A method for creating a redundant automation system, a computer program and a computer-readable medium, wherein the redundant automation system includes at least one automation installation to be controlled that is installed at an installation location and two control applications that are communicatively interconnected via a synchronization path, and includes a plurality of communication hubs and communication paths connecting these to one another, where one of the control applications operates as the master and the other control application operates as a reserve, such that when the control application operating as the master fails, the control application operating as the reserve function as the master, and where the locations of the computing resources for the control applications are selected such that the control applications are connected to the at least one automation installation via two different communication paths preferably having no or a minimal number of common communication hubs.

The present disclosure relates to a control system for selectively controlling a vehicle, ensuring high integrity of decisions taken by the control system when controlling the vehicle. The present disclosure also relates to a corresponding computer implemented method and to a computer program product.

An input circuit for reading in an analog input signal of a sensor comprises: first and second input ports connectable to the sensor; a first current-measuring signal converter connected to the first input port and comprising a current-measuring apparatus to determine a first output signal from the analog input signal; a current-limiting apparatus inside the first current-measuring signal converter for limiting a maximum current flowing through the first current-measuring signal converter; and a second current-measuring signal converter connected to the second input port and comprising a current-measuring apparatus to determine a second output signal from the analog input signal, wherein the first and second current-measuring signal converters are connected in series; and a testing apparatus for comparing the first and second output signals to detect faults of the first and second current-measuring signal converters in response to deviations between the first and second output signals exceeding a limit value.

A control system is for controlling safety-critical processes, non-safety-critical processes, and/or installation components. The control system includes: at least one control unit configured to control non-safety-critical processes and/or non-safety-critical installation components, at least one safety control unit for controlling safety-critical processes and/or safety-critical installation components, and at least one input/output unit connected to the first control unit via an internal input/output bus. The control system is configured to act as communication master or as communication minion or as both in a pool having other devices that is connected via field bus, and to that end, the control system includes a master communication coupler and a minion communication coupler. The control system is modularly configurable. At least the safety control unit includes respective subunits with master functionality and subunits with minion functionalities.

A program modification support device supports modifications of programs realizing functions of a process control system comprising a first process control device and a second process control device. The program modification support device includes a selector configured to select, from data used in a first program among the programs, data required to be maintained for continuing a first function when switching from the first process control device to the second process control device is performed, the first program being for realizing the first function required to be continued when the switching is performed.

The real time capability is to be improved in a Cloud-based control system for an automation plant. To this end, a redundantly embodied, Cloud-based control system with a plurality of computing resources distributed over a network with control applications running thereon is proposed, which, embodied as a primary and backups, execute a control program almost simultaneously and send corresponding program instructions to the automation plant. Long transmission times of individual computing resources therefore do not have a negative effect on the control of the automation plant.

The present invention provides a method for operating dual controller which monitors the state of a dual controller to determine whether the dual controller is faulty and enables operation thereof with a controller in a normal state. An operation method of a dual controller according to the present invention dq-converts control command output values of first and second controllers to calculate rates of change in dq conversion values and dq-converts feedback input values, fed back to the first and second controllers, to calculate average rates of change in dq conversion values. When the average rates of change in the dq conversion values for the control command output values and the average rates of change in the dq conversion values for the feedback input values for the respective first and second controllers are identical, the corresponding controller is determined to be in a normal state, and to be in a faulty state otherwise. According to the results of the determination, the controller in the faulty state is set to a standby state and the controller in the normal state is set to an active state.

Method for operating a redundantly configured automation system which includes has a first subsystem, a second subsystem and a third subsystem, wherein a sequence program is implemented in each of the subsystems of the automation system and is executable in a runtime environment to fulfill automation tasks, and wherein a data memory is implemented in the subsystems in each of the automation systems, where the sequence program includes at least a first subprogram and a second subprogram, the data memory in each of the subsystems includes at least a first submemory and a second submemory, the first subprogram and the first submemory are synchronized with a first synchronization clock between the first and second subsystems, and the second subprogram and the second submemory are synchronized with a second synchronization clock between the first and third subsystems, and where the first and synchronization clocks differ from one another.

A method for operating a mobile platform includes detecting a malfunction in a first sensor communicating with a sensor controller associated with the mobile platform, and, in response to detecting the malfunction in the first sensor, eliminating the first sensor from a sensor data source for controlling the mobile platform, enabling a second sensor to be in the sensor data source, continuing to receive and evaluate data from the first sensor, and, in response to not detecting an anomaly in the data from the first sensor, restoring the first sensor back into the sensor data source.

The present invention concerns a flight control system of an aircraft comprising: —a first processing unit (1), —a second processing unit (2), —communication means configured to establish a first two-way digital link (3) and a second two-way digital link (4) between the first processing unit (1) and the second processing unit (2), said second link (4) being redundant with the first link (3), and said first link (3) and second link (4) being likely to be active concomitantly, said system further comprising backup communication means enabling data exchanges between the first processing unit (1) and the second processing unit (2) in the case of a failure in the first link (3) and second link (4), said backup communication means comprising an array of sensors or actuators (13) and/or a secure onboard network for the avionics (14).