Abstract: A method for creating a user program for a safety controller designed to control an automated installation having a plurality of sensors and a plurality of actuators involves several programming steps. The user program comprises a first program portion, in which safety-related program variables are processed in failsafe fashion, and comprises at least one second program portion, in which non-safety-related program variables are processed, wherein failsafe processing is not necessary for the non-safety-related program variables within the second program portion.

Abstract: A method for creating a user program for a safety controller designed to control an automated installation having a plurality of sensors and a plurality of actuators involves several programming steps. The user program comprises a first program portion, in which safety-related program variables are processed in failsafe fashion, and comprises at least one second program portion, in which non-safety-related program variables are processed, wherein failsafe processing is not necessary for the non-safety-related program variables within the second program portion.

Abstract: The present invention describes a method for configuring a station connected to a field bus, wherein a logical address is allocated to said station. The method comprises the steps of: transmitting said logical address from an address-allocation unit to said station; transmitting a physical address from said address-allocation unit to said station, said physical address corresponding to an assumed physical position of said station relative to said field bus; verifying said physical address being transmitted to said station based on an actual physical position of said station relative to said field bus; and storing said transmitted logical address in a memory of said station depending on the verification of said physical address.

Abstract: The present invention describes a control system for controlling safety-critical processes. The control system has a first control unit for controlling a safety-critical process and at least one signal unit linked to the safety-critical process via I/O channels. It further comprises a field bus connecting said first control unit and said signal unit, and a bus master for controlling communication on said field bus. Said first control unit and said signal unit each comprise safety-directed arrangements for ensuring failsafe communication among each other. Said bus master is connected to said field bus separately from said first control unit and said signal unit.

Abstract: The present invention describes a method for configuring a station connected to a field bus, wherein a logical address is allocated to said station. The method comprises the steps of: transmitting said logical address from an address-allocation unit to said station; transmitting a physical address from said address-allocation unit to said station, said physical address corresponding to an assumed physical position of said station relative to said field bus; verifying said physical address being transmitted to said station based on an actual physical position of said station relative to said field bus; and storing said transmitted logical address in a memory of said station depending on the verification of said physical address.

Abstract: The present invention describes a control system for controlling safety-critical processes. The control system has a first control unit for controlling a safety-critical process and at least one signal unit linked to the safety-critical process via I/O channels. It further comprises a field bus connecting said first control unit and said signal unit, and a bus master for controlling communication on said field bus. Said first control unit and said signal unit each comprise safety-directed arrangements for ensuring failsafe communication among each other. Said bus master is connected to said field bus separately from said first control unit and said signal unit.

Abstract: In the case of a multichannel monitoring device for monitoring system operating states, a test input (45a, 45b) is provided per channel (2, 3) on an evaluation and monitoring circuit for the purpose of testing the supply leads (7a, 7b) to the signalling units (1a, 1b) for freedom from damage. Either no filters or filters (47a, 47b) with a short settling time are provided in the supply lead to this test input (45a, 45b). As a result, testing requires only a very short time, so that the evaluation of the signalling units (1a, 1b) is interrupted only for a very short time. The time is so short that no dangerous system states can occur.

Abstract: A system architecture uses at least two processors (2, 3), which jointly control a process and constantly compare their data with each other. A program complex which has been checked with respect to the possible errors, as well as a non-checked program complex, runs on one of the two processors (2). In order to rule out interference in the checked program complex by the non-checked one, the peripheral hardware (12) which interact with the checked program complex are provided with inhibit inputs (16), and the tested program complex, via the inhibit inputs (16), blocks the peripheral hardware (12) which are reserved for it before it gives up command to the non-checked program complex.