Abstract: A hardware architecture for controlling a safety-relevant process having at least two microcontrollers for controlling the process in at least two control branches, wherein the respective microcontroller control the safety-relevant process. The microcontrollers process the data from at least one sensor, which detects the actual characteristic of the respective control branch. Between the two microcontrollers, the data of the respective sensor are exchanged and provided for each microcontroller and a check is made to determine whether the data from the sensors are consistent. In response to an inconsistency being detected, a majority decision is made and a model value used in forming the majority decision, is calculated in the microcontroller based on control commands so the control of the safety-relevant process by the microcontroller of the control branch, whose data were detected as erroneous in the majority decision, is disabled.

Abstract: A hardware architecture for controlling a safety-relevant process having at least two microcontrollers for controlling the process in at least two control branches, wherein the respective microcontroller control the safety-relevant process. The microcontrollers process the data from at least one sensor, which detects the actual characteristic of the respective control branch. Between the two microcontrollers, the data of the respective sensor are exchanged and provided for each microcontroller and a check is made to determine whether the data from the sensors are consistent. In response to an inconsistency being detected, a majority decision is made and a model value used in forming the majority decision, is calculated in the microcontroller based on control commands so the control of the safety-relevant process by the microcontroller of the control branch, whose data were detected as erroneous in the majority decision, is disabled.