The present disclosure relates to a control system for selectively controlling a vehicle, ensuring high integrity of decisions taken by the control system when controlling the vehicle. The present disclosure also relates to a corresponding computer implemented method and to a computer program product.

Disclosed is a redundant hot standby control system including K industrial personal computers, with a plurality of virtual control devices being established thereon respectively, at least one of the plurality of virtual control devices being established on each IPC as a main control device; and the other virtual control devices being standby control devices. Each of the standby control devices corresponds to a virtual control device, which serves as the main control device on another IPC, except for the IPC to which the standby control device itself belongs. A procedure, which is the same as that operated on the main control device corresponding thereto, is operated on the standby control device. A control bus of the system is used for connecting a plurality of the M IPCs; and a field bus is used for connecting the M IPCs and a plurality of field devices.

Disclosed is a redundant hot standby control system including K industrial personal computers, with a plurality of virtual control devices being established thereon respectively, at least one of the plurality of virtual control devices being established on each IPC as a main control device; and the other virtual control devices being standby control devices. Each of the standby control devices corresponds to a virtual control device, which serves as the main control device on another IPC, except for the IPC to which the standby control device itself belongs. A procedure, which is the same as that operated on the main control device corresponding thereto, is operated on the standby control device. A control bus of the system is used for connecting a plurality of the M IPCs; and a field bus is used for connecting the M IPCs and a plurality of field devices.

A plant state displaying apparatus displaying information representing a state of a plant includes a generator that: acquires plant information from at least one of devices, apparatuses, and facilities installed in the plant; calculates a state value representing the state of the plant using the plant information; and generates a plant state diagram in which at least one of a color and a density of at least one of devices, apparatuses, and facilities from which the plant information is acquired is changed according to magnitude of the state value; and a display that displays the plant state diagram generated by the generator as the information representing the state of the plant.

Exemplary embodiments pertain to a system that can include a high-level controller coupled to a low-level controller for controlling a physical asset. In one exemplary implementation, the high-level controller executes a first finite state machine for controlling a power generation unit via a network. The low-level controller executes a second finite state machine that may have fewer states than the first finite state machine. The second finite state machine places the low-level controller in a default mode of operation for controlling the power generation unit under various conditions such as when the high-level controller is controlling the physical asset during a normal mode of operation; when the high-level controller is revising the first finite state machine; when the high-level controller is controlling the physical asset using a revised first finite state machine; and/or upon detecting a loss of communications between the high-level controller and the low-level controller.

An industrial control device allows end users to customize the mode model that defines rules for arbitrating between program and operator control. The industrial control device includes configuration tools that allow the user to define which set of states or modes are to be used for arbitrating between program control and operator control in accordance with the usages and standards of a given industrial facility or enterprise. The configuration tools also allow the commands for transitioning between the selected ownership states to be modified to conform to a desired ownership mode model. Using the mode model configuration tools, users can adapt the ownership mode model to conform to their own customer-specific or industry-specific standards of operator/program arbitration. In some scenarios, the customized mode model can be applied to defined multilevel equipment groupings such that control ownership is cascaded to all devices of a defined ownership chain.

Exemplary embodiments pertain to a system that can include a high-level controller coupled to a low-level controller for controlling a physical asset. In one exemplary implementation, the high-level controller executes a first finite state machine for controlling a power generation unit via a network. The low-level controller executes a second finite state machine that may have fewer states than the first finite state machine. The second finite state machine places the low-level controller in a default mode of operation for controlling the power generation unit under various conditions such as when the high-level controller is controlling the physical asset during a normal mode of operation; when the high-level controller is revising the first finite state machine; when the high-level controller is controlling the physical asset using a revised first finite state machine; and/or upon detecting a loss of communications between the high-level controller and the low-level controller.

An industrial control device allows end users to customize the mode model that defines rules for arbitrating between program and operator control. The industrial control device includes configuration tools that allow the user to define which set of states or modes are to be used for arbitrating between program control and operator control in accordance with the usages and standards of a given industrial facility or enterprise. The configuration tools also allow the commands for transitioning between the selected ownership states to be modified to conform to a desired ownership mode model. Using the mode model configuration tools, users can adapt the ownership mode model to conform to their own customer-specific or industry-specific standards of operator/program arbitration. In some scenarios, the customized mode model can be applied to defined multilevel equipment groupings such that control ownership is cascaded to all devices of a defined ownership chain.

A method is provided for selecting a plurality of program functions for providing repeatedly implemented functions, e.g., in a vehicle, ship or in an aircraft. The method includes determining a first total performance value based on recorded first single performance values and recorded first dependencies, determining a first total performance value based on determined second single performance values and recorded second dependencies, determining a cluster performance from the first total performance value and from the second total performance value, and the cluster performance value or at least one value determined from the cluster performance value is used for selecting the program functions or of other program functions for providing the repeatedly implemented functions.

In a method for actuating at least one actuator, two control units and a selection logic are provided, and each of the control units is designed to influence the actuator. Each of the control units performs a self-diagnosis, and each of the control units generates at least one activating signal as a function of the self-diagnosis. The activating signal indicates which of the control units is to be activated. The selection logic activates one of the two control units for influencing the actuator as a function of the activating signals.