A safety master configured to communicate with a plurality of safety slaves over a safety field network or with a plurality of safety local I/O units connected by a safety back plane bus of the safety master, wherein each of the plurality of safety slaves and safety local I/O units allow connection to safety I/O devices in a plurality of cell equipment, and wherein the safety master receives a status signal indicating a “safe state” or an “unsafe state” related to cell equipment from each of the corresponding plurality of safety slaves or safety local I/O units, and controls operation/stop of cell equipment by executing an interlock operation program with the received status signal as an input to output an operation instruction signal.