JPH0816202A - Controller - Google Patents

Abstract

PURPOSE:To surely suppress the issuing of an erroneous control instruction having the possibility of causing a serious accident endangering life and to surely obtain the safety of a control program by extracting a specific control instruction and prerequisite for executing the control instruction and generating a check pattern. CONSTITUTION:A control instruction checking part 12 fetches a control instruction group supplied from a control part 11 and a status information group supplied from a controlled system 2 and checks the validity of issue of a specific control instruction included in the control instruction group based upon a check pattern read out from a check pattern storing part 14. When the issuing of the specific control instruction is valid as the result of the checking, the checking part 12 transfers the control instruction group to the system 2, which operates in accordance with the control instruction group. When a condition for the issuing of the specific control instruction is not satisfied, abnormality is judged and the checking part 12 suppresses the transfer of the control instruction group to the system 2.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a control device using a computer, and more particularly to a technique for improving the safety of the control device.

[0002]

2. Description of the Related Art Depending on a control system using a computer, malfunction due to computer failure, noise, software bug, or the like may cause a serious accident that may affect human life.
Therefore, the control system must be designed so as not to cause a malfunction, or to be controlled safely even if a malfunction occurs.

As a publicly known example of a technique for ensuring the safety of such a control system, there is a technique described in Japanese Patent Laid-Open No. 61-166489. In the above-mentioned publicly known example, if a signal that is issued when the preconditions are not satisfied may cause a serious accident that may affect human life, the preconditions that should be satisfied at normal times are logically set, and when the logic conditions are not satisfied, When the signal is turned on, it is determined that the signal is an abnormal signal and the normal operation of the controlled object is blocked.

[0004]

In the above-mentioned known example, since the preconditions are peculiar to the system, the precondition checking mechanism is incorporated in the system. However, by incorporating the control information including the preconditions as data, for a versatile control device that can cope with various variations with different preconditions, a check mechanism of a system built-in type as shown in a known example is used. Then, the system itself must be recreated for each individual variation, which is not possible.

The present invention has been made in view of the above circumstances, and even if it is a versatile control device capable of coping with various variations having different preconditions, by incorporating control information as data, By providing a simple check function, it is possible to reliably prevent erroneous issuance of control commands that could cause a fatal accident if issued if the prerequisites are not satisfied, and ensure the safety of the control program. An object is to provide a control device to be obtained.

[0006]

A control device of the present invention takes in control information describing a control command and preconditions for executing the control command at the time of start-up, and when online, keeps a status information group from a control target constant. In the control device that controls the control target by outputting the control command group to the control target at a constant period while capturing in a cycle, in the control command group that the control device outputs to the control target, On the other hand, a check pattern for checking the simultaneous establishment of the specific control command and the precondition for issuing the specific control command is extracted from the control information as the specific control command and the precondition for issuing the specific control command. And a check pattern generation unit that generates the check pattern generation unit when the specific control command is issued. Based on a check pattern corresponding to a fixed control instruction, the specific control instruction issued and the precondition are checked for simultaneous establishment, and if they are not established simultaneously, transfer of the control instruction group to the controlled object is performed. The control command check means for suppressing is provided.

[0007]

The check pattern generating means extracts, from the control information, a specific control command specified in advance and a precondition for executing the specific control command, and the check pattern is generated. To generate.

Prerequisites are status information obtained from the controlled object and control commands other than the specific control command. As a result, it is possible to reliably generate a check pattern for various variations caused by changing the control information.

On the other hand, the control command check means, when the specific control command is issued, checks whether the specific control command and the precondition are simultaneously established based on a check pattern corresponding to the control command. When they are not satisfied at the same time, the transfer of the control instruction group to the control target is suppressed.
As a result, it is possible to surely suppress the control against erroneous issuance of a control command that may cause a fatal accident if it is issued when the preconditions are not satisfied using the check pattern.

[0010]

An embodiment of the present invention will be described with reference to the drawings.
FIG. 1 shows the configuration of an embodiment of a control device according to the present invention. In the figure, the control device 1 controls the controlled object 2. The control device 1 transfers the control command group to the control target 2 at a constant cycle, and the control target 2 operates by receiving the control command group from the control device 1.

The control object 2 transfers the status information group to the control device 1 at a constant cycle, and the control device 1 receives the status information group from the control object 2 and uses it to determine the next control.

The control device 1 controls a control object 2 based on the control information stored in the control information storage unit 10 and the control information storage unit 10 that stores the control information describing the preconditions for executing the control command. Control unit 11 for controlling, and control unit 11
Control command check unit 12 for checking the validity of the control command issuance using a check pattern with the control command group output by the control target and the status information group output by the control target 2 as inputs.
And a check pattern generation unit 13 that generates a check pattern used for checking by the control command check unit 12 based on the control information stored in the control information storage unit 10, and a check pattern generated by the check pattern generation unit 13. Check pattern storage unit 1 for storing patterns
4 and.

The control device 1 and the controlled object 2 operate as follows. First, by off-line processing, the check pattern generation unit 13 reads control information from the control information storage unit 10, generates a check pattern, and outputs the generated check pattern to the check pattern storage unit 14.

Next, when the online system is activated, the control unit 11 reads the control information from the control information storage unit 10,
The control command check unit 12 includes a check pattern storage unit 14
Read the check pattern from.

After the above processing, the control unit 11, the control command check unit 12, and the controlled object 2 operate online. That is, the control unit 11 outputs the control command group to the control command check unit 12 at regular intervals. Control object 2 is control unit 1
1 and the status information group is output to the control command check unit 12.

The control command check unit 12 takes in the control command group supplied from the control unit 11 and the status information group supplied from the controlled object 2, and controls the above based on the check pattern read from the check pattern storage unit 14. The validity of issuing a specific control command included in the command group is checked. As a result of the check, if the issuance of the specific control command is valid, the control command checking unit 12 transfers the control command group to the control target 2, and the control target 2 operates according to the control command group. On the contrary, if the condition for issuing the specific control command is not satisfied, it is determined to be abnormal, and the control command check unit 12 suppresses the transfer of the control command group to the controlled object 2.

The control command check unit 12 also displays a check flag indicating whether the control command issuance is normal or abnormal, and a logo indicating which control command in the control command group is abnormally issued. Output to.

Next, FIG. 2 shows a specific configuration of the control command check unit 12. In the figure, the check pattern input unit 1
Reference numeral 21 reads the check pattern from the check pattern storage unit 14 when the online system is activated.

The check pattern temporary storage unit 122 stores the check pattern read by the check pattern input unit 121 while the power is on.

The control command input unit 123 reads the control command group from the control unit 11, and the status information input unit 126 reads the status information group from the controlled object 2.

The control command determination unit 120 uses the status information group transferred from the status information input unit 126 and the check pattern transferred from the check pattern temporary storage unit 122 to control transferred from the control command input unit 123. The validity of the issue of the specific control command in the command group is checked.

The control command output unit 125 receives the control command group and the check flag indicating the result of the check from the control command determination unit 120, and outputs the control command group to the controlled object 2 when the check flag indicates OK. However, when the check flag indicates NG, the output of the control command group to the controlled object 2 is suppressed.

The check flag logo output unit 124 receives a check flag indicating the result of the check from the control command determination unit 120 and a logo indicating which control command in the control command group is issued abnormally, and the control unit 11 Output to.

Next, FIG. 3 shows a specific configuration of the control command determination section 120. In the figure, the register 200 fetches the control command group supplied from the control command input unit 123. Here, the control instruction group is an example of bits in which each bit is data indicating ON / OFF of an individual control instruction.

The control command mask register 201 fetches a control command mask for fetching a specific control command bit in the control command register 200 from the check pattern temporary storage section 122.

The bit selection circuit 202 masks the control instruction group supplied by the control instruction register 200 with the control instruction mask supplied by the control instruction mask register 201.

The bit-on decision circuit 203 takes in the pattern masked by the bit selection circuit 202 and decides whether or not a bit is set. A logic "1" is output when the bit is set, and a logic "0" is output when the bit is not set. Here, the logical "1" output indicates that the specific control instruction to be checked is issued.

On the other hand, the condition register 209 stores the control command group from the control command input unit 123 into the status information input unit 1
The status information group is fetched from 26. Here, the status information group is a bit string in which each bit is data indicating status information of an individual control target.

The condition mask register 210 fetches from the check pattern temporary storage unit 122 a condition mask for fetching a necessary condition from the condition data fetched in the condition register 209.

The bit mask circuit 211 masks the condition data in the condition register 209 with the condition mask in the condition mask register 210.

The condition judgment pattern register 212 fetches from the check pattern temporary storage unit 122 a condition judgment pattern for judging whether the masked condition data is consistent with the control command.

The bit coincidence determination circuit 204 determines whether or not the condition determination pattern in the condition determination pattern register 212 and the masked condition data output by the bit mask circuit 211 match. If they match, a logical "0" is output, and if they do not match, a logical "1" is output.

The AND circuit 205 outputs the output of the bit-on determination circuit 203 and the output of the bit coincidence determination circuit 204 to AN.
Take D logic. The output of the AND circuit 205 becomes logic "1" when the specific control command is issued and the precondition for issuing the specific control command is not satisfied.
The output of the AND circuit 205 is transferred to the check flag logo output unit 124 as a check flag, and the check flag logo output unit 124 notifies the control unit 11 of the detection result.

The output (check flag) of the AND circuit 205 is transferred to the control command output unit 125 and used to determine whether to output the control command to the controlled object 2.

Further, the output of the AND circuit 205 is used for the control line of the multiplexer 206. Multiplexer 2
Reference numeral 06 supplies “0” to the OR circuit 207 when the check flag is “0” and the output of the bit selection circuit 202 when the check flag is “1”.

The OR circuit 207 performs an OR logic on the output of the logo register 208 and the output of the multiplexer 206 bit by bit, and writes the output to the logo register 208 again. As a result, if the specific control instruction does not match the condition, the specific control instruction bit is registered in the logo register.

Next, FIG. 4 shows a specific structure of the check pattern generation unit 13, and FIG. 5 shows details of data handled by the check pattern generation unit. In these figures, the control information input unit 130 uses the control information 300 from the control information storage unit 10.
Read. Here, the control information 300 shows the relationship between the control command and the status information, and is expressed in a table format in FIG. 5, but various description methods are possible depending on the application field.

The check information extraction unit 131 extracts the check information 310 necessary for creating a check pattern from the control information 300 taken in by the control information input unit 130. That is, first, from the control commands described in the control information 300, a specific control command that may cause a serious accident if it is issued by mistake is extracted.

Next, when issuing the specific control command,
Other control commands, which are prerequisites, and status information are extracted and correspond to the specific commands.

The check pattern creating unit 132 creates the control command mask 320, the condition mask 330, and the condition pattern 340 based on the check information 310 extracted by the check information extracting unit 131.

The control command mask 320 is a pattern indicating the bit position of the specific control command, and is used to extract the specific control command from the bit string of the control command group.

The condition mask 330 is a pattern indicating the bit positions of other control commands and status information to be checked as preconditions when the specific control command is issued, and is used to extract the condition bits.

The condition judgment pattern 340 shows a bit pattern of other control commands and status information which are preconditions when the above-mentioned specific control command is issued, and the consistency between the condition bit and the above-mentioned specific control command is shown. It is used to judge whether or not there is.

The check pattern output unit 133 has the control command mask 32 created by the check pattern creating unit 132.
0, the condition mask 330, and the condition determination pattern 340 are output to the check pattern storage unit 14.

According to the above-described embodiment, when the specific control command is issued for the specific control command which may cause a serious accident if it is issued incorrectly, the specific control command is controlled by the control target. Before the transfer to the above, the preconditions for the issuance of the specific control command are checked, and if the result of the check is that the precondition is not satisfied, the issuance of the specific control command is suppressed. Therefore, there is an effect that a serious accident can be surely prevented by adding a simple check means.

Further, according to the present embodiment, the check pattern is extracted by the off-line processing from the control information indicating the control command and the preconditions for its issuance to extract the precondition for the specific control command that may cause a serious accident. Since it is possible to generate, it is possible to reliably prevent serious accidents by adding simple checking means even for a versatile control device that enables various controls by exchanging control information. There is.

Furthermore, according to the present embodiment, since the check processing is realized by a simple logical operation, there is an effect that the check processing can be executed at high speed.

Next, FIG. 6 shows an embodiment in which the control device shown in the first embodiment is applied to actual control. The controlled object 2 shown in FIG. 6 is a building entrance. Since the air pressure in the room of this building is high, the carry-in port 2 is assumed to have a double door structure of the outer door 20 and the inner door 21. Carry-in entrance 2
Includes an external door 20, an internal door 21, an outdoor lighting 22, a middle room lighting 23, an indoor lighting 24, and an air conditioner 25, which are controlled by the control device 1 (FIG. 1).

At the carry-in entrance 2, when the outer door 20 and the inner door 21 are opened at the same time, a strong wind blows from the room to the outside because the air pressure in the room is high, and various things are blown, causing a serious accident. It may cause.

FIG. 7 shows control command bits (30 to 41) and status information bits 50 to 5 in controlling the carry-in entrance 2.
7 is shown. In the figure, the control command bit 30 is a command for opening the outer door 20, the control command bit 31 is a command for closing the outer door 20, and the control command bit 32 is for the inner door 2.
The instruction to open 1 and the control instruction bit 33 are
Control instruction bit 34 is for switching on the outdoor lighting 22 and control instruction bit 35 is for the outdoor lighting 2
2 is a switch-off command and control command bit 36 is a switch-on command for the interior lighting 23, and a control command bit 37 is a switch-off command for the interior lighting 23 and a control command bit 38.
Is a switch-on command for the indoor lighting 24, a control command bit 39 is a switch-off command for the indoor lighting 24, a control command bit 40 is a switch-on command for the air conditioner 25, and a control command bit 41 is a switch-off for the air conditioner 25. It is an instruction.

On the other hand, the status information bit 50 indicates that the external door 20 is completely open, and the status information bit 51 indicates that the external door 20 is completely closed. The status information bit 52 indicates that the internal door 21
Indicates that the inner door 21 is completely open, and the status information bit 53 indicates that the inner door 21 is completely closed. The status information bits 54, 55, and 56 indicate that the outdoor lighting 22, the interior lighting 23, and the indoor lighting 24 are turned on, and the status information bit 57 indicates that the air conditioner is switched on.

FIG. 8 shows the control information 30 used in this embodiment.
Indicates the content of 0. The control information 300 has the following contents. (1) When opening the external door 20, the external door 2
0 and the inner door 21 must be closed.
(2) When closing the outer door 20, the outer door 20 must be open and the inner door must be closed.
(3) When opening the inner door 21, the outer door 20 and the inner door 21 must be closed. (4) When closing the inner door 21, the outer door 20 must be closed and the inner door must be open. (5) When the outdoor lighting 22 is turned on, the outdoor lighting 22 must be turned off. (6) When the outdoor lighting 22 is turned off, the outdoor lighting 22 must be on.
(7) When turning on the interior room lighting 23, the interior room lighting 23 must be turned off. (8) When turning off the interior room lighting 23, the interior room lighting 23 must be on. (9) When turning on the interior lighting 24, the interior lighting 2
4 must have disappeared. (10) Indoor lighting 24
When turning off, the interior lighting 24 must be turned on. (11) When starting the air conditioning 25, the air conditioning 25 must be stopped. (12) Air conditioning 25
The air conditioner 25 must be operating when the control is stopped. Although all the preconditions are AND conditions here, OR conditions may be included.

From the above control information 300, check information 3
10 is created. In the check information 310, a specific control command which, if erroneously issued, leads to a serious accident, and preconditions for issuing the specific control command are listed.

In this embodiment, a serious accident may occur when the outer door 20 and the inner door 21 are opened at the same time. Therefore, as a specific control command, a command 30 for opening the outer door 20 and a command 3 for opening the inner door 21.
Specify 2.

The conditions for issuing the command 30 for opening the outer door 20 are that the command 32 for opening the inner door 21 has not been issued, and that the inner door 21 is completely closed. The condition that the inner door 21 is completely closed is
The status information bit 52 indicating that the internal door 21 of the status information group is completely open is “0”, and the status information bit 53 indicating that the internal door 21 is completely closed is “1”. is there.

The conditions for issuing the command 32 for opening the inner door 21 are that the command 30 for opening the outer door 20 has not been issued, and that the outer door 20 is completely closed. The condition that the external door 20 is completely closed means that the status information bit 50 indicating that the external door 20 in the status information group is completely open is “0” and the external door 20 is completely closed. This means that the status information bit 51 shown is "1".

Next, FIG. 9 shows a control command mask 320, a condition mask 330, and a condition judgment pattern 340 generated from the check information 310. The control command mask 320 extracts the issuance of the opening command 30 for the external door 20 in pattern 1 and the issuance of the opening command 32 for the internal door 21 in pattern 2.

In the condition mask 330, in the pattern 1, the opening command 32 of the internal door 21 and the status information 52, 5 are output.
3 is extracted, and in pattern 2, a command 3 to open the external door 20
0 and status information 50 and 51 are extracted.

In the condition judgment pattern 340, only the status information bit 53 in the pattern 1 is compared with the condition data masked by the condition mask 330.
In pattern 2, it is checked that only the status information bit 51 is "1". Note that the prerequisite is O
If the R condition is included, one control command mask 3
20 can be checked by using a plurality of condition masks 330 and condition determination patterns 340.

FIG. 10 shows a case where the external door 20 of the carry-in port 2 is in a stopped state in the process of not being completely closed. The operation of the control command determination unit 120 when the control command 32 for opening the internal door 21 is issued at this time will be described with reference to FIGS. 11 and 12.

In FIG. 11, it is assumed that as the control command, a command 32 for opening the internal door, a command 36 for turning on the interior lighting, and a command 41 for stopping the air conditioner are issued at the same time. As shown in FIG. 9, the control command mask 320 has two types, pattern 1 and pattern 2, so the check process is performed twice.

First, the pattern 1 of the control command mask 320
Are set in the control instruction mask register 201. Pattern 1 of the control command mask 320 is a mask for extracting the command 30 for opening the external door 20. Bit selection circuit 2
When 02 takes the AND logic for each bit of the control instruction set in the control instruction register 200 and the control instruction mask 320 set in the control instruction mask register 201,
"000000000000" is obtained as the output. As a result, it is detected that the command 30 for opening the external door 20 has not been issued. All the circuit outputs below the bit selection circuit 202 become "0", and the process for the pattern 1 of the control command mask 320 ends.

Next, the control command determination unit 120 shown in FIG.
FIG. 12 shows an operation when the pattern 2 of the control command mask 320 is used in the above operation. In the control instruction mask register 201, a control instruction group similar to that in FIG. 11 is set. The pattern 2 of the control command mask 320 is set in the control command register 201. Control instruction mask 3
Pattern 2 of 20 is a mask for extracting a command 32 for opening the internal door 21.

The bit selection circuit 202 takes an AND logic for each bit of the control instruction group set in the control instruction register 200 and the control instruction mask 320 set in the control instruction mask register 201, and outputs "0010000000".
Get 00 ".

The bit-on decision circuit 203 outputs "1" because there is "1" in the bit string output from the bit selection circuit 202.

On the other hand, the control register group and the status information group are set in the condition register 209, and the pattern 2 of the condition mask 330 is set in the condition mask register 210.

The condition determination pattern register 212 has the pattern 2 of the condition determination pattern 340 set therein. The bit mask circuit 211 uses the condition register 20.
Control instruction group and status information group set to 9;
Condition mask 3 set in the condition mask register 210
The bit 2 AND logic with the pattern 2 of 30 is taken. The output of the bit mask circuit 211 is “000000000000”.

The bit match judging circuit 204 checks whether the output of the bit mask circuit 211 matches the pattern 2 of the condition judging pattern 340 set in the condition judging pattern register 212. In the operation of FIG. 12, the bit match determination circuit 204 determines that they do not match and outputs "1".

As a result, the AND circuit 205 outputs the output "1" of the bit-on judging circuit 203 and the bit constant judging circuit 2
An AND logic of the output "1" of 04 is taken and the logic "1" is output. Since the output of the AND circuit 205 is a logical "1", it is determined that the control command bit 32 (inner door opening command) is issued unreasonably, and the output of the control command group to the controlled object 2 is suppressed.

Further, the multiplexer 206 selects the output “001000000000” of the bit selection circuit 202 to select the OR circuit 2
07 and is registered in the logo register 208.

According to this embodiment, the atmospheric pressure in the room is high, and
By providing a simple check means at the carry-in entrance where a double door is provided and the opening and closing of the double door is controlled by a computer, it is possible to surely prevent erroneous control that causes a serious accident in which two doors are opened at the same time. .

Further, according to the present embodiment, by the off-line processing, from the control information indicating the preconditions for the issuance of the control instruction, the instruction to open the external door and the internal door which may cause a serious accident are opened. Preconditions for commands can be extracted and check patterns can be generated, so even if the equipment at the carry-in entrance changes or the bit arrangement of the control command group and status information group changes, it is safe just by changing the control information. A high degree of control can be realized.

Further, according to the present embodiment, it is possible to realize a highly safe control even for other control targets simply by exchanging the control information.

Further, according to the present embodiment, the check process is realized by a simple logical operation, so that the check process can be executed at high speed.

[0075]

According to the present invention, when a specific control command that may cause a serious accident if issued incorrectly,
When the specific control command is issued, before the specific control command is transferred to the control target, check the prerequisites for which the specific control command is allowed to be issued, and as a result of the check,
When it is determined that the above prerequisites are not satisfied, the issuance of the specific control command can be suppressed, and therefore a serious accident can be surely prevented by adding a simple check means.

Further, according to the present invention, by the off-line processing, the preconditions for the specific control command that may cause a serious accident are extracted from the control information indicating the preconditions for issuing the control command and checked. Since a pattern can be generated, even for a versatile control device that enables various controls by exchanging control information, it is possible to reliably prevent serious accidents by adding simple checking means. .

Furthermore, according to the present invention, since the check processing is realized by a simple logical operation, the check processing can be executed at high speed.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of an embodiment of a control device according to the present invention.

FIG. 2 is a block diagram showing a specific configuration of a control command check unit in the control device shown in FIG.

3 is a block diagram showing a specific configuration of a control command determination unit in the control command check unit shown in FIG.

4 is a block diagram showing a specific configuration of a check pattern generation unit in the control device shown in FIG.

FIG. 5 is an explanatory diagram conceptually showing a generation process of various data handled by a check pattern generation unit.

FIG. 6 is an explanatory diagram showing a configuration of a carry-in port as a control target to which the control device according to the present invention is applied.

7 is an explanatory diagram showing a data structure of control commands and status information used for controlling the carry-in entrance shown in FIG. 6;

8 is an explanatory diagram showing specific contents of control information and check information used to control the carry-in entrance shown in FIG.

9 is an explanatory diagram showing specific contents of a control command mask, a condition mask, and a condition determination pattern used for controlling the carry-in entrance shown in FIG.

FIG. 10 is an explanatory view showing a state where the external door of the carry-in entrance shown in FIG. 6 is not completely closed and is stopped midway.

FIG. 11 is an explanatory diagram illustrating an example of an operation of a control command determination unit.

FIG. 12 is an explanatory diagram showing another example of the operation of the control command determination unit.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Control device 2 Control object 10 Control information storage part 11 Control part 12 Control command check part 13 Check pattern generation part 14 Check pattern storage part 120 Control command determination part 131 Check information extraction part 132 Check pattern creation part

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Atsushi Hiratsuka 1070 Ige, Katsuta City, Ibaraki Prefecture Hitachi Ltd. Mito Plant

Claims (9)

[Claims] 1. A control command and control information describing a precondition for executing the control command are fetched at startup, and when online, a status information group is fetched from a control target at a constant cycle and the control instruction group is controlled by the control. In a control device for controlling a control target by outputting to a target at a constant cycle, in the control command group that the control device outputs to the control target, the specific control command and the specific control command Check pattern generation means for generating a check pattern for checking whether a specific control command is issued simultaneously with a precondition for issuing the specific control command by extracting the specific control command and the precondition for issuing the specific control command from the control information; When the specific control command is issued, the check pattern corresponding to the specific control command generated by the check pattern generating means is generated. Control command check means for checking whether the issued specific control command and the precondition are simultaneously satisfied on the basis of a pattern and, if not simultaneously, suppressing transfer of the control command group to the controlled object. A control device comprising: 2. A control command and control information describing a precondition for executing the control command are fetched at start-up, and when online, a status information group is fetched from a control target at a constant cycle and the control instruction group is controlled by the control. In a control device that controls a control target by outputting to a target at a constant cycle, erroneous control due to issuance of an erroneous control command in the control command group that the control device outputs to the control target is always prevented A check pattern for checking the simultaneous establishment of the specific control command and the precondition for issuing the specific control command for the specific control command required to be specified, from the control information to the specific control command and the specific control command. Check pattern generating means for generating a control command issuance condition by extracting a precondition, and when the specific control command is issued, Based on the check pattern corresponding to the specific control command generated by the pattern generation means, it is checked whether the issued specific control command and the precondition are satisfied at the same time. A control device, comprising: a control command check means for suppressing transfer of a group to a controlled object. 3. A control command and control information describing a precondition for executing the control command are fetched at startup, and when online, a status information group is fetched from a control target at a constant cycle and the control instruction group is controlled by the control. In a control device that controls a control target by outputting to a target at a constant cycle, erroneous control due to issuance of an erroneous control command in the control command group that the control device outputs to the control target is always prevented. A check pattern for checking the simultaneous establishment of the specific control command and the precondition for issuing the specific control command with respect to the specific control command instructing the switch-on control that is required to be specified from the control information. Check command generation means for generating by extracting the control command and the precondition for issuing the specific control command; When it is executed, based on the check pattern corresponding to the specific control instruction generated by the check pattern generating means, the simultaneous establishment of the issued specific control instruction and the precondition is checked, and the simultaneous establishment is confirmed. If there is not, a control command check means for suppressing transfer of the control command group to the controlled object. 4. The control instruction group is a bit string, one control instruction corresponds to one bit, bit “1” means issuance of the control instruction, and bit “0” indicates the control instruction. Claim 1 which means not to issue.
4. The control device according to any one of 3 to 3. 5. The control device according to claim 1, wherein the status information group is a bit string, and one status information corresponds to one bit. 6. The control device according to claim 1, wherein the precondition is a control command other than the specific control command and the status information group. 7. The check pattern includes a control command mask for extracting the specific control command from the control command group, and a control command and status information to be the preconditions from the control command group and the status information group. And a condition determination pattern for checking whether or not the control instruction and the status information subject to the precondition satisfy the precondition, the control command mask, the condition mask, and the condition determination pattern are respectively 7. The control device according to claim 1, comprising a bit string. 8. The control command checking means simultaneously performs the specific control command and a precondition for issuing the specific control command by a logical operation of the control command group, the status information group, and the check pattern. The control device according to claim 7, wherein a check of establishment is performed. 9. The specific control instruction is selected by the check pattern generating means by a logical operation of a pre-incorporated logic of a bit string indicating a control instruction group and a bit string indicating the control instruction mask. The control device according to claim 8.