Abstract: An ultrasonic transducer for an ultrasonic flowmeter includes: a transducer housing with an ultrasound window; a transducer element in the transducer housing that transmits ultrasonic signals onto a signal path and receives ultrasonic signals from the signal path; a control and evaluation unit that controls the transducer element and evaluates the ultrasonic signals; and a buffer element that forms at least one at least partially reflective boundary layer in the signal path. In an operating state, the transducer element transmits an ultrasonic signal that is at least partially reflected at the boundary layer of the buffer element, and the reflected signal component is received by the transducer element. The control and evaluation unit monitors the reception of the reflected signal component and, in the absence of reception of a reflected signal component, detects an error state of the ultrasonic transducer.

Abstract: An ultrasonic transducer for an ultrasonic flowmeter includes: a transducer housing with an ultrasound window; a transducer element in the transducer housing that transmits ultrasonic signals onto a signal path and receives ultrasonic signals from the signal path; a control and evaluation unit that controls the transducer element and evaluates the ultrasonic signals; and a buffer element that forms at least one at least partially reflective boundary layer in the signal path. In an operating state, the transducer element transmits an ultrasonic signal that is at least partially reflected at the boundary layer of the buffer element, and the reflected signal component is received by the transducer element. The control and evaluation unit monitors the reception of the reflected signal component and, in the absence of reception of a reflected signal component, detects an error state of the ultrasonic transducer.

Abstract: A method of ensuring a correct program sequence in a dual-Processor module that includes Processor A and Processor B. Processor A and Processor B are both coupled to a common memory. Processor A and Processor B each execute a first safety program and each generate an instruction stream therefrom. At one or more points in time while running the first safety program, Processor A reads its program counter value from a current instruction being executed and generates therefrom a current Processor A CRC value, and Processor B reading its program counter value from the same current instruction being executed generates therefrom a current Processor B CRC value. Processor A transfers its current CRC value to Processor B and/or Processor B transfers its current CRC value to Processor A, and these CRC values are compared. A safety action is triggered if the comparing determines non-matching current CRC values.

Abstract: A method of ensuring a correct program sequence in a dual-Processor module that includes Processor A and Processor B. Processor A and Processor B are both coupled to a common memory. Processor A and Processor B each execute a first safety program and each generate an instruction stream therefrom. At one or more points in time while running the first safety program, Processor A reads its program counter value from a current instruction being executed and generates therefrom a current Processor A CRC value, and Processor B reading its program counter value from the same current instruction being executed generates therefrom a current Processor B CRC value. Processor A transfers its current CRC value to Processor B and/or Processor B transfers its current CRC value to Processor A, and these CRC values are compared. A safety action is triggered if the comparing determines non-matching current CRC values.

Abstract: A safety controller includes an interface circuit coupled to IO devices coupled to field devices coupled to processing equipment, a primary controller including a primary processor and a secondary controller including a secondary processor each for implementing control loops that automatically take actions by sending control signals to the actuators, and a bus coupling the interface circuit and a mode-switching multi-key switch. The multi-key switch includes a force (FRC) enable key-switch having a FRC enable On position for entering a maintenance override mode and an OFF position, and a FRC reset key-switch having a FRC reset position for removal of maintenance overrides. Following entry of a first maintenance override and the FRC enable key-switch is then returned to the OFF position, there are no changes to the first maintenance override while new maintenance overrides cannot be added until the FRC enable key-switch is set to the FRC On position again.

Abstract: A fault-tolerant industrial control system includes a redundant controller including a first process controller (CP1) including a first processor with a first associated memory, and a parallel connected second redundant process controller (CP2) including a second processor with a second associated memory. A redundancy link is between CP1 and CP2 for sharing data. CP1 and CP2 include logic gates exclusive of any conditional branching for performing data synchronization and calculations including a different logical arrangement for providing each of a digital output (DO), a digital input (DI), an analog input (AI), and an analog output (AO). At least one input/output (IO) module includes a first IO processor including a first memory coupled by a first leg to CP1 and by a second leg to CP2. The IO module is coupled to field devices that are coupled to processing equipment.