The purpose of the present invention is to solve the new problem of appropriately protecting a control apparatus and a controller system including the control apparatus against a security event. The execution content of a security protection process performed by a security-monitoring device is determined in accordance with the action state of this control apparatus and/or a notification issued through a control arithmetic operation by the control apparatus.

A programmable logic controller for an industrial control system is disclosed which includes an application logic execution layer and at least one of an update checking layer and an output checking layer. The application logic layer is configured for processing sensor input data to generate an output parameter for an actuator. The output checking layer is configured for outputting only an allowed output parameter to the actuator. The update checking layer is configured for verifying whether application logic update defined by application logic update data corresponds to an application logic update in a list of allowed logic updates, and the application logic is updated only if the update data is allowed application logic update data.

A safety system includes a safety unit and at least one safety related participant which comprises a protective device and a first and a second interruptible signal transmission path which can be interrupted together on the occurrence of a non-secure state of the protective device. The safety system includes at least one test signal path which runs through the safety related participant to a safety input of the safety unit starting from an output of the safety unit and comprises at least one of the first and the second interruptible signal transmission paths. The safety related participant comprises an interruption switch arranged in the test signal path and an evaluation unit which is connected to the first signal transmission path and/or to a first switching signal output of the protective device and to the second signal transmission path and/or to a second switching signal output of the protective device.