected control program as the first deployment method. In addition, the deployment method determination unit 31 updates the total s by adding s to the total s trgt . The deployment method determination unit 31 repeats the determination of whether expression (1) holds and the update of the total s in order from the control program with the smallest "priority" number. Then, the deployment method determination unit 31 determines the deployment method of the selected control program at the time when expression (1) does not hold as the second deployment method. After determining the deployment method of each control program, the deployment method determination unit 31 advances the procedure to step S3.

[0066] In step S3, the deployment method determination unit 31 calculates an estimated value of control performance. The method for calculating the estimated value of control performance is arbitrary. In the first embodiment, the control performance for the iterative type control program is represented by the scan time. In addition, the control performance for the event type control program is represented by the response time.

[0067] The deployment method determination unit 31 calculates the estimated scan time value D for the iterative type control program, for example, by the following expression (2) scan . Note that d scan0This is an estimated value of the sum of the processing times of each iterative control program and other processing times. Other processing times include the time required for processing such as input / output processing. d trans _ dec _ scan This is an estimated time, calculated by summing the time it takes for data to be transferred from the non-secure RAM 23 to the secure RAM 22 and for decryption to be completed, for each control program whose decryption method is determined to be the second decryption method. scan = d scan0 +d trans _ dec _ scan ... (2)

[0068] The deployment method determination unit 31 determines the estimated response time D for the event type control program using, for example, the following equation (3): ev Calculate d. ev0 This is an estimated response time to the event. trans _ dec _ ev This is an estimated time, calculated by summing the time it takes for data to be transferred from the non-secure RAM 23 to the secure RAM 22 and for decryption to be completed, for each control program whose decryption method is determined to be the second decryption method. ev = d ev0 +d trans _ dec _ ev ... (3)

[0069] The method for calculating the estimated scan time and the estimated response time is arbitrary. The deployment method determination unit 31 may use values ​​calculated using calculation parameters pre-set in the program creation support device 3 as the estimated scan time or the estimated response time. The deployment method determination unit 31 may also use values ​​measured in advance for the actual machine as the estimated scan time or the estimated response time.

[0070] In step S4, the development method determination unit 31 presents the estimated value calculated in step S3 to the user and asks the user to determine whether the estimated value falls within the required range. The development method determination unit 31 presents the estimated value to the user via the user interface 15. The user determines whether the presented estimated value falls within the required range. The user inputs information indicating whether the presented estimated value falls within the required range to the program creation support device 3 using the user interface 15.

[0071] In step S5, the expansion method determination unit 31 determines whether or not the estimated value is included in the required range. If it is determined that the estimated value is included in the required range (step S5, Yes), in step S6, the expansion method determination unit 31 encrypts each control program, the selected system program information, and the control program information.

[0072] In step S7, the deployment method determination unit 31 stores the encrypted control programs, the encrypted selected system program information, and the encrypted control program information in the ROM 24 of the control device 2.

[0073] In step S6, the decryption method determination unit 31 may leave control programs that are set as not requiring protection unencrypted in plain text. In this case, the decryption method determination unit 31 stores the plain text control programs in the ROM 24 of the control device 2.

[0074] If it is determined that the estimated value is not included within the required range (step S5, No), in step S8, the development method determination unit 31 presents the user with a proposed improvement in control performance. The development method determination unit 31 creates the improvement proposal. The development method determination unit 31 presents information indicating the content of the improvement proposal to the user via the user I / F 15.

[0075] For example, the deployment method determination unit 31 determines the estimated scan time D scan and the estimated response time D evTo reduce both of these factors, we propose changing the "Availability" setting of optional functions in the selected system program information from "Available" to "Not Available". By reducing the number of optional functions used, the number of selected system programs to be executed decreases. By reducing the number of selected system programs to be executed, the number of control programs whose deployment method is set to the second deployment method can be increased. This reduces the estimated scan time D. scan Or an estimated response time D ev A reduction in this can be expected.

[0076] Furthermore, if the "usage status" setting cannot be changed, the deployment method determination unit 31 determines the estimated scan time D scan and the estimated response time D ev To reduce one of these factors, it may be suggested to change the "priority" in the control program information. For example, the estimated response time D ev When reducing the scan time, the deployment method determination unit 31 proposes setting the "priority" of the event-type control program higher than the "priority" of the repetitive-type control program. By setting the "priority" of the event-type control program higher than the "priority" of the repetitive-type control program, the estimated scan time D scan d trans _ dec _ scan d increases. trans _ dec _ scan Due to the trade-off caused by the increase, the estimated response time D ev Our d trans _ dec _ ev This can be expected to reduce [the amount]. Furthermore, the method used by the deployment method determination unit 31 to create the improvement plan is not limited to the method described above and is arbitrary.

[0077] Based on the above, the expansion method determination unit 31 completes its operation according to the procedure shown in Figure 5. In the above, in step S4, the user determines whether or not the estimated value is included in the requested range, but the expansion method determination unit 31 may also determine whether or not the estimated value is included in the requested range. In this case, the requested range is set in the expansion method determination unit 31. The expansion method determination unit 31 determines whether or not the estimated value is included in the requested range by comparing the set range with the estimated value.

[0078] Next, the operation of the unpacking processing unit 41 of the control device 2 will be described. Figure 6 is a flowchart showing an example of the operation procedure of the unpacking processing unit 41 of the control device 2 according to Embodiment 1. Here, the operation of the unpacking processing unit 41 during the boot-up of the control device 2 will be described.

[0079] In step S11, the deployment processing unit 41 deploys the basic system program to the secure RAM 22 or non-secure RAM 23. The deployment processing unit 41 reads the basic system program from the ROM 24. The deployment processing unit 41 deploys the basic system program to the secure RAM 22 or non-secure RAM 23 according to a deployment method predetermined by the manufacturer.

[0080] In step S12, the deployment processing unit 41 deploys the selected system program to the secure RAM 22 or non-secure RAM 23. The deployment processing unit 41 reads the selected system program from the ROM 24. The deployment processing unit 41 deploys the selected system program to the secure RAM 22 or non-secure RAM 23 according to a deployment method predetermined by the manufacturer.

[0081] In step S13, the unpacking processing unit 41 unpacks each control program into the secure RAM 22 or non-secure RAM 23. The unpacking processing unit 41 unpacks each control program using the unpacking method shown in the "Unpacking Method" of the control program information.

[0082] The decompression processing unit 41 decrypts the encrypted control program transferred from the ROM 24 for the control program for which the first decompression method is set, and decompresses the plaintext control program into the secure RAM 22.

[0083] The decompression processing unit 41 stores the encrypted control program in the non-secure RAM 23 for control programs for which the second decompression method is set. The decompression processing unit 41 stores the encrypted control program transferred from the ROM 24 in the non-secure RAM 23. Before executing the control program, the decompression processing unit 41 transfers the encrypted control program to the secure RAM 22. The decompression processing unit 41 decrypts the encrypted control program transferred to the secure RAM 22 and expands the plaintext control program into the temporary decompression area of ​​the secure RAM 22.

[0084] The decompression processing unit 41 decrypts the encrypted control program for control programs for which the third decompression method is set, and decompresses the plaintext control program into the non-secure RAM 23. Alternatively, for control programs for which the third decompression method is set and which are stored in plaintext in the ROM 24, the decompression processing unit 41 decompresses the plaintext control program transferred from the ROM 24 into the non-secure RAM 23. With the above, the decompression processing unit 41 completes the operation according to the procedure shown in Figure 6.

[0085] Next, the operation of the expansion processing unit 41 and the program execution unit 42 when the control device 2 executes a control program will be described. Figure 7 is a flowchart showing an example of the operation procedure of the expansion processing unit 41 and the program execution unit 42 when the control device 2 according to Embodiment 1 executes a control program. Here, an example of operation when executing a repetitive type control program, that is, when executing repetitive processing, will be described. The operation described here is executed each time the program switching of the control processor 21 occurs. The program switching is assumed to include input / output processing. Hereafter, input / output processing will be referred to as "I / O processing".

[0086] In step S21, the program execution unit 42 determines whether there are any control programs in the iterative process that have not yet been executed. The program execution unit 42 determines whether there are any control programs of the iterative type that have not yet been executed. If there are control programs that have not yet been executed (step S21, Yes), the program execution unit 42 proceeds to step S22. If there are no control programs that have not yet been executed (step S21, No), the program execution unit 42 proceeds to step S27.

[0087] In step S22, the program execution unit 42 determines whether the deployment method for the next control program to be executed is the second deployment method. The next control program to be executed is the control program to be executed after the control program that has just completed execution. The program execution unit 42 identifies the next control program to be executed based on the "execution order" of the control program information. The program execution unit 42 determines whether the deployment method for the identified control program is the second deployment method by referring to the deployment method shown in the control program information.

[0088] If the method for unpacking the control program to be executed next is the second unpacking method (step S22, Yes), then in step S23, the unpacking processing unit 41 transfers the encrypted control program from the non-secure RAM 23 to the secure RAM 22. The unpacking processing unit 41 transfers the encrypted control program stored in the non-secure RAM 23 to the secure RAM 22.

[0089] In step S24, the decompression processing unit 41 decodes the control program transferred to the secure RAM 22. The decompression processing unit 41 expands the control program, which is in plain text, into the secure RAM 22. In step S25, the decompression processing unit 41 executes the control program that was expanded in step S24.

[0090] If the method for deploying the control program to be executed next is not the second deployment method (step S22, No), then in step S26, the program execution unit 42 executes the control program deployed according to the procedure shown in Figure 6. The program execution unit 42 executes the control program deployed to the secure RAM 22 by the first deployment method. Alternatively, the program execution unit 42 executes the control program deployed to the non-secure RAM 23 by the third deployment method.

[0091] In step S27, the program execution unit 42 executes I / O processing. With this, the expansion processing unit 41 and the program execution unit 42 complete their operations according to the procedure shown in Figure 7.

[0092] Furthermore, when the expansion processing unit 41 and the program execution unit 42 execute an event-type control program, they perform the same operations as in steps S22 to S26 when an event occurs.

[0093] A second deployment method may be defined as a method for deploying the system program. In this case, the control device 2 performs the transfer, decoding, and deployment of the system program in the same manner as in the case of a control program for which the second deployment method is set.

[0094] Figure 8 is a diagram illustrating the operation transitions of the control processor 21 of the control device 2 according to Embodiment 1. In Figure 8, time progresses from left to right. Here, we will explain the operation transitions when executing control programs A to C, which are iterative control programs. For example, in Figure 8, the rectangle labeled "Control Program A" represents the period during which control program A is executed. The rectangle labeled "Control Program B Transfer / Decoding" represents the period during which control program B is transferred and decoded.

[0095] Control program A is deployed by the first deployment method. At the start of the operation shown in Figure 8, control program A is deployed in secure RAM 22. Control programs B and C are deployed by the second deployment method. At the start of the operation shown in Figure 8, control programs B and C are encrypted and held in non-secure RAM 23.

[0096] The control processor 21 executes control programs A to C in the order indicated in the "execution order" of the control program information. After executing control program A, the control processor 21 transfers and decodes control program B, and then executes control program B. After executing control program B, the control processor 21 transfers and decodes control program C, and then executes control program C. After executing control program C, the control processor 21 performs I / O processing. The period from the start of execution of control program A until the completion of I / O processing corresponds to the scan time. The control processor 21 repeats the execution of control programs A to C and the execution of I / O processing.

[0097] In the above, the control device 2 is configured to deploy each control program using a deployment method specified from among three deployment methods. However, the deployment methods that can be specified for deploying each control program are not limited to three; there may be multiple deployment methods. The deployment method determination unit 31 is not limited to determining the deployment method for each control program from among three deployment methods. The deployment method determination unit 31 may determine the deployment method for each control program from among multiple deployment methods.

[0098] According to Embodiment 1, the control device 2 includes a first holding unit capable of holding a control program, a second holding unit capable of holding a control program and having greater security than the first holding unit, an unpacking processing unit 41 that unpacks the control program using an unpacking method determined from among a plurality of unpacking methods using the first or second holding unit, and a program execution unit 42 that executes the unpacked control program. The control device 2 can protect the control program when the data size of the control program to be protected exceeds the size of the area of ​​the second holding unit, by determining an unpacking method using the first holding unit. By determining the unpacking method of the control program from among a plurality of unpacking methods, it is possible to reduce the deterioration of the control performance of the control device due to the protection of the control program. As a result, the control device 2 can protect the control program and reduce the deterioration of the control performance of the control device 2.

[0099] Multiple deployment methods may include a first deployment method in which the control program is deployed to a second storage unit; a second deployment method in which the encrypted control program is stored in the first storage unit when the control program is not being executed, and when the control program is being executed, the encrypted control program stored in the first storage unit is transferred to the second storage unit and the decrypted control program is deployed to the second storage unit; and a third deployment method in which the control program is deployed to the first storage unit. The control device 2 can protect the control program that is to be protected by the first deployment method or the second deployment method.

[0100] According to Embodiment 1, the program creation support device 3 determines a method for deploying the control program from among multiple deployment methods and outputs information indicating the determined deployment method to the control device 2. The program creation support device 3 may also request the setting of protection attributes, including whether or not protection of the control program is necessary, and determine the method for deploying the control program based on the set protection attributes. This makes it possible for the program creation support device 3 to protect control programs that require protection.

[0101] The program creation support device 3 may also request the setting of protection attributes, including a priority for preventing latency degradation associated with the protection of control programs. This allows the program creation support device 3 to protect control programs with high priority while suppressing latency degradation.

[0102] The program creation support device 3 may estimate the control performance of the control device 2 when the control program is executed, and if it is determined that the estimated value showing the control performance does not fall within the required range, it may present improvement proposals that enable improvement of the control performance. In this way, the program creation support device 3 can protect the control program while keeping the control performance of the control device 2 within the required range.

[0103] Embodiment 2. Embodiment 2 describes an example in which the transfer and decoding in the second deployment method are performed in parallel with the execution of the control program. In Embodiment 2, the same reference numerals are used for the same components as in Embodiment 1, and the description mainly focuses on configurations that differ from Embodiment 1.

[0104] Figure 9 shows an example configuration of control device 2A according to Embodiment 2. Control device 2A has the same configuration as control device 2 shown in Figure 1. Furthermore, control device 2A includes a transfer processor 26 and a decryption processor 27. The transfer processor 26 and the decryption processor 27 are located in a secure area.

[0105] The functional configuration of the control device 2A is the same as that of the control device 2 shown in Figure 2. The decompression processing unit 41 of the control device 2A performs the transfer and decoding of one of the multiple control programs in parallel with the execution of one of the multiple control programs by the program execution unit 42. The function of transferring the control program is realized by using the transfer processor 26. The function of decoding the control program is realized by using the decoding processor 27. The configuration of the program creation support device 3 according to Embodiment 2 is the same as that of the program creation support device 3 shown in Figures 1 and 2.

[0106] Figure 10 is a flowchart showing an example of the operation procedure of the expansion processing unit 41 and the program execution unit 42 when the control device 2A according to Embodiment 2 executes a control program. Here, an example of operation when executing a repetitive type control program, that is, when executing repetitive processing, will be described. The operation described here is executed each time the program switching of the control processor 21 occurs.

[0107] In step S31, the program execution unit 42 determines whether the deployment method for the next control program to be executed is the second deployment method. The next control program to be executed is the control program to be executed immediately after the control program that has just completed execution. The program execution unit 42 identifies the next control program to be executed based on the "execution order" of the control program information. The program execution unit 42 determines whether the deployment method for the identified control program is the second deployment method by referring to the deployment method shown in the control program information.

[0108] If the method for deploying the control program to be executed next is the second deployment method (step S31, Yes), in step S32, the program execution unit 42 instructs the deployment processing unit 41 to start the transfer and decryption. The deployment processing unit 41 follows the instruction and starts the transfer and decryption of the control program to be executed next. The deployment processing unit 41 transfers the encrypted control program from the non-secure RAM 23 to the secure RAM 22. The deployment processing unit 41 decrypts the control program transferred to the secure RAM 22. If the method for deploying the control program to be executed next is not the second deployment method (step S31, No), the program execution unit 42 skips step S32.

[0109] Steps S33 and S34 are the same as steps S21 and S22 shown in Figure 7. If there is a control program among all the control programs in the iterative process that has not yet been executed (step S33, Yes), the program execution unit 42 proceeds to step S34. If there is no control program among all the control programs in the iterative process that has not yet been executed (step S33, No), the program execution unit 42 proceeds to step S38.

[0110] If the method for unpacking the control program to be executed next is the second unpacking method (step S34, Yes), in step S35, the program execution unit 42 waits until the transfer and decryption initiated by the instruction in step S32 are completed. Once decryption is complete, the unpacking processing unit 41 unpacks the control program, which is in plain text, into the secure RAM 22. In step S36, the program execution unit 42 executes the unpacked control program.

[0111] If the method for unpacking the control program to be executed next is not the second unpacking method (step S34, No), the program execution unit 42 proceeds to step S37. Steps S37 and S38 are the same as steps S26 and S27 shown in Figure 7. With this, the unpacking processing unit 41 and the program execution unit 42 complete their operations according to the procedure shown in Figure 10.

[0112] Furthermore, when executing an event-type control program, it is difficult to predict when an event will occur. The decompression processing unit 41 and the program execution unit 42 execute the event-type control program using the same procedure as in Embodiment 1, without using the transfer processor 26 and the decoding processor 27.

[0113] The operation of the deployment method determination unit 31 in Embodiment 2 is the same as in Embodiment 1. However, the estimated scan time D is obtained by the above equation (2). scan When writing, d trans _ dec _ scanThis value takes into account that the transfer by the transfer processor 26 and the decoding by the decoding processor 27 are performed in parallel with the execution of the control program.

[0114] Figure 11 is a diagram illustrating the operational transitions of the control processor 21, transfer processor 26, and decoding processor 27 of the control device 2A according to Embodiment 2. In Figure 11, time progresses from left to right. Here, we will explain the operational transitions when executing control programs A to C, which are iterative control programs.

[0115] The control processor 21 executes control programs A to C in the order indicated in the "execution order" of the control program information. The transfer processor 26 and the decoding processor 27 transfer and decode control program B in parallel with the execution of control program A by the control processor 21. After the transfer and decodement of control program B are completed, the control processor 21 executes control program B. The transfer processor 26 and the decoding processor 27 transfer and decode control program C in parallel with the execution of control program B by the control processor 21.

[0116] In the example shown in Figure 11, the transfer and decoding of control program C are assumed to be completed before the execution of control program B is completed. The control processor 21 starts executing control program C after the execution of control program B is completed. After executing control program C, the control processor 21 performs I / O processing.

[0117] According to Embodiment 2, the unpacking processing unit 41 performs the transfer and decoding of one of the multiple control programs in parallel with the execution of one of the multiple control programs by the program execution unit 42. As a result, the control device 2 can shorten the scan time for executing the control program and reduce the deterioration of the control performance of the control device 2.

[0118] Embodiment 3. Embodiment 3 describes an example of a proposed change in the order in which the control program is executed. In Embodiment 3, the same reference numerals are used for components that are the same as those in Embodiment 1 or 2, and the description will mainly focus on configurations that differ from those in Embodiment 1 or 2.

[0119] The control device 2A according to Embodiment 3 has the same configuration as the control device 2A shown in Figure 9. The functional configuration of the control device 2A is the same as the functional configuration of the control device 2 shown in Figure 2. The configuration of the program creation support device 3 according to Embodiment 3 is the same as the configuration of the program creation support device 3 shown in Figures 1 and 2.

[0120] In Embodiment 3, the deployment method determination unit 31 determines that the control performance of the control device 2 will be improved by changing the order in which the control programs are executed as specified by the user, and proposes to the user that the order in which the control programs are executed be changed.

[0121] The deployment method determination unit 31 operates in the same manner as shown in Figure 5. When creating an improvement plan for control performance, the deployment method determination unit 31 searches for an execution order of multiple control programs that is expected to increase the parallelism of the processes executed by the control device 2. Here, suppose the search by the deployment method determination unit 31 leads to an order different from the order shown in the "execution order" of the control program information. In this case, the deployment method determination unit 31 proposes to the user that they change the execution order of the multiple control programs from the order specified by the user to the order derived by the deployment method determination unit 31.

[0122] For example, in step S8 shown in Figure 5, the deployment method determination unit 31 presents the user with an improvement proposal that includes a suggestion to change the execution order of the multiple control programs. The user can then refer to the improvement proposal and reset the execution order of the multiple control programs. In addition to presenting the improvement proposal in step S8, the deployment method determination unit 31 may also present the user with an improvement proposal for the execution order.

[0123] Figure 12 is a diagram illustrating an example in which the execution order of multiple control programs is changed in Embodiment 3. Figure 12 shows an example of control program information in which the "execution order" has been changed. Here, the execution order shown in the control program information shown in Figure 4 is considered the execution order before the change. In the execution order after the change, control program B and control program C are swapped in the execution order before the change.

[0124] Figure 13 is a diagram illustrating the operational transitions of the control processor 21, the transfer processor 26, and the decoding processor 27 when the execution order of multiple control programs is changed in Embodiment 3. Figure 13 shows the operational transitions of the control processor 21, the transfer processor 26, and the decoding processor 27 when the execution order of multiple control programs is changed, as shown in Figure 12. In Figure 13, time progresses from left to right. Figure 13 shows the operational transitions after the execution order has been changed. The operational transitions shown in Figure 11 are assumed to be the operational transitions before the execution order was changed.

[0125] As shown in Figure 11, the execution order before the change is control program A, control program B, and control program C. In contrast, as shown in Figure 13, the execution order after the change is control program A, control program C, and control program B. By changing the execution order in this way, the scan time in the case shown in Figure 13 is shortened compared to the case shown in Figure 11. The deployment method determination unit 31 searches for an execution order that enables this shortening of the scan time.

[0126] According to Embodiment 3, when the program creation support device 3 determines that the control performance of the control device 2 can be improved by executing multiple control programs in a different order specified by the user, it presents an improvement plan that includes a suggestion for changing the order. This allows the program creation support device 3 to prompt the user to make settings that improve the control performance of the control device 2.

[0127] The configurations shown in each of the embodiments described above are examples of the content of this disclosure. The configurations of each embodiment can be combined with other known technologies. The configurations of each embodiment may be combined with each other as appropriate. It is possible to omit or modify parts of the configurations of each embodiment without departing from the gist of this disclosure.

[0128] 1 Control system, 2, 2A Control device, 3 Program creation support device, 4 Controlled device, 11 Processor, 12 RAM, 13, 24 ROM, 14, 25 Input / Output I / F, 15 User I / F, 21 Control processor, 22 Secure RAM, 23 Non-secure RAM, 26 Transfer processor, 27 Decryption processor, 31 Expansion method determination unit, 41 Expansion processing unit, 42 Program execution unit.

Claims

1. A control device for controlling a controlled device by executing a control program, comprising: a first holding unit capable of holding the control program; a second holding unit capable of holding the control program and having greater security than the first holding unit; an unpacking processing unit for unpacking the control program using an unpacking method determined from a plurality of unpacking methods using the first holding unit or the second holding unit; and a program execution unit for executing the unpacked control program.

2. The control device according to claim 1, characterized in that the plurality of deployment methods include: a first deployment method for deploying the control program to the second holding unit; a second deployment method for holding the encrypted control program in the first holding unit when the control program is not being executed, and when the control program is being executed, transferring the encrypted control program held in the first holding unit to the second holding unit and deploying the decrypted control program to the second holding unit; and a third deployment method for deploying the control program to the first holding unit.

3. The control device according to claim 1 or 2, characterized in that the decompression processing unit performs the transfer and decoding of one of the multiple control programs in parallel with the execution of one of the multiple control programs by the program execution unit.

4. A program creation support program for assisting the creation of a control program to be executed by a control device that controls a controlled device, characterized in that it causes a computer system to perform the following steps: determining a method for deploying the control program from among a plurality of deployment methods using a first holding unit having the control device that is capable of holding the control program, or a second holding unit having the control device that is capable of holding the control program and has higher security than the first holding unit; and outputting information indicating the determined deployment method to the control device.

5. The program creation support program according to claim 4, characterized in that the computer system is made to perform a step of requesting the setting of protection attributes, including whether or not protection of the control program is necessary, and in the step of determining the deployment method of the control program, the deployment method is determined based on the set protection attributes.

6. The program creation support program according to claim 5, characterized in that the step of requesting the setting of the protection attributes includes requesting the setting of the protection attributes to include a priority for preventing the deterioration of latency associated with the protection of the control program.

7. The program creation support program according to claim 5 or 6, characterized in that it causes the computer system to perform the steps of: estimating the control performance of the control device when the control program is executed; and, if it is determined that the estimated value showing the result of the control performance estimation does not fall within the required range, presenting an improvement plan that enables improvement of the control performance.

8. The program creation support program according to claim 7, characterized in that, in the step of presenting the improvement proposal, if it is determined that the control performance of the control device can be improved by changing the order in which the multiple control programs are executed, the program creation support program presents the improvement proposal, including a suggestion for changing the order.

9. A control system comprising: a control device that controls a controlled device by executing a control program; and a program creation support device that assists in the creation of the control program, wherein the control device has a holding unit having a first holding unit capable of holding the control program and a second holding unit capable of holding the control program and having greater security than the first holding unit; an expansion processing unit that expands the control program into the holding unit; and a program execution unit that executes the expanded control program, wherein the program creation support device comprises an expansion method determination unit that determines an expansion method for the control program by the expansion processing unit from among a plurality of expansion methods using the first holding unit or the second holding unit, and the expansion processing unit expands the control program according to the determined expansion method.

10. A control method for controlling a device to be controlled by a control system comprising a control device for controlling the device by executing a control program, and a program creation support device for assisting in the creation of the control program, the method comprising: determining a method for deploying the control program from among a plurality of deployment methods using a first holding unit capable of holding the control program, or a second holding unit capable of holding the control program and having greater security than the first holding unit; deploying the control program using the determined deployment method; and executing the deployed control program.

Images