WO1996024891A1 - Systemarchitektur mit einem programm, welches einen peripherieeingang sperrt, solange es infolge von zeitscheibenverfahren nicht auf einem prozessor läuft - Google Patents
Systemarchitektur mit einem programm, welches einen peripherieeingang sperrt, solange es infolge von zeitscheibenverfahren nicht auf einem prozessor läuft Download PDFInfo
- Publication number
- WO1996024891A1 WO1996024891A1 PCT/DE1996/000145 DE9600145W WO9624891A1 WO 1996024891 A1 WO1996024891 A1 WO 1996024891A1 DE 9600145 W DE9600145 W DE 9600145W WO 9624891 A1 WO9624891 A1 WO 9624891A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- processor
- prog
- program
- system architecture
- program complex
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/1629—Error detection by comparing the output of redundant processing systems
- G06F11/1637—Error detection by comparing the output of redundant processing systems using additional compare functionality in one or some but not all of the redundant processing components
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B19/00—Programme-control systems
- G05B19/02—Programme-control systems electric
- G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
- G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
- G05B19/0428—Safety, monitoring
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B19/00—Programme-control systems
- G05B19/02—Programme-control systems electric
- G05B19/18—Numerical control [NC], i.e. automatically operating machines, in particular machine tools, e.g. in a manufacturing environment, so as to execute positioning, movement or co-ordinated operations by means of programme data in numerical form
- G05B19/406—Numerical control [NC], i.e. automatically operating machines, in particular machine tools, e.g. in a manufacturing environment, so as to execute positioning, movement or co-ordinated operations by means of programme data in numerical form characterised by monitoring or safety
- G05B19/4063—Monitoring general control system
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0796—Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
Definitions
- the 3etneb is being automated to an increasing extent by machines, including machines that, due to the large number of independent axes, have a significant control effort. In order to exclude dangers to people and machines as much as possible, these controls have to be to a very high degree safe, at least: in terms of such control instructions, the incorrect operation of which can have catasrophaic consequences for people or machines.
- the electrical outlay and the outlay on components it makes sense to run two different program complexes in one and the same processor, whereby there should always be control over how the two program complexes interact with one another.
- peripheral means equipped with inhibit inputs it can be ensured that the second program complex is unable to issue any commands to the peripheral means of which the first program complex has no knowledge.
- the first program complex is a securely verified program complex, it switches the peripheral means assigned to it and only to be commanded by it to a state in which it does not issue any commands to its on before it transfers the processor or computer core to the second program complex - and accept exits. Read access to the registers of these peripherals can remain permissible.
- the second program complex receives the processor or computer core, it can run essentially autonomously there. If, as a result of programming errors or other errors in the data, the second program complex tries in a non-conforming manner to write access to the peripheral means of the first complex, the blocked peripheral means will ignore these inputs provided to them and will not execute them.
- the first program complex becomes aware of this hostile behavior of the second program complex by changing the state on the inhibit line. If he detects manipulations on the inhibit line, he has the opportunity to shutdown the entire system, to which the system architecture belongs, in an orderly manner.
- the new system architecture is linked to other security means in order to make security as high as possible.
- the system architecture described is only a section of an entire system which is regarded as safe, the security of which is ensured in the known manner by alternately querying and checking adjacent channels and their data.
- the first peripheral means are reserved exclusively for the first program complex or that there is at least one of the first peripheral means which is permissible to be read and / or read from both program complexes.
- the two program complexes may be expedient to have a memory area via which the two program complexes communicate with one another, since they only have the processor one after the other, and consequently cannot work simultaneously. They therefore need a common "letter asten", through which they can exchange messages or data.
- This memory for the communication of the program complexes is preferably accommodated in the second memory means, since this inevitably ensures that the data and commands of the first program complex which are in the first memory means are not caused by a faulty behavior of the second program complex can be changed.
- a particularly secure system is obtained if the first storage means are reserved exclusively for the first program complex. In principle, the same can also exist for the second program complex, so that a further memory area is provided as a communication area for the program complexes.
- the first program complex has the higher priority, ie, even if the second program complex does not conform, it must get the processor back within a predetermined time in order to be able to carry out its control function. This may not be the case if the second program complex hangs in an endless loop and no longer reaches the program point at which it voluntarily returns the processor.
- the processor is preferably provided with an interrupt control to which a timer is connected is. As a result, the processor can forcibly remove the second program complex so that the first program complex in turn comes into the possession of the processor.
- the security of the overall system can be increased if at least one further processor exists in parallel to the first processor, in which a program related to the first program complex runs, so that both processors or program complexes can constantly compare their data and calculation results with one another in order to: Difference of the results to be able to shut down the controlled system in a sensible, harmless manner
- the program complex running on the third processor can show the same behavior from the point of view of its peripheral means assigned to it as the first program complex from the point of view of its peripheral means, but both program codes are designed differently.
- This different design of the program codes is inevitably achieved if the first and the second processor are different, for example in the register length or the available commands.
- the further processor can also be used to check whether, while the first program complex did not have the processor, the second program complex changed the data on the peripheral means in an impermissible manner after changing the signals at the inhibit inputs. After the first program complex has returned, the latter is able to read the data from the peripheral means and to compare it with the data that the third program complex has received from its peripheral means. As soon as a difference occurs there, the system is in turn able to shut down the controlled machine.
- Fig. 2 highly schematized the temporal behavior of the two program complexes that run on the first processor.
- a new system architecture 1 for process control is illustrated in a block diagram in FIG. 1 (the controlled process itself is not shown and can be a machine tool, a chemical process or the like).
- This system architecture 1 has a first processor 2 and a second processor 3, which are connected to one another via communication lines 4.
- Two separate memories 4 and 5 are also connected to processor 2 via communication lines 6 and 7. These two memories 4 and 5 are implemented in terms of hardware in physically separate memory modules.
- At least the first processor 2 has an interrupt control with a corresponding assigned input 8, to which a clock or a timer 9 is connected.
- the timer 9 can also be part of the processor 2 itself.
- Two groups 12 and 13 of peripheral devices are connected to the first processor 2 via a bus system or corresponding communication lines 11.
- Peripheral means are to be understood to mean those hardware devices as are used in process or machine controls to control the process. A distinction is made between those peripheral devices which only report information about the process which is to be controlled to the controller and also those peripheral devices which convert commands from the controller into changes in the state of the process, for example by relays, solenoid valves, and electromechanical interlocks and the like actuate.
- Peripheral means 12a As an example of a peripheral means that only transmits information to the control Peripheral means 12a shown, which for example transfers temperature or position information to the control.
- the part framed by the block is intended to symbolize all the necessary hardware which is necessary to convert the physical signal into the electrical quantity, that with the interface, such as that through the communication lines 11 and the corresponding input connection of the first processor 2 is formed, are compatible.
- the read access to the peripheral means 16a in principle does not mean that write accesses are also possible which cause state changes within the peripheral means 12a.
- a second peripheral means 12b is intended to symbolize all those peripheral means which convert information or commands supplied by the first processor 2 via the communication lines 11 into a physical quantity.
- the interface means 12b thus intervene directly in the process to be controlled and to be controlled, for example by actuating a schematically indicated electromagnetic valve 14.
- Other electromechanical converters such as DC or AC motors, heating devices, ignition devices and the like. can also be part of the relevant peripheral means 12b.
- the dashed line 15 drawn between the two peripheral means 12a and 12b is intended to indicate that a much larger number of peripheral means may be present, and is usually also present, than only the two peripheral means 12a and 12b.
- the two peripheral means 12a and 12b are each provided with an inhibit input 16a or 16b, which is connected to a common inhibit line 17 which connects the inhibit inputs 16a and 16b with a corresponding I / O Port 18 of the first processor 2 connects.
- the second group of peripheral devices is similar composed like the first group 12, ie it also consists of peripheral means that supply information to the first processor 2, as well as peripheral means that convert commands of the first processor 2 into corresponding physical or electrical quantities.
- peripheral means 13a to 13b of the second group 13 differ from the peripheral means 12a to 12b in the direction of the process to be controlled.
- the second processor 3 serves to increase the redundancy, which is why it differs in terms of hardware from the first processor 2, i.e. it has, for example, a different instruction set and / or a different register length. Furthermore, it is implemented in its own chip or even arranged on its own circuit board.
- the second processor 3 is connected via communication lines 19 to a memory 20 assigned to it and via further communication lines 22 to its own set of peripheral means 23 which, from the point of view of the process to be controlled, have the same function as the peripheral means 12a to 12b of the first group 12 and which, if necessary as far as the execution of commands is concerned, are AND-linked on the output side to the process, so that state changes in the process or the machine are carried out first when the two processors 2 and 3 are connected via the peripheral means 12 concerned or 13 give the same output commands.
- the new system architecture 1 it is possible to run two different program complexes, one of which is a verified and security-checked program complex, while the other second program complex is a program complex to which less stringent security requirements are imposed.
- the secure program complex has a counterpart in the processor 3 and is implemented there with a corresponding program which is stored exclusively in the memory 21 and the data of which is likewise only in the memory 21 are so far as they do not come from the peripheral means 23 or are held there.
- the verified program complex relevant for the safety of the controlled process referred to in the further first program complex, runs as well as a second program complex, which is not decisive for the safety of the controlled process.
- the first program complex is implemented by a program or a set of programs that is stored in the memory 4.
- the second program complex also a program or a set of programs, is found in the memory 5.
- the first program complex because it has been checked for safety, is authorized and intended to address the peripheral means of the second group 12 and to use them to issue commands which actively intervene in the controlled process or the machine and undertake state changes there.
- An example of such a peripheral means is the peripheral means 12b given as an example.
- the first program complex also accesses the peripheral means 12, which transmit information from the process to the program complex; for example via the peripheral means 12a.
- the second program complex works exclusively with the peripheral means of the second group 13, that is to say neither receives data from the first group 12 nor has writing access to these peripheral means of the first group 12.
- This assumption applies to an error-free concept for the second program complex and on the condition that the error-free concept is also used error-free in the corresponding programs.
- the initialization phase for the program complexes has already passed and that the system is in normal operation.
- the first and the second program complex alternate periodically in the first processor 2.
- the behavior is observed at a point in time at which, as indicated in the upper bar with the designation "Prog. I", the first program complex is active, ie it receives data from the process to be controlled and corresponding commands, if necessary , to the process.
- the first program complex constantly compares its measured and calculated data with the corresponding data which the program complex running on the second processor 3 receives from its periphery or calculates from the data obtained. As long as this comparison shows identity, the system continues to work. However, if the two processors 2 and 3 detect deviations, the entire process is stopped immediately in accordance with previously defined routines.
- the first program complex comes to a point within a maximum time limit at which it no longer needs the processor 2.
- the inhibit inputs 16a and 16b of the peripheral means of the first group 12 are first supplied with a blocking signal by the second program complex via the corresponding output 18.
- the peripheral means of the first group 12 get into a state in which they ignore any incoming writing signals that would change their state via the communication lines 11. Reading access in the sense that the peripheral means or the associated interface cards are queried via the communication lines 11, but still remain possible.
- the first program complex of this inhibition After the first program complex of this inhibition has sent to its associated peripheral means 12, it releases the first processor 2.
- the release of the first processor 2 by the first program complex has the result that the second program complex, which is stored in the memory 5, now receives the second processor 2 and thus has the possibility of assigning the second program complex To use peripheral means 13.
- the second program complex works without errors, then it does not have write access, that is to say changes in state, to the peripheral means 12 which are reserved for the first program complex. If he does or tries to do so due to a programming error or another error, the write access has no effect, because the peripheral means 12 are blocked against write access via the inhibit inputs 16a and 16b.
- the second program complex Before a predetermined time has elapsed, the second program complex reaches a program point at which it voluntarily releases the first processor 2.
- the first processor 2 can then in turn start the first program complex.
- This first program complex first checks whether the peripheral means 12 still have the inhibit signal. The inhibit signal is then deleted so that the first program complex can communicate normally with its peripherals 12 again. Next there is a data comparison between the first program complex of the first processor 2 and the program complex running on the second processor 3 and, if this comparison has not shown any differences, the first program complex runs normally on the first processor 2.
- the reinitialization of the first program complex determines that the inhibit signal is no longer present, the first program complex assumes that the second program complex has not behaved in a compliant manner and has attempted to issue control commands via the corresponding ones in an inadmissible manner Peripheral medium to spend 12. Since this is a dangerous error situation, the controlled process is then stopped immediately.
- a further error of the first program complex can consist in the fact that it deletes the inhibit signal and then sets it again in order to be able to access the peripheral means 12 in the meantime in writing.
- Such a malfunction is determined by comparing the data of the first program complex with the data which the program complex holds on the second processor 3. This ensures with a very high degree of certainty that the second program complex, which is not subject to a safety-related check, does not interfere with the safety-checked first program complex due to concept or other errors. Nevertheless, the two program complexes can run on one and the same processor, and possibly even share those peripheral means via which only data are transmitted in the direction of the processor in question.
- the user who creates the second program complex can avoid complicated error considerations and error handling routines if he accommodates all safety-relevant command sequences in the first program complex and only then needs to do a complicated error consideration for this program complex. Subsequent changes to the second program complex are readily possible, which considerably simplifies the programming of the new system architecture. In particular, it is sufficient if only the hardware, including the first program complex, is checked and approved by the supervisory authority. Without this division, the user would have to have a new check carried out by the supervisory authority for every minor change, even on non-security-relevant command sequences.
- the first is solved in the manner just described and the second program complex on the first processor 2 constantly. After a time slice procedure, you receive the first processor and, provided there are no errors, voluntarily return it within the time slice. If, however, one of the two program complexes gets into an endless loop, the timer 9 runs out before the processor 2 is returned, which then produces an interrupt at the interrupt input 8, which causes the processor to pass into an alarm routine which the interrupts the current program complex and, depending on whether the error occurred in the safety-relevant part or in the non-safety-relevant part, either only issues an error message or the system is shut down on a subordinate basis.
- a system architecture uses at least two processors which jointly control a process and constantly compare their data with one another.
- a program complex runs on one of the two processors, which has been checked for possible errors, and an unchecked program complex.
- the peripheral means which work together with the checked program complex, are provided with inhibit inputs and the checked program complex is blocked the peripheral means reserved for him via the inhibit inputs before he hands over to the unchecked program complex.
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- General Engineering & Computer Science (AREA)
- Automation & Control Theory (AREA)
- Human Computer Interaction (AREA)
- Manufacturing & Machinery (AREA)
- Hardware Redundancy (AREA)
- Storage Device Security (AREA)
- Retry When Errors Occur (AREA)
Abstract
Description
Claims
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US08/894,859 US5920715A (en) | 1995-02-10 | 1996-02-01 | System architecture permitting verified and unverified programs to execute safely on one processor |
DE59602166T DE59602166D1 (de) | 1995-02-10 | 1996-02-01 | Systemarchitektur mit einem programm, welches einen peripherieeingang sperrt, solange es infolge von zeitscheibenverfahren nicht auf einem prozessor läuft |
JP52388796A JP3731186B2 (ja) | 1995-02-10 | 1996-02-01 | システムアーキテクチャ |
EP96900881A EP0808482B1 (de) | 1995-02-10 | 1996-02-01 | Systemarchitektur mit einem programm, welches einen peripherieeingang sperrt, solange es infolge von zeitscheibenverfahren nicht auf einem prozessor läuft |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
DE19504404.5 | 1995-02-10 | ||
DE19504404A DE19504404C1 (de) | 1995-02-10 | 1995-02-10 | Systemarchitektur |
Publications (1)
Publication Number | Publication Date |
---|---|
WO1996024891A1 true WO1996024891A1 (de) | 1996-08-15 |
Family
ID=7753624
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/DE1996/000145 WO1996024891A1 (de) | 1995-02-10 | 1996-02-01 | Systemarchitektur mit einem programm, welches einen peripherieeingang sperrt, solange es infolge von zeitscheibenverfahren nicht auf einem prozessor läuft |
Country Status (6)
Country | Link |
---|---|
US (1) | US5920715A (de) |
EP (1) | EP0808482B1 (de) |
JP (1) | JP3731186B2 (de) |
DE (2) | DE19504404C1 (de) |
ES (1) | ES2132875T3 (de) |
WO (1) | WO1996024891A1 (de) |
Families Citing this family (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2001513236A (ja) * | 1997-02-26 | 2001-08-28 | シーメンス アクチエンゲゼルシヤフト | 検定済のチャネルおよび非検定済のチャネルを有する冗長に構成された電子装置 |
CN1099075C (zh) * | 1997-02-26 | 2003-01-15 | 西门子公司 | 带有认证和非认证通道的冗余电子设备 |
DE19800311A1 (de) * | 1998-01-07 | 1999-07-08 | Itt Mfg Enterprises Inc | Elektronische, digitale Einrichtung |
US6202067B1 (en) * | 1998-04-07 | 2001-03-13 | Lucent Technologies, Inc. | Method and apparatus for correct and complete transactions in a fault tolerant distributed database system |
DE19826875A1 (de) | 1998-06-17 | 1999-12-23 | Heidenhain Gmbh Dr Johannes | Numerische Steuerung mit einem räumlich getrennten Eingabegerät |
US6856627B2 (en) * | 1999-01-15 | 2005-02-15 | Cisco Technology, Inc. | Method for routing information over a network |
US6523139B1 (en) * | 1999-12-17 | 2003-02-18 | Honeywell International Inc. | System and method for fail safe process execution monitoring and output control for critical systems |
DE10240584A1 (de) * | 2002-08-28 | 2004-03-11 | Pilz Gmbh & Co. | Sicherheitssteuerung zum fehlersicheren Steuern von sicherheitskritischen Prozessen sowie Verfahren zum Aufspielen eines neuen Betriebsprogrammes auf eine solche |
DE10261453B4 (de) * | 2002-12-31 | 2010-04-15 | Danfoss Drives A/S | Motorsteuerung |
DE102005041455A1 (de) * | 2005-08-31 | 2007-03-15 | Abb Patent Gmbh | Automatisierungstechnische Einrichtung |
DE102005043481A1 (de) * | 2005-09-13 | 2007-03-15 | Abb Patent Gmbh | Automatisierungstechnische Einrichtung |
DE102005043482A1 (de) * | 2005-09-13 | 2007-03-15 | Abb Patent Gmbh | Automatisierungstechnische Einrichtung |
DE102005043485A1 (de) | 2005-09-13 | 2007-03-15 | Abb Patent Gmbh | Automatisierungstechnische Einrichtung |
FR2893431A1 (fr) * | 2005-11-16 | 2007-05-18 | St Microelectronics Sa | Composant integre securise et procede de securisation associe |
US10031502B2 (en) | 2015-03-27 | 2018-07-24 | Rockwell Automation Germany Gmbh & Co. Kg | I/O expansion for safety controller |
US10025287B2 (en) | 2015-03-30 | 2018-07-17 | Rockwell Automation Germany Gmbh & Co. Kg | Method for assignment of verification numbers |
US10197985B2 (en) | 2015-10-29 | 2019-02-05 | Rockwell Automation Germany Gmbh & Co. Kg | Safety controller module |
DE102015120314A1 (de) * | 2015-11-24 | 2017-05-24 | Pilz Gmbh & Co. Kg | Verfahren zum Programmieren einer Sicherheitssteuerung |
EP3249476B1 (de) * | 2016-05-25 | 2022-06-15 | Leuze electronic GmbH + Co KG | Sensor |
EP3620248B1 (de) * | 2018-09-10 | 2022-06-22 | SMW-Autoblok Spannsysteme GmbH | Kopplungs-einrichtung |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4484270A (en) * | 1982-07-07 | 1984-11-20 | Sperry Corporation | Centralized hardware control of multisystem access to shared and non-shared subsystems |
EP0298396A2 (de) * | 1987-07-08 | 1989-01-11 | Hitachi, Ltd. | Funktionsverteiltes Steuergerät |
Family Cites Families (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4568866A (en) * | 1983-10-26 | 1986-02-04 | Allen-Bradley Company | Programmable controller for stepping motor control |
US5386360A (en) * | 1989-05-09 | 1995-01-31 | Ansan Industries Ltd. | Peripheral data acquisition, monitor, and adaptive control system via personal computer |
US5774721A (en) * | 1995-09-08 | 1998-06-30 | Iq Systems, Inc. | Method of communication between processors in a distributed processing system having a host processor and at least one object oriented processor |
-
1995
- 1995-02-10 DE DE19504404A patent/DE19504404C1/de not_active Expired - Fee Related
-
1996
- 1996-02-01 JP JP52388796A patent/JP3731186B2/ja not_active Expired - Lifetime
- 1996-02-01 EP EP96900881A patent/EP0808482B1/de not_active Expired - Lifetime
- 1996-02-01 WO PCT/DE1996/000145 patent/WO1996024891A1/de active IP Right Grant
- 1996-02-01 DE DE59602166T patent/DE59602166D1/de not_active Expired - Lifetime
- 1996-02-01 US US08/894,859 patent/US5920715A/en not_active Expired - Lifetime
- 1996-02-01 ES ES96900881T patent/ES2132875T3/es not_active Expired - Lifetime
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4484270A (en) * | 1982-07-07 | 1984-11-20 | Sperry Corporation | Centralized hardware control of multisystem access to shared and non-shared subsystems |
EP0298396A2 (de) * | 1987-07-08 | 1989-01-11 | Hitachi, Ltd. | Funktionsverteiltes Steuergerät |
Also Published As
Publication number | Publication date |
---|---|
ES2132875T3 (es) | 1999-08-16 |
DE19504404C1 (de) | 1996-06-20 |
DE59602166D1 (de) | 1999-07-15 |
EP0808482A1 (de) | 1997-11-26 |
JP3731186B2 (ja) | 2006-01-05 |
JPH11504735A (ja) | 1999-04-27 |
EP0808482B1 (de) | 1999-06-09 |
US5920715A (en) | 1999-07-06 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP0808482A1 (de) | Systemarchitektur mit einem programm, welches einen peripherieeingang sperrt, solange es infolge von zeitscheibenverfahren nicht auf einem prozessor läuft | |
EP0972388B1 (de) | Verfahren zur programmierung eines sicherheitsgerichteten steuerungssystems | |
DE3688722T2 (de) | Datensteuersystem für Systemkanal zur digitalen automatischen Flugsteuerung mit mehreren verschiedenen Datenverarbeitungen. | |
DE60309928T2 (de) | Verfahren zur erhöhung der sicherheitsintegritätsstufe eines kontrollsystems | |
EP0011685B1 (de) | Programmierbare Speicherschutzeinrichtung für Mikroprozessorsysteme und Schaltungsanordnung mit einer derartigen Einrichtung | |
EP1952238B1 (de) | Busmodul zum anschluss an ein bussystem sowie verwendung eines solchen busmoduls in einem as-i-bussystem | |
WO2000079352A2 (de) | Sicherheitsbezogenes automatisierungsbussystem | |
EP2422244B1 (de) | Sicherheitssteuerung und verfahren zum steuern einer automatisierten anlage | |
DE102017109886A1 (de) | Steuerungssystem zum Steuern von sicherheitskritischen und nichtsicherheitskritischen Prozessen mit Master-Slave-Funktionalität | |
EP1043641A2 (de) | Fehlersicheres Automatisierungssystem mit Standard-CPU und Verfahren für ein fehlersicheres Automatisierungssystem | |
DE102006012042A1 (de) | Steuervorrichtung zur fehlersicheren Steuerung einer Maschine | |
WO2017080793A2 (de) | Verfahren zum betrieb eines mehrkernprozessors | |
EP2520989B1 (de) | Verfahren zum Betrieb eines hochverfügbaren Systems mit funktionaler Sicherheit sowie ein hochverfügbares System mit funktionaler Sicherheit | |
EP0547259B1 (de) | Schaltungsanordnung zum Sichern des Betriebes eines rechnergesteuerten Gerätes | |
DE3751374T2 (de) | Verfahren und Mechanismus zum unabhängigen Sicherstellungsmodustransfer für digitale Steuerprozessoren. | |
DE3938501A1 (de) | Verfahren zum betrieb eines mehrkanaligen failsafe-rechnersystems und einrichtung zur durchfuehrung des verfahrens | |
EP4038844A1 (de) | Ein/ausgabe-station für ein feldbussystem, feldbus-koppler für die ein/ausgabe-station, sowie platzhaltermodul für die ein/ausgabe-station | |
DE1966991A1 (de) | Ausfallgesicherte datenverarbeitungsanlage | |
WO2008128710A1 (de) | Steuervorrichtung für fahrzeuge | |
DE102006020793A1 (de) | Schaltungsanordnung und Verfahren zum Betrieb einer Schaltungsanordnung | |
EP1176508B1 (de) | Anordnung zur Überwachung des ordnungsgemässen Betriebes von die selben oder einander entsprechende Aktionen ausführenden Komponenten eines elektrischen Systems | |
WO2002099643A2 (de) | Verfahren und vorrichtung zur kommunikation in einem fehlertoleranten verteilten computersystem | |
WO2004036324A1 (de) | Verfahren und vorrichtung zur prozessautomatisierung mit redundanten steuergeräten zur ansteuerung von peripheriegeräten über ein bussystem | |
EP0548382A1 (de) | Verfahren und Anordnung zum Bewerkstelligen von Baugruppenaustauschaktionen im laufenden Betrieb eines Bussystems | |
EP0902369A2 (de) | Verfahren zur Isolation eines defekten Rechners in einem fehlertoleranten Mehrrechnersystem |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): CA CN JP MX SG US |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): AT BE CH DE DK ES FR GB GR IE IT LU MC NL PT SE |
|
DFPE | Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101) | ||
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 1996900881 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 08894859 Country of ref document: US |
|
ENP | Entry into the national phase |
Ref country code: JP Ref document number: 1996 523887 Kind code of ref document: A Format of ref document f/p: F |
|
WWP | Wipo information: published in national office |
Ref document number: 1996900881 Country of ref document: EP |
|
WWG | Wipo information: grant in national office |
Ref document number: 1996900881 Country of ref document: EP |