Abstract: A safety module (5) with terminals for connection to a bus system control module (2), which is provided for connecting input/output modules (4a, 4b) for field devices, via a databus (3), has a data processing unit (?C2), which is set up corresponding to the bus system control unit (2) for identical processing of the data transmitted via the databus (3). The data processing unit (?C2) for ensuring correct data communication with a safety function is set up in such a way that mutual checking of the safety function takes place by means of data exchange via the databus with the bus system control unit (2).

Abstract: A safety module (5) with terminals for connection to a bus system control module (2), which is provided for connecting input/output modules (4a, 4b) for field devices, via a databus (3), has a data processing unit (?C2), which is set up corresponding to the bus system control unit (2) for identical processing of the data transmitted via the databus (3). The data processing unit (?C2) for ensuring correct data communication with a safety function is set up in such a way that mutual checking of the safety function takes place by means of data exchange via the databus with the bus system control unit (2).

Abstract: A microprocessor system for a machine controller used in safety-critical applications includes a main processor, a program and/or data store, an input/output unit and a bus. The bus couples the components and at least one safety processor together. The safety processor has a dedicated program/data store. A safe transmission link is provided for loading programs and data into the safety processor. The transmission link includes the general bus and a mailbox (87) which has a state machine whose input is connected to the general bus and whose output is connected to the safety processor. As a result, program data can be written to the safety processor's program store without the risk of being manipulated. This makes it possible for the program data to be loaded into the safety processor safely using the bus which is not safe per se. The bus thus does not need to belong to the safe area. Certification of the microprocessor controller is thus simplified.