A safety sensor for monitoring the operational safety of a system comprises at least one safety signal input and at least one safety signal output. The safety sensor has a control unit. The control unit imprints the output safety signal with additional data, wherein the signal value of the output safety signal is changed within the limits of the value range assigned to the presently output signal state of the output safety signal depending on the additional data of the signal value of the output safety signal, and/or the control unit imprints the received input safety signal with additional data, wherein the signal value of the received input safety signal is changed within the limits of the value range assigned to the presently received signal state of the input safety signal depending on the additional data of the signal value of the received input safety signal.

A control unit and method for operating an industrial automation system communication network that includes a plurality of communication devices, wherein a plurality of control units redundant with respect to each other controls functions of a plurality of associated communication devices, where the communication devices transmit communication-specific input variables to all associated redundant control units, output variables (produced by the control units redundant with respect to each other are checked for deviations from each other, and where if there are deviations, then a switchover is made to reserve control units or control units having output variables that deviate with respect to a majority of control units redundant to each other are deactivated.

A method for operating a mobile platform includes detecting a malfunction in a first sensor communicating with a sensor controller associated with the mobile platform, and switching to a second sensor communicating with the sensor controller based upon the detecting.

This control subsystem comprises a first control subsystem comprising a first computing module able to acquire interaction data describing the interactions of the operator, associate these interaction data with a command, and generate a command signal corresponding to this command.

The system further comprises a second control subsystem comprising a first computing module able to acquire the command signal, verify the compatibility of the command corresponding to the command signal with an operational context and, when the command is compatible with the operational context, generate a confirmation signal, and a third control subsystem able to acquire the command signal and the confirmation signal, and consolidate these signals to command the commanded system.

A control assembly for an aircraft system according to an example of the present disclosure includes a multi-core processor that has a plurality of cores coupled to a communications module and to an arbitration module. The communications module is operable to communicate information between the plurality of cores and one or more aircraft modules. The plurality of cores include first and second cores operable to concurrently execute a first discrete set of software instructions to generate respective instances of an output. The arbitration module is operable to communicate each and every one of the respective instances to control the one or more aircraft modules. A method of operating an aircraft system is also disclosed.

A control system is for controlling safety-critical processes, non-safety-critical processes, and/or installation components. The control system includes: at least one control unit configured to control non-safety-critical processes and/or non-safety-critical installation components, at least one safety control unit for controlling safety-critical processes and/or safety-critical installation components, and at least one input/output unit connected to the first control unit via an internal input/output bus. The control system is configured to act as communication master or as communication minion or as both in a pool having other devices that is connected via field bus, and to that end, the control system includes a master communication coupler and a minion communication coupler. The control system is modularly configurable. At least the safety control unit includes respective subunits with master functionality and subunits with minion functionalities.

An automation network includes a plurality of data processing devices that are connected to one another for data communication. At least one data processing device in a first state, from the plurality of data processing devices, is preconfigured such that it generates corresponding messages upon identifying one or more security-relevant events. The messages are transmitted to at least one first software tool configured to record and evaluate the messages to determine whether there is a security-relevant attack on the automation network. The messages are transmitted to a second software tool configured to record and evaluate the messages and to determine whether the corresponding messages are generated by the at least one data processing device.

To achieve an automatic adjustment of a monitoring time in an automation system with a first automation device and a second automation device, at least one of the two automation devices operates a measuring program. A desired ring interruption is carried out by the measuring program by blocking a ring port in order thus to provoke a ring reconfiguration that utilizes a reconfiguration time. The blockage of the ring port is canceled again after the reconfiguration time has elapsed. The ring port is blocked again if the ring port has been opened by the ring reconfiguration, and all routing tables are deleted. As a result of this, at least the peripheral units are triggered to learn new network routes. Runtimes of test telegrams are measured, and a maximum value of the measured runtimes is stored. The measured maximum value is used for a dynamic adjustment of the monitoring time.

A method for processing data for an automated vehicle, including operating at least two processing units, the at least two processing units being monitored by a monitoring device having at least two self-monitoring monitoring units. Defined monitoring of the processing units is carried out with the aid of the at least two monitoring units. A master functionality of the monitoring units is assumed by a defined monitoring unit. In the event of a fault of the monitoring unit carrying out the master functionality, the master functionality is taken over by a downstream monitoring unit.

The present invention discloses a method for controlling a process using a plurality of regulatory controllers (160) connected to a remote supervisory controller (120) over a communication link (155) and to a local supervisory controller (130) over a process bus (170). The remote supervisory controller (120) controls the regulatory controllers (160) over the communication link (155) with the use of a remote process model. During operation of the plant a local process model is configured in the local supervisory controller (130) with control data send on the communication link (155). Upon failure of the communication link (155) the local supervisory controller (130) takes over the control through the process bus (170), acting as a redundant or a backup controller. The method comprises: monitoring transmission of control data between the remote supervisory controller (120) and the plurality of controllers (160) over the communication link (155); determining functional correlations between measured process variables and control process variables, based on the control data and a predetermined correlation function; configuring local process model based on the determined functional correlations; and providing intermediate set points using the configured local process model, upon an intermediate failure of the communication link (155), where the communication link recovers from the intermediate failure within a predetermined time period.