The present invention concerns a method for switching, by a local processing unit (1,2) of a flight control system of an aircraft, configured to control at least one local actuator, connected to at least one local sensor and connected via at least one link (3,4) to an opposite processing unit (2,1) configured to control at least one opposite actuator and be connected to at least one opposite sensor, said local processing unit (1,2) being further configured to be connected to backup communication means (13,14) enabling data exchanges between the local processing unit (1,2) and the opposite processing unit (2,1) in the case of failures of the links connecting same (3,4), said backup communication means comprising an array of sensors or actuators (13) and/or a secure onboard network for the avionics (14), comprising steps of: •—sending, to the opposite processing unit (2,1), acquisition data relative to the at least one local sensor and actuator data relative to the at least one local actuator, •—receiving, from the opposite processing unit (2,1), acquisition data relative to the at least one opposite sensor and actuator data relative to the at least one opposite actuator, •—receiving an item of opposite health data and determining an item of local health data, •—switching said local processing unit (1,2) from a first state to a second state chosen from an active state (15), a passive state (16) and a slave state (18), depending on the opposite health data received and the local health data determined.

The present invention includes a drawing data generating unit, a variation pattern that varies at regular intervals to be displayed, a display unit that displays drawing data, and a comparator that compares whether input signals are coincident, and the drawing data generating unit includes a receiver that receives data from a higher-level device, a drawing control unit that converts the data received from the higher-level device to drawing data, and a drawing memory that stores the drawing data. The drawing data generating unit and the variation pattern are redundantly configured, and the variation pattern is input to the drawing data generating unit. One output signal of the drawing data generating unit regarding drawing data including the variation pattern is transmitted to the display unit, a plurality of output signals from the drawing data generating unit are input to the comparator, and the comparator outputs a comparison result as a detection signal outside. This improves safety and reliability when severe safety criteria are required such as in a case of monitor-display in industrial plant equipment.

A method for controlling an industrial process includes providing process data of the industrial process to an active instance of a control software as input, based on this input, updating an internal state of the active instance of the control software that is characterized by a set of internal variables of this active instance; based on this updated internal state, determining an output signal and outputting this output signal to at least one piece of equipment that is configured to alter a state, and/or a behavior, of the industrial process. The method further includes providing a prioritized subset of the internal variables that characterize the state of the active instance to at least one further instance of a control software that is configured to take over control of the industrial process in case of a failure and/or malfunction of the active instance.

The present invention makes it possible to reduce a load associated with transfer of parameters. A control system is equipped with first and second controllers connected to a network, and a drive apparatus for driving a motor in accordance with an instruction from the first controller. The drive apparatus includes a memory that stores a safety program for implementing a safety function, and a parameter group referenced by this program. The second controller transmits an instruction related to work of the safety function to the drive apparatus. A support apparatus capable of being connected to the network generates the parameter group, and reduces a size of the parameter group when this parameter group is transferred to the drive apparatus in order that the parameter group can be restored by the drive apparatus.

A controller is a controller forming, with another controller, a redundant controller. The controller includes a communication function unit that performs communication with an external device capable of executing control calculation needed for process control for a plant, and a redundancy management unit that switches states of the controller between an active state where a result of the control calculation obtained from the external device via the communication function unit is reflected in the process control and a standby state where the result of the control calculation is not reflected in the process control. The redundancy management unit switches the states of the controller to bring one of the controller and the another controller into the active state.

This control subsystem comprises a first control subsystem comprising a first computing module able to acquire interaction data describing the interactions of the operator, associate these interaction data with a command, and generate a command signal corresponding to this command. The system further comprises a second control subsystem comprising a first computing module able to acquire the command signal, verify the compatibility of the command corresponding to the command signal with an operational context and, when the command is compatible with the operational context, generate a confirmation signal, and a third control subsystem able to acquire the command signal and the confirmation signal, and consolidate these signals to command the commanded system.

A method and redundant control system for an actuator in which two redundant control computers are connected via buses to a respective peripheral station containing an interface module and at least one periphery module, wherein the actuator is connected to mutually decoupled signal outputs of two periphery modules, each forming an output module, of the two peripheral stations, where output values generated by the two redundant control computers for the actuator are transmitted by the interface modules to the output modules, wherein upon detection of a bus fault, the respective interface module transmits a command to all downstream output modules to output substitute values, and where output modules to which the actuator is connected exchange information about receipt of the command via a communication link and implement it only if another output module concerned has also received the command so as to prevent failure modes in redundant operation.

The invention relates to a safety switching device (10) comprising a control side (40) with at least one single-error tolerance, having a first and second control unit (12, 14), each formed on an actuation side (50) for emitting a switch command (20) to at least two switching elements (52, 54, 56), and comprising a monitoring unit (30, 30.1, 30.2, 30.3) having a first and a second connection element (31, 36), and which monitoring unit (30, 30.1, 30.2, 30.3) is designed to emit the switch command (20) to at least one switching element (52, 54, 56) of a load circuit (23), characterised in that the at least two switching elements (52, 54, 56) are each designed as standard components that are free from a forced guidance of the contacts (62) thereof, and the first connection element (31) is directly connected to the second control unit (14) via a first feedback channel (42) and the second connection element (36) is directly connected to the first control unit (12) via a second feedback channel (44).

The invention relates to an engine control device comprising a first control channel (V1) and a second control channel (V2), each control channel comprising a first sensor (CAV1, CAV2) and a second sensor (CBV2, CBV2), each configured to provide, respectively, a first measurement (A) and a second measurement (B) to each channel, each of the channels having an active or passive state defining an active channel (V1) or a passive channel (V2), the active channel (V1) being designed to control at least one actuator (ACT) of the engine while the passive channel (V2) is designed to take over for the active channel if the latter fails.

A method for operating a mobile platform includes selecting a first sensor associated with a higher weight as a selected sensor among at least two sensors, the weight is among a plurality of weights assigned to the sensors associated with a statistical weight function; detecting a malfunction in the first sensor communicating with a sensor controller associated with the mobile platform, and switching to a second sensor associated with a lower weight as the selected sensor to communicate with the sensor controller based upon the detecting.