A method for controlling an automation system having control redundancy is provided. The automation system has at least a first controller, a second controller and a plurality of field devices connected to the first and second controller via a data bus, with the first and second controller configured to cyclically control an automation process of the automation system. The method comprises cyclically controlling the automation process via the first controller, determining a malfunction of the first controller during an (n+x)-th control cycle, where the (n+x)-th control cycle is carried out x control cycles later in time than the n-th control cycle, and sending out an n-th set of output data via a second input-output unit of the second controller to the plurality of field devices in the (n+x)-th control cycle, for controlling the automation process. An automation system is configured to carry out the method.

A controller includes: a communication port and a connection port that allow communication with another controller; and a hardware processor coupled to the ports. The hardware processor is configured to: transmit a first state signal indicating a state of the controller of an own device to the other controller from each port; receive a second state signal indicating a state of the other controller from the other controller via each of the ports; and switch, when the own device is in a standby state, the own device from the standby state to an operating state, when a breakdown of the other controller indicated by the received second state signal and an unreceived state in which the second state signal is not received for a predetermined time or more from both the communication and connection ports are monitored and at least one of the breakdown and the unreceived state is detected.

A controller includes: a communication port and a connection port that allow communication with another controller; and a hardware processor coupled to the ports. The hardware processor is configured to: transmit a first state signal indicating a state of the controller of an own device to the other controller from each port; receive a second state signal indicating a state of the other controller from the other controller via each of the ports; and switch, when the own device is in a standby state, the own device from the standby state to an operating state, when a breakdown of the other controller indicated by the received second state signal and an unreceived state in which the second state signal is not received for a predetermined time or more from both the communication and connection ports are monitored and at least one of the breakdown and the unreceived state is detected.

A method for controlling an automation system having control redundancy is provided. The automation system has at least a first controller, a second controller and a plurality of field devices connected to the first and second controller via a data bus, with the first and second controller configured to cyclically control an automation process of the automation system. The method comprises cyclically controlling the automation process via the first controller, determining a malfunction of the first controller during an (n+x)-th control cycle, where the (n+x)-th control cycle is carried out x control cycles later in time than the n-th control cycle, and sending out an n-th set of output data via a second input-output unit of the second controller to the plurality of field devices in the (n+x)-th control cycle, for controlling the automation process. An automation system is configured to carry out the method.