A safety control unit includes: a memory; a computation control part; and an input and output unit for connecting the computation control part to a safety input device and an output device to be safely controlled. A system program includes a data refresh program for executing a data refresh of safety control data of the safety input device and the output device and the control data of the memory via the input and output unit. If the computation control part receives a change of a control program, the computation control part stops executing the control program. The computation control part executes the change of the control program while executing a part of the system program including the data refresh. The computation control part resumes executing the control program.