Time partitions which need not be executed can be skipped. An OS partially includes a partition scheduler which selects and decides a time partition to be subsequently scheduled in accordance with a scheduling pattern including TP1 in which an execution time is allocated to a safety monitoring program, TP2 in which the execution time is allocated to a normal control program, and TP 3 in which the execution time is allocated to a safety control program. A processor executes the OS to cause the partition scheduler to periodically operate. The partition scheduler skips a TP including a program which need not be executed among TPs included in the scheduling pattern, in response to a notification of an execution result from a program executed in at least one of the time partitions TP1 to TP3.