The present invention includes a drawing data generating unit, a variation pattern that varies at regular intervals to be displayed, a display unit that displays drawing data, and a comparator that compares whether input signals are coincident, and the drawing data generating unit includes a receiver that receives data from a higher-level device, a drawing control unit that converts the data received from the higher-level device to drawing data, and a drawing memory that stores the drawing data. The drawing data generating unit and the variation pattern are redundantly configured, and the variation pattern is input to the drawing data generating unit. One output signal of the drawing data generating unit regarding drawing data including the variation pattern is transmitted to the display unit, a plurality of output signals from the drawing data generating unit are input to the comparator, and the comparator outputs a comparison result as a detection signal outside. This improves safety and reliability when severe safety criteria are required such as in a case of monitor-display in industrial plant equipment.

A method and redundant control system for an actuator in which two redundant control computers are connected via buses to a respective peripheral station containing an interface module and at least one periphery module, wherein the actuator is connected to mutually decoupled signal outputs of two periphery modules, each forming an output module, of the two peripheral stations, where output values generated by the two redundant control computers for the actuator are transmitted by the interface modules to the output modules, wherein upon detection of a bus fault, the respective interface module transmits a command to all downstream output modules to output substitute values, and where output modules to which the actuator is connected exchange information about receipt of the command via a communication link and implement it only if another output module concerned has also received the command so as to prevent failure modes in redundant operation.

An arrangement having two redundant modules that monitor one another and that each contain a current or voltage source, which is connected to a first line terminal via a first controllable switch and a first current sensor, wherein each module also has a second line terminal and a ground terminal, between which lies a second current sensor in series with a second controllable switch, where each module, when in the functioning state, closes the controllable switches contained therein, and contains a monitoring device connected to the two current sensors of the modules, the monitoring device generating a monitoring signal identifying the corresponding other module as functioning if at least one of the two current sensors detects a current flow.

A process control system is provided which has at least one OPC client and one OPC server which communicate via a standardized OPC interface. Furthermore the process control system has at least two redundantly operated control devices which each communicate with the OPC server by means of a coupling device. Each control device is designed to provide process variables and status information. The status information contains the current role of the respective control device, wherein the current role is either that of a main control device or an auxiliary control device. The OPC server is designed to detect the main control device in response to the status information of at least one control device, to register a list of variables generated by the OPC client at the main control device and/or to transmit to the OPC client only the process variables which have been provided by the main control device.

According to one embodiment, a system includes control apparatus and server. Control apparatus includes collector, transmitter, receiver and main controller. Collector collects sensing data concerning control targets in social infrastructure. Transmitter transmits collected sensing data to server. Receiver receives control instruction from server. Main controller controls control targets based on control instruction. Server includes acquisition unit, database, generator and instructor. Acquisition unit acquires sensing data from control apparatus. Database stores sensing data. Generator generates control instruction by processing sensing data. Instructor transmits generated control instruction to control apparatus.

A flight control system of an aircraft including a first processing unit, a second processing unit, communication means configured to establish a first two-way digital link and as second two-way digital link between the first processing unit and the second processing unit. The second link is redundant with the first link, and the first link and second link are likely to be active concomitantly. The system further includes backup communication means enabling data exchanges between the first processing unit and the second processing unit in the case of a failure in the first link and second link. The backup communication means includes an array of sensors or actuators and/or a secure onboard network for the avionics.

A device for failsafe monitoring a number of passes of a moving machine part through a defined movement region comprising an input for receiving an encoder signal, which represents a motion value of the moving machine part. The device further comprises a failsafe evaluation unit for providing a failsafe shutdown signal as a function of the number of passes of the moving machine part through the defined movement region. The failsafe evaluation unit is configured to determine the number of passes of the moving machine part through the defined movement region from the motion value.

An input circuit for reading in an analog input signal of a sensor comprises: first and second input ports connectable to the sensor; a first current-measuring signal converter connected to the first input port and comprising a current-measuring apparatus to determine a first output signal from the analog input signal; a current-limiting apparatus inside the first current-measuring signal converter for limiting a maximum current flowing through the first current-measuring signal converter; and a second current-measuring signal converter connected to the second input port and comprising a current-measuring apparatus to determine a second output signal from the analog input signal, wherein the first and second current-measuring signal converters are connected in series; and a testing apparatus for comparing the first and second output signals to detect faults of the first and second current-measuring signal converters in response to deviations between the first and second output signals exceeding a limit value.

To achieve an automatic adjustment of a monitoring time in an automation system with a first automation device and a second automation device, at least one of the two automation devices operates a measuring program. A desired ring interruption is carried out by the measuring program by blocking a ring port in order thus to provoke a ring reconfiguration that utilizes a reconfiguration time. The blockage of the ring port is canceled again after the reconfiguration time has elapsed. The ring port is blocked again if the ring port has been opened by the ring reconfiguration, and all routing tables are deleted. As a result of this, at least the peripheral units are triggered to learn new network routes. Runtimes of test telegrams are measured, and a maximum value of the measured runtimes is stored. The measured maximum value is used for a dynamic adjustment of the monitoring time.

An output module comprises two management units each of which calculates the current demand for the module independently from one another. One management unit controls an output current, controller whilst the other unit monitors the current produced by the output current controller against an independently calculated demand. The output module has multiple output modules. In normal operation, each module provides a portion of the required output current, the total output current being equal to the sum of the currents output by each module. in the event of failure on one of the, modules, the other module or modules switch to providing the total current required and the failed module is switched to a fail safe mode by using an isolation circuit to switch off the output current from that module.