Patent Description:
In various manufacturing sites, control apparatuses such as programmable logic controllers (PLCs), etc., have been introduced. Such control apparatus is a computer and executes a control program designed in correspondence with a manufacturing apparatus or manufacturing equipment. The control apparatus is connected with various apparatuses in or outside a factory via a relay.

For example, <CIT> (Patent Document <NUM>) discloses a control apparatus communicably connected with a cloud system outside a factory via a router as an example of the relay.

In addition, <CIT> (Patent Document <NUM>) discloses a control apparatus communicably connected with another control apparatus via a router as an example of the relay.

Patent literature <CIT> relates to a model-based industrial security policy configuration system implementing a plant-wide industrial asset security policy in accordance with security policy definitions provided by a user. The configuration system models the collection of industrial assets for which diverse security policies are to be implemented. An interface allows the user to define security policies for a plant environment at a high-level by grouping the industrial assets into security zones, and defining any additional communication permissions in terms of asset-to-asset, asset-to-zone, or zone-to-zone conduits.

Patent literature <CIT> relates to a plant control system including at least one control apparatus, and an engineering apparatus for changing a security state of the control apparatus. The control apparatus includes: a security management part for accepting a security level change request downloaded from the engineering apparatus and changing a security level of the control apparatus by referring to a password held by the control apparatus; and a change permission part for permitting a change in the security level by the security management part.

Like the control apparatus disclosed in Patent Document <NUM>, with the progress in information and communication technology (ICT) in recent years, control apparatuses are connected with various external apparatuses via a network. In addition, the processing executed in the control apparatus has become more sophisticated. With such networking or intelligentization, various security threats may occur to the control apparatus.

In the conventional control apparatus, no security events, including security threats that may occur through networking or intelligentization, is anticipated.

An objective of the invention is to solve the new issue of appropriately protecting a control apparatus and a controller system including the control apparatus against security events which may occur through the networking or the intelligentization of the control apparatus and the control system.

The following disclosure serves a better understanding of the present invention. According to the invention, a support apparatus is provided according to claim <NUM>. The support apparatus includes: a forming/editing part, providing a first user interface for forming or editing a user program defining contents of a control arithmetic operation executed by the control apparatus which executes a control arithmetic operation for controlling a control target; and an output part outputting the user program formed via the first user interface provided by the forming/editing part. In the step of providing the first user interface, as an instruction constituting the user program, the forming/editing part provides a second user interface which receives a selection of a change instruction for changing a behavior of a security monitoring device, said changing a behavior being carried out by executing the security protection process in correspondence with one of security levels in accordance with at least one of action states of the control apparatus including a detection of a security event which is possible to occur in the control apparatus and including an execution of a process in correspondence with the security event. The second user interface includes a level corresponding region for associating an action state of the control apparatus with a respective security level, the level corresponding region includes a state displaying region in which the action state of the control apparatus is defined and a level input region in which the security level corresponding to the respective action state is received.

According to the disclosure, an environment capable of changing the behavior of the security monitoring device is provided. As a result, an environment for appropriately protecting the controller system against a security event which may occur is provided.

In the above disclosure, the forming/editing part provides a user interface receiving setting of an execution condition of the change instruction.

According to the disclosure, since the condition for changing the behavior of the security monitoring device can be changed, a security environment in correspondence with a situation in which a security event occurs can be provided.

In the above disclosure, the change instruction includes a change instruction for determining a value of an output signal indicating the behavior of the security monitoring device carried out by executing the security protection process with respect to an input signal indicating an action state of the control apparatus. In the case where the change instruction is selected, the forming/editing part provides a user interface receiving setting of a correspondence relationship between the input signal and the output signal.

According to the disclosure, an environment for taking security countermeasures in correspondence with the action state of the control apparatus is provided.

In the above disclosure, the forming/editing part provides a user interface for setting the behavior of the security monitoring device.

In the above disclosure, the behavior of the security monitoring device includes setting of a connection condition for connecting the controller system with an outside network. The forming/editing part provides a user interface for setting contents of the connection condition.

According to the disclosure, since the connection for connection with an outside network can be set in correspondence with the action state of the control apparatus, a communication limitation can be applied according to the situation, and an environment for taking security countermeasures with flexibility is provided.

According to the invention, an assistance program is provided according to claim <NUM>. The assistance program assists in development of the user program executed by the control apparatus which executes the control arithmetic operation for controlling the control target included in the controller system.

According to the invention, a control system is defined according to claim <NUM>.

According to the disclosure, an environment capable of changing the behavior of the security monitoring device is provided. As a result, an environment for appropriately protecting the control apparatus against a security event that may occur is provided.

The control apparatus and the controller system including the control apparatus can be appropriately protected against a security event that may occur.

Hereinafter, embodiments according to the invention will be described with reference to the drawings. In the following description, the same parts and components are designated by the same reference numerals. The names and functions thereof are also the same. Therefore, detailed descriptions thereof will not be repeated. In addition, each embodiment and each modification described below may be selectively combined as appropriate.

With reference to <FIG>, an example of the situation to which the invention is applied is described. <FIG> is a diagram illustrating an example of a control system 10a centering on a controller system 1a. <FIG> is a diagram illustrating a situation in which a security event with respect to a control apparatus 100a may occur. <FIG> is a diagram illustrating an example of a functional configuration of a support apparatus and a controller system connected with the support apparatus.

The controller system 1a includes the control apparatus 100a and the security monitoring device 200a. The control apparatus 100a and the security monitoring device 200a are communicably connected via any data transmission path, such as PCI Express or Ethernet (registered trademark).

The control apparatus 100a executes a control arithmetic operation for controlling a control target, and executes a core process in the controller system 1a. The control apparatus 100a has one or more communication ports. In the example shown in <FIG>, the control apparatus 100a has communication ports 142a, 144a, 146a, and 148a.

The control apparatus 100a is communicably connected with a support apparatus 600a via the communication port 142a. The support apparatus 600a provides the user with functions, such as creating, debugging, and setting various parameters of programs executed by respective apparatuses included in the controller system 1a. A program created by the user by using the support apparatus 600a is referred to as a user program 1086a. The user program 1086a is transmitted from the support apparatus 600a to the control apparatus 100a, and is executed by the control apparatus 100a. The support apparatus 600a and the control apparatus 100a are typically connected by using a universal serial bus (USB) cable.

The user program 1086a may also be stored in a storage medium such as a memory card 115a. In the example shown in <FIG>, the control apparatus 100a is provided with a memory card interface 114a and configured so that the memory card 115a is removable, and can read the user program 1086a stored in the memory card 115a.

The control apparatus 100a is communicably connected with a field device 500a via the communication port 144a. The field device 500a includes a sensor or a detector which collects various information required for the control arithmetic operation from the control target and an actuator which exerts a function with respect to the control target. Typically, EtherCAT (registered trademark) is used as the communication protocol between the field device 500a and the control apparatus 100a.

The control apparatus 100a is communicably connected with one or more human machine interfaces (HMIs) 800a via the communication port 146a. The HMI 800a notifies the operator with various information obtained from the control arithmetic operation in the controller system 1a and generates an internal command with respect to the controller system 1a in accordance with the operation from the operator. Typically, EtherNET/IP (registered trademark) is used as the communication protocol between the HMI 800a and the control apparatus 100a.

The control apparatus 100a is communicably connected with a database 950a via the communication port 148a. The database 950a collects various data (e.g., information relating to the traceability and measured from the work as the control target) transmitted from the controller system 1a. The database 950a may be communicably connected with the control apparatus 100a via an internal network, and may also be connected with the control apparatus 100a via a virtual private network (VPN). In the example shown in <FIG>, EtherNet/IP (registered trademark) is used as the communication protocol between the database 950a and the control apparatus 100a.

The security monitoring device 200a is responsible for the security function with respect to the controller system 1a and executes a security protection process with respect to the controller system 1a. The security protection process will be described in greater detail in the following. The security monitoring device 200a has one or more communication ports. In the example shown in <FIG>, the security monitoring device 200a has a communication port 242a.

The security monitoring device 200a is communicably connected with the support apparatus 600a or a supervisory control and data acquisition (SCADA) apparatus 750a. The communication between the security monitoring device 200a and the support apparatus 600a and the communication between the security monitoring device 200a and the SCAD apparatus 750a are typically performed by using a VPN.

The support apparatus 600a, for example, realizes remote maintenance of the controller system 1a through communicable connection with the security monitoring device 200a via the VPN.

The SCADA apparatus 750a notifies the operator with various information obtained from the control arithmetic operation in the controller system 1a and generates an internal command with respect to the controller system 1a in accordance with the operation from the operator. The SCADA apparatus <NUM> also has a function of collecting data handled by the controller system 1a.

Referring to <FIG>, the situation in which a security event with respect to the control apparatus 100a may occur is described. Here, a "security event" covers any event which obstructs the normal operation of the equipment or machine included in the control system 10a as well as an event which may be related to such event.

In addition, "normal operation" also covers an ancillary process, such as the start-up, maintenance, and setup changes of the equipment or machine in order for the equipment or machine to continue operating according to the system design and the production plan.

In the control apparatus 100a, typically, there is a risk that a security event may occur in: (<NUM>) the communication with a superordinate apparatus such as the database 950a, (<NUM>) the communication with the control target, such as the field device 500a, (<NUM>) the communication with an apparatus which exerts a change to the control program executed by the control apparatus 100a, or (<NUM>) the communication with an external apparatus. In addition, all the physical ports provided in the control apparatus 100a bear a risk that a security event may occur. Here, the concept of the control program includes, in addition to the user program 1086a, a system program providing basic functions as the control apparatus 100a.

The security monitoring device 200a executes the security protection process, including processes of detecting a security event which may occur in the controller system 1a and responding to a security event, in various situations. The process for responding to a security event includes a process related to at least one of preventing a security event which may occur in the controller system 1a and coping with a detected security event.

The user program 1086a executed by the control apparatus 100a includes a change instruction 860a for changing the behavior of the security monitoring device 200a carried out by executing the security protection process. By executing the change instruction 860a, at least one of the prevention with respect to the security event and the coping with respect to the detected security event executed by the security monitoring device 200a can be changed.

The support apparatus 600a provides a user interface for selecting the change instruction 860a in the formation of the user program 1086a. The user interface is realized by using a display part, such as a display, and an input part, such as a mouse and a keyboard, included in the support apparatus 600a.

Referring to <FIG>, the support apparatus includes a forming/editing part 602a for providing a user interface for forming or editing a user program and an output part 620a outputting the user program formed via the user interface provided by the forming/editing part.

Here, the user program 1086a output by the support apparatus 600a may be a program written in object codes after compilation, and may also be a program written in source codes before compilation.

The forming/editing part 602a, for example, is a function expressed by executing various programs by a processor included in the support apparatus 600a.

The output part 620a may be a USB controller for directly outputting the user program 1086a to the control apparatus 100a, and may also be a memory card interface for outputting the user program 1086a to the memory card 115a, and may also be an interface for communicable connection with another apparatus (e.g., the security monitoring device 200a) communicably connected with the control apparatus 100a.

The control apparatus 100a includes a program execution part 102a executing a user program and a communication interface 110a for connection with the security monitoring device 200a.

When executing the user program including the change instruction formed via the user interface provided by the support apparatus 600a, the program execution part 102a notifies the security monitoring device 200a with an instruction for changing the contents of the security protection process executed by the security monitoring device 200a. The program execution part 102a is a function expressed by executing a system program by a processor included in the control apparatus 100a.

The security monitoring device 200a receives the instruction from the control apparatus 100a to change the contents of the security protection process. For example, in the case shown in <FIG>, the security monitoring device 200a changes the contents of the security protection process from an execution content A to an execution content B.

Accordingly, with the support apparatus 600a providing a user interface capable of selecting the change instruction, an environment capable of changing the behavior of the security monitoring device 200a is provided. As a result, an environment for appropriately protecting the controller system against a security event which may occur is provided.

<FIG> is a view illustrating an appearance of a configuration example of the controller system <NUM> according to an embodiment. The controller system <NUM> includes a control unit <NUM>, a security unit <NUM>, a safety unit <NUM>, one or more function units <NUM>, and a power unit <NUM>.

The control unit <NUM> and the security unit <NUM> are connected via any data transmission path, such as PCI Express or Ethernet (registered trademark). The control unit <NUM> and the safety unit <NUM> as well as the one or more function units <NUM> are connected via an internal bus not shown herein.

The control unit <NUM> is an example of the control apparatus performing the control arithmetic operation for controlling the control target, and executes a core process in the controller system <NUM>. The control unit <NUM> executes the control arithmetic operation for controlling the control target in accordance with arbitrarily designed requirements. Relative to the control arithmetic operation executed by the safety unit <NUM> described in the following, the control arithmetic operation executed by the control unit <NUM> is referred to as "standard control". In the configuration shown in <FIG>, the control unit <NUM> has one or more communication ports.

The security unit <NUM> is connected with the control unit <NUM>, and is responsible for the security function with respect to the controller system <NUM>. The security unit <NUM> is an example of the security monitoring device executing the security protection process. In the configuration shown in <FIG>, the security unit <NUM> has one or more communication ports. The security function provided by the security unit <NUM> will be described in detail in the following.

The safety unit <NUM> is independent from the control unit <NUM>, and executes the control arithmetic operation for realizing the safety function related to the control target. The control arithmetic operation executed by the safety unit <NUM> is referred to as "safety control". Normally, "safety control" is designed to meet the requirements for realizing the safety functions defined in IEC <NUM>. "Safety control" is a general term for processes for preventing human safety from being threatened by equipment or machines.

The function units <NUM> provide various functions for realizing the control with respect to various control targets by the controller system <NUM>. The function units <NUM> may typically include an I/O unit, a safety I/O unit, a communication unit, a motion controller unit, a temperature adjustment unit, a pulse counter unit, etc. Examples of the I/O unit include a digital input (DI) unit, a digital output (DO) unit, an analog output unit (AI), an analog output (AO) unit, a pulse catch input unit, and a composite unit in which multiple types are mixed. The safety I/O unit handles an I/O process related to safety control.

The power unit <NUM> supplies power at a preset voltage to the respective units forming the controller system <NUM>.

In the following, the hardware configuration example of the respective units forming the controller system <NUM> will be described according to the embodiment.

<FIG> is a schematic diagram illustrating a hardware configuration example of the control unit <NUM> constituting the controller system <NUM> according to an embodiment. The control unit <NUM> includes, as main components, a processor <NUM> such as a central processing unit (CPU) or a graphical processing unit (GPU), a chipset <NUM>, a main storage apparatus <NUM>, a secondary storage apparatus <NUM>, a communication controller <NUM>, a universal serial bus (USB) controller <NUM>, a memory card interface <NUM>, network controllers <NUM>, <NUM>, and <NUM>, an internal bus controller <NUM>, and an indicator <NUM>.

By reading various programs stored in the secondary storage apparatus <NUM> and expanding the programs in the main storage apparatus <NUM>, the processor <NUM> realizes the control arithmetic operation relating to the standard control as well as various processes to be described in the following. That is, the processor <NUM> has the function as a program execution part that executes a program. By mediating the data exchange among the processor <NUM> and the respective components, the chipset <NUM> realizes the processes of the control unit <NUM> as a whole.

In addition to the system program, the secondary storage apparatus <NUM> stores a control program that operates in the execution environment provided by the system program.

The communication controller <NUM> handles the data exchange with the security unit <NUM>. As the communication controller <NUM>, a communication chip compatible with PCI Express or Ethernet can be adopted, for example.

The USB controller <NUM> is equivalent to a communication port and handles the data exchange with an arbitrary information processing apparatus via USB connection. Specifically, the USB controller <NUM> handles the data exchange with a support apparatus <NUM>. The support apparatus <NUM> is at least able to access the control unit <NUM> and provides the user with functions, such as creating, debugging, and setting various parameters of programs executed by respective units included in the controller system 1a.

The memory card interface <NUM> is configured so that a memory card <NUM> is removable, and is capable of writing data of the control program or the respective settings to the memory card <NUM>, or capable of reading data of the control program or the respective settings from the memory card <NUM>.

The network controller <NUM> handles the data exchange with one or more field devices <NUM>. The field device <NUM> includes a sensor or a detector which collects various information required for the control arithmetic operation from the control target and an actuator which exerts a function with respect to the control target. The field device <NUM> includes a robot that exerts an external function with respect to the work, a conveyor that conveys the work, and an I/O unit that exchanges signals with a sensor or an actuator provided in the field.

The network controller <NUM> handles the data exchange with an HMI 800a. The HMI 800a notifies the operator with various information obtained from the control arithmetic operation in the controller system <NUM> and generates an internal command, etc., with respect to the controller system <NUM> in accordance with the operation from the operator.

The network controller <NUM> handles the data exchange with a database <NUM>. The database <NUM> collects various data (e.g., information relating to the traceability measured from each work) transmitted from the controller system <NUM>.

Each of the network controllers <NUM>, <NUM>, and <NUM> is equivalent to a communication port, and may adopt an industrial network protocol, such as EtherCAT (registered trademark), Ethernet/IP (registered trademark), DeviceNet (registered trademark), CompoNet (registered trademark), etc..

The internal bus controller <NUM> handles the data exchange with the safety unit <NUM> forming the controller system <NUM> or the one or more function units <NUM>. In the internal bus, a communication protocol inherently provided by the manufacturer may be used, or a communication protocol same as or compliant with an industrial network protocol may be adopted.

The indicator <NUM> notifies the action state, etc., of the control unit <NUM>, and is configured as one or more LEDs provided on the unit surface.

In <FIG>, while a configuration example in which required functions are provided by the processor <NUM> executing the programs, some or all of the provided functions may also be implemented by using a dedicated hardware circuit (e.g., an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA), etc.,). Alternatively, the main parts of the control unit <NUM> may be realized by using hardware (e.g., an industrial personal computer based on a general-purpose personal computer) following a general-purpose architecture. In such case, by using virtualization technology, multiple operating systems (OSs) with different purposes may be executed in parallel, and required applications may be executed in the respective OSs.

<FIG> is a schematic diagram illustrating a hardware configuration example of the security unit <NUM> constituting the controller system <NUM> according to an embodiment. The security unit <NUM> includes, as main components, a processor <NUM> such as a CPU or a GPU, a chipset <NUM>, a main storage apparatus <NUM>, a secondary storage apparatus <NUM>, a communication controller <NUM>, a USB controller <NUM>, a memory card interface <NUM>, a network controller <NUM>, and an indicator <NUM>.

By reading various programs stored in the secondary storage apparatus <NUM> and expanding the programs in the main memory apparatus <NUM>, the processor <NUM> realizes various security functions to be described in the following. By mediating the data exchange among the processor <NUM> and the respective components, the chipset <NUM> realizes the processes of the security unit <NUM> as a whole.

In addition to the system program, the secondary storage apparatus <NUM> also stores the security system program that operates in the execution environment provided by the system program.

The communication controller <NUM> handles the data exchange with the control unit <NUM>. As the communication controller <NUM>, like the communication controller <NUM> in the control unit <NUM>, a communication chip compatible with PCI Express or Ethernet can be adopted, for example.

The USB controller <NUM> handles the data exchange with an arbitrary information processing apparatus via USB connection. Typically, the USB controller <NUM> handles the data exchange with the support apparatus <NUM>.

The network controller <NUM> handles the data exchange with an arbitrary apparatus via a network. The network controller <NUM> may adopt a general-purpose network protocol, such as the Ethernet (registered trademark). Via the network, for example, the support apparatus <NUM> and the SCADA apparatus <NUM> may be connected.

The SCADA apparatus <NUM> notifies the operator with various information obtained from the control arithmetic operation in the controller system <NUM> and generates an internal command, etc., with respect to the controller system <NUM> in accordance with the operation from the operator. The SCADA apparatus <NUM> has a function of collecting data handled by the controller system <NUM>.

The indicator <NUM> notifies the action state, etc., of the security unit <NUM>, and is configured as one or more LEDs provided on the unit surface.

In <FIG>, while a configuration example in which required functions are provided by the processor <NUM> executing the programs, some or all of the provided functions may also be implemented by using a dedicated hardware circuit (e.g., ASIC or FPGA). Alternatively, the main parts of the security unit <NUM> may be realized by using hardware (e.g., an industrial personal computer based on a general-purpose personal computer) following a general-purpose architecture. In such case, by using virtualization technology, multiple OSs with different purposes may be executed in parallel, and required applications may be executed in the respective OSs.

<FIG> is a schematic diagram illustrating a hardware configuration example of the safety unit <NUM> constituting the controller system <NUM> according to an embodiment. The safety unit <NUM> includes, as main components, a processor <NUM> such as a CPU or a GPU, a chipset <NUM>, a main storage apparatus <NUM>, a secondary storage apparatus <NUM>, a memory card interface <NUM>, an internal bus controller <NUM>, and an indicator <NUM>.

By reading various programs stored in the secondary storage apparatus <NUM> and expanding the programs in the main memory apparatus <NUM>, the processor <NUM> realizes the control arithmetic operation relating to safety control as well as various processes to be described in the following. By mediating the data exchange among the processor <NUM> and the respective components, the chipset <NUM> realizes the processes of the safety unit <NUM> as a whole.

In addition to the system program, the secondary storage apparatus <NUM> stores the safety program that operates in the execution environment provided by the system program.

The memory card interface <NUM> is configured so that a memory card <NUM> is removable, and is capable of writing data of the safety program or the respective settings to the memory card <NUM>, or capable of reading data of the safety program or the respective settings from the memory card <NUM>.

The internal bus controller <NUM> handles the data exchange with the control unit <NUM> via an internal bus.

The indicator <NUM> notifies the action state, etc., of the safety unit <NUM>, and is configured as one or more LEDs provided on the unit surface.

In <FIG>, while a configuration example in which required functions are provided by the processor <NUM> executing the programs, some or all of the provided functions may also be implemented by using a dedicated hardware circuit (e.g., ASIC or FPGA). Alternatively, the main parts of the safety unit <NUM> may be realized by using hardware (e.g., an industrial personal computer based on a general-purpose personal computer) following a general-purpose architecture. In such case, by using virtualization technology, multiple OSs with different purposes may be executed in parallel, and required applications may be executed in the respective OSs.

<FIG> is a schematic diagram illustrating a software configuration of the controller system <NUM>. In <FIG>, the descriptions about the safety unit <NUM>, the function units <NUM>, and the power unit <NUM> are omitted. The instruction codes included in the software group of the control unit <NUM> shown in <FIG> are stored in the secondary storage apparatus <NUM>, read at a suitable timing, and executed by the processor <NUM>. The instruction codes included in the software group of the security unit <NUM> shown in <FIG> are stored in the secondary storage apparatus <NUM>, read at a suitable timing, and executed by the processor <NUM>.

The software executed by the control unit <NUM>, in general, includes an OS <NUM>, a system program <NUM>, and a user program <NUM>. The system program <NUM> and the user program <NUM> are generally referred to as a control program <NUM>.

The OS <NUM> is designed in correspondence with the computer architecture of the control unit <NUM>, and provides the basic execution environment for the processor <NUM> to execute the system program <NUM> and the user program <NUM>. The OS <NUM> is typically provided by the manufacturer of the controller or a professional software company.

The system program <NUM> is a software group for providing functions as the controller system <NUM>. Specifically, the system program <NUM> includes a scheduler program <NUM>, a sequence instruction program <NUM>, an input/output program <NUM>, and an access process program <NUM>. Each program included in the system program <NUM> is typically provided by the manufacturer of the controller or a professional software company.

The user program <NUM> is formed in correspondence with the control purpose of the user. The user program <NUM> is formed, for example, in the support apparatus <NUM>. The user program <NUM> is transferred from the support apparatus <NUM> to the control unit <NUM> via the USB cable, and is stored in the secondary storage apparatus <NUM>.

The user program <NUM> realizes the control purpose of the user through cooperating with a sequence instruction program <NUM>. That is, the user program <NUM> realizes a programmed action by using the instructions, functions, functional modules provided by the sequence instruction program <NUM>.

The user program <NUM> includes one or more change instructions <NUM>. The change instruction is an instruction for changing the contents of the security protection processes executed by the security unit <NUM>. While not shown in <FIG>, the change instruction <NUM> includes a first change instruction and a second change instruction. The first change instruction is an instruction for determining the value of the output signal indicating the behavior of the security unit <NUM> carried out by executing the security protection process with respect to the input signal indicating the action state of the control unit <NUM>. The second change instruction is an instruction indicating the behavior of the security unit <NUM>.

The level corresponding data <NUM> and the process content corresponding data <NUM>, as the information indicating parameters for executing the change instruction, are sent from the support apparatus <NUM> in correspondence with the user program <NUM>. Details about the level corresponding data <NUM> and the process content corresponding data <NUM> will be described in detail in the following.

The user program <NUM> includes a control instruction <NUM> for controlling the field device <NUM>, etc., other than the change instruction. Configuration data <NUM>, as the information indicating the parameter for executing the control instruction, is sent from the support apparatus <NUM> in correspondence with the user program <NUM>. Details of the configuration data <NUM> will be described in the following.

The scheduler program <NUM> makes the processor <NUM> execute programs in accordance with predetermined priority. The scheduler program <NUM> controls the start and the interruption of a process as well as the resumption of a process after the process is interrupted for each program executed by the processor <NUM>.

The sequence instruction program <NUM> includes an instruction code group for calling an entity of the sequence instruction specified in the user program <NUM> when the user program <NUM> is executed and realizing the contents of the instruction.

The input/output process program <NUM> is a program for managing the acquisition of input data and the transmission of output data between field devices connected with the control unit <NUM>.

The access process program <NUM> includes an instruction code group for realizing the process of communicating with another apparatus such as the security unit <NUM>. More specifically, by executing the access process program <NUM>, the control unit <NUM> outputs the output signal indicating the behavior of the security unit <NUM> carried out by executing the security protection process and determined when the change instruction is executed to the security unit <NUM> through the execution of the access process program <NUM>.

The security unit <NUM>, in general, includes an OS <NUM> and a system program <NUM>.

The OS <NUM> is designed in correspondence with the computer architecture of the security unit <NUM>, and provides the basic execution environment for the processor <NUM> to execute the system program <NUM>. The OS <NUM> is typically provided by the manufacturer of the controller or a professional software company.

The system program <NUM> includes an access process program <NUM> and a security protection program <NUM>.

The access process program <NUM> includes an instruction code group for realizing the process of communicating with another apparatus such as the control unit <NUM>.

The security protection program <NUM> includes a prevention program <NUM>, a detection program <NUM>, and a coping program <NUM>. The security protection program <NUM> includes an instruction code group for executing each of the prevention program <NUM>, the detection program <NUM>, and the coping program <NUM> in accordance with the output signal indicating the behavior of the security unit <NUM>, transmitted from the control unit <NUM>, and obtained through the execution of the access process program <NUM>.

The security unit <NUM> executes each program included in the security protection program <NUM> in accordance with the output signal indicating the behavior of the security unit <NUM> and output from the control unit <NUM>.

The security unit <NUM> is responsible for the security function with respect to the controller system <NUM> and executes the security protection process with respect to the controller system <NUM>. For the control unit <NUM>, a security event may occur in various situations (as shown in <FIG>). The security unit <NUM> executes the security protection process, including the prevention with respect to the security event that may occur in the control unit <NUM>, the detection of the security event, and coping with the detected security event, in the respective situations.

The security unit <NUM> is capable of executing security protection processes respectively corresponding to multiple predetermined security levels. In addition, the security protection process is executed in correspondence with one of the security levels in accordance with at least one of the action state of the control unit <NUM> and the notification issued by the control arithmetic operation executed by the control unit <NUM>.

<FIG> is a functional configuration diagram schematically illustrating security functions of the controller system <NUM>. The functions of the control unit <NUM> shown in <FIG> are realized by executing the respective programs shown in <FIG> by the processor <NUM>. In addition, the functions of the security unit <NUM> shown in <FIG> are realized by executing the respective programs shown in <FIG> by the processor <NUM>.

The control unit <NUM> includes a state management part <NUM>, a control arithmetic operation part <NUM>, a level determining part <NUM>, and a security planning part <NUM>.

The state management part <NUM> manages the action state of the control unit <NUM>. The action states are states controlled through execution of the system program <NUM> which is installed in advance in the control unit <NUM> and provides functions as the control unit <NUM>. That is, the action states of the control unit <NUM> are states defined by the manufacturer of the control unit <NUM>. In addition, the state management part <NUM> may also be considered as functions expressed by executing the system program <NUM>.

Typically, the action states of the control unit <NUM> can be classified into a state in which the control program provided in the control unit <NUM> is executed and a state in which the control program is not executed, or a state in which rewriting of the control program is permitted and a state in which the rewriting is not permitted.

In the embodiment, control is exerted in one of the four action states, i.e., the "program mode", the "operation mode", the "on-line editing mode", and the "maintenance mode".

The "program mode" is an action state controlled during a period before the user program <NUM> is installed to the control unit <NUM> until the installation is completed and the control unit does not execute a program. For example, the "program mode" is an action state when the control unit <NUM> is shipped or an action state controlled when the control program of the control unit <NUM> is rewritten.

The "operation mode" is an action state controlled when the control unit <NUM> is executing a program, and is a mode controlled when equipment or a machine is in operation.

The "on-line edit mode" is an action state able to rewrite the control program during execution of the control program.

The "maintenance mode" is an action state in which the control unit <NUM> does not execute a program, and the program of the control unit <NUM> is able to be rewritten.

As an example of these action states, the types of the action states which the control unit <NUM> controls may include fewer than four types, one type, and five or more types. In addition, it is not required that the control unit <NUM> necessarily includes the action states shown in <FIG>.

The statement management part <NUM> controls the action state in correspondence with the met condition of switching the action state when the condition is met. The statement management part <NUM> notifies the level determining part <NUM> that the action state is switched. The state management part <NUM>, for example, typically switches the action state in the case of detecting a command of switching the state from the support apparatus <NUM>, an internal command generated in the HMI 800a, or an operation with respect to a key switch (not shown) provided in the control unit <NUM>.

The control arithmetic operation part <NUM> performs the control arithmetic operation for controlling the work as the control target. The control arithmetic operation part <NUM> executes the control arithmetic operation in accordance with the configuration data <NUM> and the input value output from the field device <NUM> or the safety unit <NUM> communicably connected with the control unit <NUM>.

The configuration data <NUM> includes the setting information required for executing the control arithmetic operation, such as including the assignment of variables used in the program with respect to the signal assigned to the I/O unit.

The level determining part <NUM> determines a security level in accordance with the input value from the state management part <NUM> or the control arithmetic operation part <NUM> and the level corresponding data <NUM>. The level determining part <NUM> notifies the security planning part <NUM> about the determined security level.

<FIG> is a diagram illustrating a data configuration of the level corresponding data <NUM>. Referring to <FIG>, the level corresponding data <NUM> includes the assignment of the security level to the input value input from the statement management part <NUM> and the control arithmetic operation part <NUM>. More specifically, the security level is assigned with respect to the action state or a variable indicating the arithmetic operation result. Examples of the arithmetic operation result include, for example, the output of an abnormal signal.

Referring to <FIG> again, the security planning part <NUM> specifies the contents of the security protection process whose contents correspond to the security level, and instructs the security unit <NUM> to execute the security protection process with the specified contents. The security planning part <NUM> specifies the contents of the security protection process in accordance with the security level notified from the level determining part <NUM> and the process content corresponding data <NUM>.

<FIG> is a diagram illustrating a data configuration of the process content corresponding data <NUM>. Referring to <FIG>, the contents of the security protection process are defined in correspondence with each of multiple predetermined security levels.

For example, as shown in <FIG>, the process content corresponding data <NUM> defines, for each security level, the information whose output is limited and the output destination which is limited among the information output from the control unit <NUM>, and the information whose input is limited and the target able to transmit information to the control unit <NUM> among the information input from an apparatus connected to the control unit <NUM>, as the prevention means against the security event.

Also, the process content corresponding data <NUM> may also define, for each security level, a threshold at which and a detection target for which a security event is determined as occurring, as a detection means of the security event.

In addition, the process content corresponding data <NUM> may also define, for each security level, among the information output from the control unit <NUM>, the information whose output is limited, the output destination which is limited, the information input to the limited control unit <NUM>, and the target able to transmit information to the control unit <NUM>, in the case in which the security event is detected, as a coping means in correspondence with the detected security event. In addition, the processing content corresponding data <NUM> may also define, for each security level, a means for notifying a security event in the case where the security event occurs.

The security unit <NUM> has an execution part <NUM>. The execution part <NUM> executes the security protection process with the contents specified by the security planning part <NUM>. Specifically, the execution part <NUM> carries out the protection against the security event by using the prevention means that is defined, detects the security event by using the detection means that is defined, and copes with the detected security event by using the coping means that is defined.

For example, in the embodiment, the security unit <NUM> exhibits the following behaviors in correspondence with the action states of the control unit <NUM>. In the "operation mode" in which the control program is executed, a security level <NUM> is set, and the communication with a superordinate apparatus, such as the database <NUM> is set to be enabled. Accordingly, the operation logs collected when the program is executed can be uploaded to the database <NUM> at all times. At this time, to lower the risk of leaking the information in operation to the outside, the communication via VPN is disabled.

In addition, in the "program mode" in which the rewriting of the control program of the control unit <NUM> is permitted, the communication with the superordinate apparatus, such as the database <NUM>, and the communication via the VPN are both disabled. Accordingly, the control program can be prevented from being rewritten unintentionally.

In addition, in the case in which the result of the control arithmetic operation indicate an abnormality, by enabling the communication via VPN, an environment capable of remote maintenance is provided.

Here, the series of processes of changing the behavior of the security unit <NUM> when the security protection process is executed in accordance with the input value from the state management part <NUM> are realized by executing the first change instruction to be described afterwards. Meanwhile, the series of processes of changing the behavior of the security unit <NUM> when the security protection process is executed in accordance with the input value from the control arithmetic operation part <NUM> are realized by executing the second change instruction to be described afterwards.

<FIG> is a schematic diagram illustrating a hardware configuration example of the support apparatus <NUM>. The support apparatus <NUM> provides the function of forming the user program including the change instruction. More specifically, the support apparatus <NUM> provides the user interface for selecting the change instruction. As an example, the support apparatus <NUM> is realized by using hardware (e.g., a general-purpose personal computer) following a general-purpose architecture.

Referring to <FIG>, the support apparatus <NUM> includes a processor <NUM>, a main memory <NUM>, an input part <NUM>, a display part <NUM>, a storage <NUM>, an optical drive <NUM>, and a USB controller <NUM>. These components are connected via a processor bus <NUM>.

The processor <NUM> is configured by a CPU or a GPU, etc., provides the user interface for selecting the change instruction by reading the program stored in the storage <NUM> and expanding the program in the main memory <NUM>, and forming the user program <NUM> in accordance with the operation by the user.

The main memory <NUM> is configured by a volatile storage apparatus, such as a DRAM or a SRAM. The storage <NUM> is configured by a non-volatile storage apparatus, such as an HDD or an SSD.

In addition to the OS for realizing basic functions, the storage <NUM> stores the support program for providing functions as the support apparatus <NUM>.

The input part <NUM> is configured by a keyboard or a house, etc., and receives a user operation. The display part <NUM> is configured by a display, etc., and outputs processing results from the processor <NUM>.

The USB controller <NUM> exchanges data with the controller system <NUM>, etc., via USB connection.

The support apparatus <NUM> has the optical drive <NUM>, and reads a program stored non-transiently in a computer-readable recording medium <NUM> (e.g., an optical recording medium such as a digital versatile disc (DVD)) from the computer-readable recording medium <NUM> to install the computer-readable recording medium <NUM> in the storage <NUM>, etc..

A support program <NUM>, etc., executed by the support apparatus <NUM> may also be installed via the computer readable recording medium <NUM>, and may also be installed by being downloaded from a sever apparatus on the network, etc. In addition, the functions provided by the support apparatus <NUM> according to the embodiment may also be realized by using a portion of the module provided by the OS.

While a configuration example in which required functions as the support apparatus <NUM> are provided by the processor <NUM> executing the program in <FIG>, some or all of the provided functions may also be implemented by using a dedicated hardware circuit (e.g., ASIC or FPGA).

The support apparatus <NUM> provides a user interface for the user to form the user program <NUM> including the change instruction. More specifically, with the processor <NUM> of the support apparatus <NUM> executing the program stored in the storage <NUM>, the user interface shown in <FIG> is displayed on the display part <NUM>, and the user program <NUM> including the change instruction in accordance with the setting received by the input part <NUM> as well as the level corresponding data <NUM> and the processing content corresponding data <NUM> required for executing the change instruction are generated.

<FIG> is a diagram illustrating an example of a user interface receiving selection of a change instruction. <FIG> is a diagram illustrating an example of a user interface provided when a change instruction is selected. <FIG> is a diagram illustrating an example of a user interface for setting contents of a connection condition for connection with an outside network. <FIG> is a diagram illustrating an example of a user interface receiving setting of an execution condition of a change instruction.

Referring to <FIG>, in a user interface <NUM>, when a security setting tab <NUM> on the left side of in the figure is selected, a setting screen <NUM> is displayed in the region on the right side. The setting screen <NUM> has a selection region <NUM> for selecting the change instruction for receiving the selection of the change instruction. In the selection region <NUM>, a tab <NUM> indicating that the change instruction is not selected and a tab <NUM> indicating that the change instruction is selected are displayed. In <FIG>, a portion of the user interface <NUM> is omitted.

Referring to <FIG>, when the tab <NUM> is selected, a first selection region <NUM> and a second selection region <NUM> for selecting the change instructions are provided for each of the two types of change instructions in the setting screen <NUM>.

The first selection region <NUM> receives the selection of the first change instruction. The first change instruction is an instruction for determining the value of the output signal indicating the behavior of the security unit <NUM> carried out by executing the security protection process with respect to the input signal indicating the action state of the control unit <NUM>. In the first selection region <NUM>, a tab <NUM> indicating that the first change instruction is not selected and a tab <NUM> indicating that the first change instruction is selected are displayed.

The second selection region <NUM> receives the selection of the second change instruction. The second change instruction is an instruction that defines the behavior of the security unit <NUM> carried out by executing the security protection process. The second change instruction is executed when a condition arbitrarily set by the user is met. In the second selection region <NUM>, a tab <NUM> indicating that the second change instruction is not selected and a tab <NUM> indicating that the second change instruction is selected are displayed.

Referring to <FIG>, when the tab <NUM> is selected, a level corresponding region <NUM> for associating the action state of the control unit <NUM> with the security level is provided. The level corresponding region <NUM> includes a state displaying region <NUM> in which the action state of the control unit <NUM> is defined and a level input region <NUM> in which the input of the security level corresponding to the action state displayed in the action display region <NUM> is received. When the tab <NUM> of the level input region <NUM> is selected, one of multiple levels can be selected. It is also possible to add a level. Since the action state of the control unit <NUM> displayed in the state display region <NUM> is predetermined, the display of the state display region <NUM> in general does not change.

Since the contents of the security protection process are set in correspondence with each security level, the level corresponding region <NUM> can be considered as a region receiving the setting of the corresponding relationship between the input signal indicating the action state of the control unit <NUM> and the output signal indicating the behavior of the security unit <NUM> carried out by executing the security protection process.

Referring to <FIG>, when the tab <NUM> is selected, in addition to the level corresponding region <NUM>, a setting content corresponding region <NUM> for setting the contents of the security protection process for each security level is provided. The setting content corresponding region <NUM> includes a level region <NUM> indicating the security level and a setting content input region <NUM> receiving the setting of the contents of the security protection process for each level.

A tab <NUM> for selecting the setting contents is provided in each cell in the setting content input region <NUM>. By selecting the tab <NUM>, the user interface for selecting the setting contents is provided.

Since the setting content corresponding region <NUM> receives the setting of the contents of the security protection process for each security level equivalent to the output signal, the setting content corresponding region <NUM> is equivalent to the user interface for setting the behavior of the security unit <NUM> indicated by the output signal.

The setting content input region <NUM> includes a permitted condition input region <NUM> receiving the setting of the permitted condition in the case where the communication via the outside network is permitted. The contents of the specific permitted condition which each permitted condition ("Maintainer", "Administrator", "Engineer") in the permitted condition input region <NUM> are set by operating a permitted condition setting screen <NUM>.

Referring to <FIG>, the permitted condition setting screen <NUM> provides a condition change selection region <NUM> which receives the selection of the permitted condition change instruction for changing the permitted condition for each level and an permitted condition setting region <NUM> for setting the permitted condition in the case where the selection of the permitted condition change instruction is carried out.

The condition change selection region <NUM> includes a tab <NUM> indicating that the permitted condition change instruction is not selected and a tab <NUM> indicating that the permitted condition change instruction is selected. When the tab <NUM> is selected, the permitted condition setting region <NUM> is provided.

The permitted condition setting region <NUM> includes a condition item region <NUM> in which a condition item is presented and a condition input region <NUM> in which, for each user name, the input of each condition item is received. In "VPN Group", an arbitrary group name can be input. The group name is associated with the group name set in the permitted condition input region <NUM> shown in <FIG>. For example, in the case where "Engineer" is input in the permitted condition input region <NUM>, it is possible to connect with the control unit <NUM> via the VPN by using the respective conditions set as "User_CCC", "User_DDD", "User_EEE" in <FIG>.

Referring to <FIG>, when the tab <NUM> in <FIG> is selected, that is, when the second change instruction is selected, a variable table screen <NUM> as a user interface for setting the execution condition of the second change instruction is provided.

The variable table screen <NUM> receives the input of a ladder program. For example, the ladder program shown in <FIG> indicates that the execution condition of the second change instruction is met when a variable referred to as Error1 is output.

With the user inputting an arbitrary variable <NUM> or combining contact points, the execution condition of the second change instruction can be set.

In addition, in the case where an instance block <NUM> is clicked on, a level selection tab <NUM> for selecting of which security level the security protection process is to be executed is provided. In the case where the instant block <NUM> is clicked on, a variable table for inputting the instruction content of the second change instruction may be provided.

The user interface shown in <FIG> is merely an example and may also be realized in a different form.

<FIG> is a schematic diagram illustrating a software configuration of the support apparatus <NUM>. In <FIG>, an example of a software group for the support apparatus <NUM> to provide respective functions is shown. The instruction codes included in the software group are read at a suitable timing and executed by the processor <NUM> of the support apparatus <NUM>.

The software executed by the support apparatus <NUM> at least includes an OS <NUM> and the support program <NUM>. The programs are stored in the storage <NUM>. In addition, the data used for executing the programs include an instruction library <NUM> and a variable library <NUM> and are stored in the storage <NUM>.

The OS6120 provides a basic environment in which the support program <NUM> can be executed. The support program <NUM> is a program for realizing the functions provided by the support apparatus <NUM>, and provides a function for forming the user program <NUM>.

The instruction library <NUM> stores instructions which are program components defined for each instruction information for forming the user program <NUM>. The instructions stored in the instruction library <NUM> includes the change instruction <NUM> and the control instruction <NUM>. The change instruction <NUM> includes a first change instruction 862a and a second change instruction 862b. When the user selects the first change instruction 862a, the first change instruction 862a is incorporated into the user program <NUM>. Similarly, when the user selects the second change instruction 862b, the second change instruction 862b is incorporated into the user program <NUM>.

The variable library <NUM> includes a variable table <NUM> defining parameters required for execution of the change instruction. In the case where the first change instruction 862a is selected, a variable table corresponding to the first change instruction 862a is called and input to the display part <NUM>, and the level corresponding region <NUM> and the setting content corresponding region <NUM> shown in <FIG> are provided.

When information is input to the level corresponding region <NUM> and the setting content corresponding region <NUM>, the support program <NUM> generates the level corresponding data <NUM> and the processing content corresponding data <NUM> and stores the level corresponding data <NUM> and the processing content corresponding data <NUM> in the data storage part <NUM>. In the case where the control instruction <NUM> is selected, the variable table corresponding to the selected control instruction is called and output to the display part <NUM>. When variables are input, the configuration data <NUM> is generated and stored in the data storage part <NUM>.

The instruction library <NUM> and the variable library <NUM> are, for example, distributed in a state of being stored in the recording medium <NUM> by a controller manufacturer or a professional software company, etc. The user can make use of the instruction library <NUM> and the variable library <NUM> by installing the instruction library <NUM> and the variable library <NUM> stored in the recording medium <NUM> to the support apparatus <NUM>.

The user program <NUM> includes an editor <NUM>, a compiler <NUM>, a debugger <NUM>, a graphical user interface (GUI) module <NUM>, a simulator <NUM>, and a data storage part <NUM>.

The editor <NUM> provides inputting and editing functions, etc., for forming a source program of the user program <NUM>. More specifically, the editor <NUM> provides functions of preserving and editing the formed source program in addition to the function that the user operates the input part <NUM> configured by a keyboard or a mouse to form the source program of the user program <NUM>. The editor <NUM>, in correspondence with the designer's operation, forms the source program of the user program <NUM> by using the change instruction selected from the instruction library <NUM>.

The compiler <NUM> provides functions of compiling the source program and generating the user program <NUM> in the form of a program executable by the control unit <NUM>.

The debugger <NUM> provides a function for performing debugging with respect to the source program of the user program <NUM>.

The GUI module <NUM> has a function of providing a user interface screen for the designer to input various data or parameters. The user interface screen is displayed on the display part <NUM>.

The simulator <NUM> constructs an environment for simulating the execution of the program by the control unit <NUM> in the support apparatus <NUM>.

The user program <NUM> that is formed is stored in the data storage part <NUM>. The user program <NUM> includes one or more instructions. The user program <NUM>, the level corresponding data <NUM>, the processing content corresponding data <NUM>, and the configuration data <NUM>, etc., stored in the data storage part <NUM> are transmitted to the control unit <NUM> via a USB cable and set in the control unit <NUM>.

While the instruction library <NUM> and the variable library <NUM> are stored in the storage <NUM> of the support apparatus <NUM> in the example shown in <FIG>, at least one of the instruction library <NUM> and the variable library <NUM> may also be stored in a server apparatus connectible with the support apparatus <NUM> via a network.

A security level switching process executed by the control unit <NUM> is described with reference to <FIG> is a flowchart illustrating an example of the security level switching process executed by the control unit <NUM>.

In Step S112, the processor <NUM> determines whether the action state of the control unit <NUM> is switched.

In the case of determining that the action state is not switched ("NO" in Step S112), the processor <NUM> switches the control to Step S116. In the case of determining that the action state is switched ("YES" in Step S112), the processor <NUM> specifies the security level corresponding to the action state in Step S114.

In Step S116, the processor <NUM> determines whether the execution condition of the second change instruction is met. That is, the processor <NUM> determines whether to perform a security level change in correspondence with a notification issued through the control arithmetic operation.

In the case where the execution condition of the second change instruction is not met ("NO" in Step S116), the processor <NUM> switches the process to Step S120. In the case where the execution condition of the second change instruction is met ("YES" in Step S116), the processor <NUM> specifies the contents of the security protection process indicated by the second change instruction.

In Step S120, the processor determines whether to generate the instruction for changing the contents of the security protection process. Specifically, if "NO" in both Step S112 and Step S116, the processor <NUM> determines to not generate the instruction ("NO" in Step S120) and ends the security level switching process.

In the case where the processor <NUM> determines to generate the instruction for changing the contents of the security protection process ("YES" in Step S120), in Step S122, the instruction for changing the contents of the security protection process is generated, and in Step S124, the security unit <NUM> is notified with the generated instruction, and the process is ended. In the case where the action state is switched and the execution condition of the second change instruction is also met, the processor <NUM> generates an instruction for changing the contents of the security protection process, so that the security becomes the highest.

In Step S122, the processor <NUM> may generate the instruction indicating the contents of the security protection process, or may also generate, as the instruction, the information for determining the contents of the security protection process.

A flowchart for a process executed by the support apparatus is described with reference to <FIG> is a flowchart illustrating an example of the process executed by the support apparatus <NUM>.

In Step S612, the processor <NUM> determines whether a start of the setting relating to the security level is received. In the case where the start of the setting relating to the security level is not received ("NO" in Step S612), the processor <NUM> ends the process.

In the case where the start of the setting relating to the security level is received ("YES" in Step S612), in Step S614, the processor <NUM> provides a user interface for receiving the selection of the change instruction.

In Step S116, the processor <NUM> determines whether the change instruction is selected. In the case where the change instruction is not selected ("NO" in Step S616), the processor <NUM> ends the process.

In the case where the change instruction is selected ("YES" in Step S616), in Step S618, the processor <NUM> provides the user interface that prompts for the input for execution of the instruction in correspondence with the change instruction that is selected.

In Step S620, the processor <NUM> determines whether an output instruction of the user program is received. In the case where the output instruction is not received ("NO" in Step S620), the processor <NUM> ends the process.

In the case where the output instruction is received ("YES" in Step S620), the processor <NUM> outputs the user program including the change instruction in Step S622.

In the above embodiment, the contents of the security protection process are set in correspondence with multiple predetermined security levels. However, the contents of the security protection process may also be determined in accordance with one of the action state of the control unit <NUM> and the results of the control arithmetic operation. For example, the contents of the security protection process may also be defined for each of the action state and the results of the arithmetic operation without using an intermediate variable referred to as the security level. In addition, while the user interface provided by the support apparatus <NUM> uses the intermediate variable referred to as the security level, the contents of the security protection process can also be set for each action state and each second change instruction without using the intermediate variable.

In the above embodiment, the contents of the security protection process are determined in accordance with each of the action state and the results of the control arithmetic operation. However, the contents of the security protection process may also be determined in accordance with only the information of one of the action state and the results of the control arithmetic operation. In addition, as the user program <NUM>, an example in which the change instruction is provided is described. However, a program equivalent to the change instruction may also be provided in advance as a system program.

For example, the control unit <NUM> may also have a function that the contents of the security protection process can be changed in correspondence with the action state of the control unit <NUM> before the user forms and installs the user program <NUM>. In such case, the contents of the security protection process of each action state may be set in default, and may be configured as being changeable by the user.

The control unit <NUM> and the security unit <NUM> may also be configured integrally. In this case, the function of the control unit <NUM> may be realized by a CPU, and the function of the security unit <NUM> may be realized by another CPU. In addition, the control unit <NUM> and the security unit <NUM> may also be realized by using a multi-core CPU. For example, the function of the control unit <NUM> may be assigned to a core of the multi-core CPU, and the function of the security unit <NUM> may also be assigned to another core of the multi-core CPU.

It should be considered that the embodiments disclosed herein are exemplary in all respects and not restrictive. The scope of the invention is defined by the scope of claims, not the above description, and is intended to include all the modifications within the meaning and scope of the claims. Further, the invention described in the embodiments and the respective modifications are intended to be carried out alone or in combination, where possible.

Claim 1:
A support apparatus (<NUM>, 600a), comprising:
a forming/editing part (<NUM>, 602a), which is adapted to provide a first user interface for forming or editing a user program (<NUM>, 1086a) defining contents of a control arithmetic operation executed by a control apparatus (<NUM>, 100a) which executes a control arithmetic operation for controlling a control target; and
an output part (110a, <NUM>) which is adapted to output the user program (<NUM>, 1086a) formed via the first user interface (<NUM>) provided by the forming/editing part (<NUM>, 602a),
wherein in the step of providing the first user interface (<NUM>), as an instruction constituting the user program (<NUM>, 1086a), the forming/editing part (<NUM>, 602a) is adapted to provide a second user interface which is adapted to receive a selection of a change instruction (<NUM>, 860a) for changing a behavior of a security monitoring device (<NUM>, 200a), said changing a behavior being carried out by executing a security protection process (<NUM>) in correspondence with one of security levels in accordance with at least one of action states of the control apparatus (<NUM>, 100a) comprising a detection of a security event which is possible to occur in the control apparatus and comprising an execution of a process in correspondence with the security event,
wherein the support apparatus (<NUM>, 600a) is characterized in that
the second user interface is adapted to comprise a level corresponding region (<NUM>) for associating an action state of the control apparatus (<NUM>) with a respective security level, the level corresponding region (<NUM>) is adapted to comprise of a state displaying region (<NUM>) in which the action state of the control apparatus (<NUM>) is defined and a level input region (<NUM>) in which the security level corresponding to the respective action state is received.