Provided is a monitoring and controlling unit for use in an autonomous system with self-X properties, including a test data interface for receiving test data, a real data interface for receiving real data, wherein the test data is compared with the real data to determine whether there is a part of new data in the real data, if a part of new data is identified in the real data, the test data is updated with the part of new data and an output interface for sending the updated test data, which can be further processed into at least one executable test. Further, provided is an according autonomous device, an autonomous system, method of self-testing of an autonomous system and computer program.

A self-diagnostic circuit includes an electrical conductor configured to multiplex, a first switch interposing the electrical conductor, and a first module crossing the first switch. The first module includes a first receptor antenna associated with the conductor on one side of the first switch, a first emitter antenna associated with the conductor on an opposite side of the first switch, and a first interfacing microprocessor. The first interfacing microprocessor is configured to receive no signal from the first receptor antenna when the first switch is open thus generating a first open signal and a first address signal indicative of the first module and outputting the first open signal and the first address signal to the conductor via the first emitter antenna. The first interfacing microprocessor is further configured to receive a first induced frequency signal from the first receptor antenna when the first switch is closed thus generating a first closed signal and the first address signal indicative of the first module and outputting the first closed signal and the first address signal to the conductor via the first emitter antenna.

In a semiconductor device according to the related art, unfortunately, a non-safety unit mounted on the same device as a safety unit is modified with low flexibility. According to one embodiment, a first semiconductor chip and a second semiconductor chip each have space domain separation hardware for limiting access to hardware resources in a functional safety system. Safety unit software and space domain and time domain separation software are executed in a time sharing manner. Based on a timer installed on the semiconductor chip, the space domain and time domain separation software performs separation for intermittently executing the safety unit software in a predetermined cycle, self-diagnosis for examining an operation of the safety unit software, and mutual diagnosis made between the first semiconductor chip and the second semiconductor chip to mutually diagnose the operation of the space domain and time domain separation software for performing the separation and the self-diagnosis.

A field device includes a controller and a process communication module. The controller is configured to perform at least one operation related to process control and is also configured to perform at least one self-recovery operation relative to the field device. The process communication module is coupled to the controller and is configured to couple to a process communication segment and communicate in accordance with a process communication protocol. The controller is configured to detect an erroneous condition and selectively apply the at least one self-recovery operation in response to the detected erroneous condition.

A safety sensor for monitoring the operational safety of a system comprises at least one safety signal input and at least one safety signal output. The safety sensor has a control unit. The control unit imprints the output safety signal with additional data, wherein the signal value of the output safety signal is changed within the limits of the value range assigned to the presently output signal state of the output safety signal depending on the additional data of the signal value of the output safety signal, and/or the control unit imprints the received input safety signal with additional data, wherein the signal value of the received input safety signal is changed within the limits of the value range assigned to the presently received signal state of the input safety signal depending on the additional data of the signal value of the received input safety signal.

A field device, which measures a physical quantity in a plant or processes the physical quantity, includes: an instruction unit configured to output a verification execution instruction signal for instructing execution of verification of the field device; an operation verifying unit configured to verify an operation of at least one element of the field device in response to the verification execution instruction signal and to verify an operation of the field device based on the verification result; and an output unit configured to output the verification result which is a result of verification of the operation by the operation verifying unit.

An optocoupler based control circuit and a method thereof are disclosed. The control circuit comprises a first control branch, which includes a first control signal input terminal configured to receive a first OFF function control signal; a first optocoupler, wherein a primary side of the first optocoupler is coupled to the first control signal input terminal, and an output of a secondary side of the first optocoupler is configured to control a first power supplied to a motor driving circuit; a first primary side on/off control circuit connected to the primary side of the first optocoupler, and configured to periodically turn on and off the coupling of the primary side to the first control signal input terminal; and a first secondary side filter circuit connected to the secondary side of the first optocoupler, and configured to filter the output of the secondary side, and configured as a low pass filter having a cutoff frequency lower than an on/off frequency of the primary side. The control circuit further comprises a diagnostic circuit configured to diagnose an operating state of the control circuit based on the output of the secondary side of the first optocoupler and the first power. The control circuit may be a Safe Torque Off (STO) circuit.

In a semiconductor device according to the related art, unfortunately, a non-safety unit mounted on the same device as a safety unit is modified with low flexibility. According to one embodiment, a first semiconductor chip and a second semiconductor chip each have space domain separation hardware for limiting access to hardware resources in a functional safety system. Safety unit software and space domain and time domain separation software are executed in a time sharing manner. Based on a timer installed on the semiconductor chip, the space domain and time domain separation software performs separation for intermittently executing the safety unit software in a predetermined cycle, self-diagnosis for examining an operation of the safety unit software, and mutual diagnosis made between the first semiconductor chip and the second semiconductor chip to mutually diagnose the operation of the space domain and time domain separation software for performing the separation and the self-diagnosis.

Provided is a monitoring and controlling unit for use in an autonomous system with self-X properties, including a test data interface for receiving test data, a real data interface for receiving real data, wherein the test data is compared with the real data to determine whether there is a part of new data in the real data, if a part of new data is identified in the real data, the test data is updated with the part of new data and an output interface for sending the updated test data, which can be further processed into at least one executable test. Further, provided is an according autonomous device, an autonomous system, method of self-testing of an autonomous system and computer program.

An optocoupler based control circuit and a method thereof are disclosed. The control circuit comprises a first control branch, which includes a first control signal input terminal configured to receive a first OFF function control signal; a first optocoupler, wherein a primary side of the first optocoupler is coupled to the first control signal input terminal, and an output of a secondary side of the first optocoupler is configured to control a first power supplied to a motor driving circuit; a first primary side on/off control circuit connected to the primary side of the first optocoupler, and configured to periodically turn on and off the coupling of the primary side to the first control signal input terminal; and a first secondary side filter circuit connected to the secondary side of the first optocoupler, and configured to filter the output of the secondary side, and configured as a low pass filter having a cutoff frequency lower than an on/off frequency of the primary side. The control circuit further comprises a diagnostic circuit configured to diagnose an operating state of the control circuit based on the output of the secondary side of the first optocoupler and the first power. The control circuit may be a Safe Torque Off (STO) circuit.