A controller includes: a communication port and a connection port that allow communication with another controller; and a hardware processor coupled to the ports. The hardware processor is configured to: transmit a first state signal indicating a state of the controller of an own device to the other controller from each port; receive a second state signal indicating a state of the other controller from the other controller via each of the ports; and switch, when the own device is in a standby state, the own device from the standby state to an operating state, when a breakdown of the other controller indicated by the received second state signal and an unreceived state in which the second state signal is not received for a predetermined time or more from both the communication and connection ports are monitored and at least one of the breakdown and the unreceived state is detected.

A method for creating a redundant automation system, a computer program and a computer-readable medium, wherein the redundant automation system includes at least one automation installation to be controlled that is installed at an installation location and two control applications that are communicatively interconnected via a synchronization path, and includes a plurality of communication hubs and communication paths connecting these to one another, where one of the control applications operates as the master and the other control application operates as a reserve, such that when the control application operating as the master fails, the control application operating as the reserve function as the master, and where the locations of the computing resources for the control applications are selected such that the control applications are connected to the at least one automation installation via two different communication paths preferably having no or a minimal number of common communication hubs.

A flight management assembly of an aircraft and method of monitoring the flight management assembly. The assembly includes two flight management systems, and a monitoring and backup unit, each of the flight management systems configured for generating data including a trajectory and a prediction of a parameter of the aircraft, one of the flight management systems being active and the other being passive, the monitoring and backup unit configured for carrying out monitoring of at least one of the items of data generated by the active flight management system in order to verify if the item of data is valid, the flight management assembly carrying out, in case of validation of the monitored item of data, a synchronization of the monitoring and backup unit and of the passive flight management system, with data called synchronization data of the active flight management system, namely a flight plan and/or a flight trajectory.

A method for use by a primary device associated with a secondary device of a redundant pair, the primary device issuing a synchronization request to its control database causing the primary device to send a tracked memory file storage of the primary device to the secondary device to update the secondary device control database and to periodically send on request of the primary device the cached changes made in the primary device to the secondary device to update the secondary device control database. The secondary device using the updated control database to identify communications connections and paths to I/O modules and peer devices assigned to the secondary device and to perform diagnostic testing of the communications connections and paths identified by the interrogation and send diagnostic messages upon detection of faults in the communication connections and paths identified.

A program modification support device supports modifications of programs realizing functions of a process control system comprising a first process control device and a second process control device. The program modification support device includes a selector configured to select, from data used in a first program among the programs, data required to be maintained for continuing a first function when switching from the first process control device to the second process control device is performed, the first program being for realizing the first function required to be continued when the switching is performed.

Methods and systems for synchronizing controllers in an automation control system, can involve arranging redundancy elements in an automation control system comprising a group of nodes, wherein the redundancy elements can include one or more primary controllers and a group of concurrent secondary controllers, and wherein a back-up to the primary controller can exist on any node. Such methods and systems can further involve backing-up of the primary controller by the one or more secondary controllers to allow the primary controller to maintain the one or more secondary controllers as a new, alternate secondary controller for a load balancing or an equipment update.

The real time capability is to be improved in a Cloud-based control system for an automation plant. To this end, a redundantly embodied, Cloud-based control system with a plurality of computing resources distributed over a network with control applications running thereon is proposed, which, embodied as a primary and backups, execute a control program almost simultaneously and send corresponding program instructions to the automation plant. Long transmission times of individual computing resources therefore do not have a negative effect on the control of the automation plant.

Method for operating a redundantly configured automation system which includes has a first subsystem, a second subsystem and a third subsystem, wherein a sequence program is implemented in each of the subsystems of the automation system and is executable in a runtime environment to fulfill automation tasks, and wherein a data memory is implemented in the subsystems in each of the automation systems, where the sequence program includes at least a first subprogram and a second subprogram, the data memory in each of the subsystems includes at least a first submemory and a second submemory, the first subprogram and the first submemory are synchronized with a first synchronization clock between the first and second subsystems, and the second subprogram and the second submemory are synchronized with a second synchronization clock between the first and third subsystems, and where the first and synchronization clocks differ from one another.

A method for operating a redundant automation system having a plurality of subsystems, wherein one subsystem of the plurality of subsystems operates as a master and assumes process control and the other subsystem operates as a reserve during redundant operation, where measures are provided by which the availability of the redundant automation system is increased, and where regardless of whether transient errors occur on the subsystem of the plurality of subsystems operating as the master or on the subsystem operating as the reserve, a total failure of the automation system is largely avoided.

A method for operating a redundant automation system having a plurality of subsystems, wherein one subsystem of the plurality of subsystems operates as a master and assumes process control and the other subsystem operates as a reserve during redundant operation, where measures are provided by which the availability of the redundant automation system is increased, and where regardless of whether transient errors occur on the subsystem of the plurality of subsystems operating as the master or on the subsystem operating as the reserve, a total failure of the automation system is largely avoided.