Abstract: An industrial control system includes a first and a second safety program executing in tandem on a first and a second safety controller, respectively. A first and a second fault condition is detected with the first or the second safety program, respectively. A third fault condition is detected by either the first or second safety programs. Monitoring for the third fault condition by the first or second safety programs is disabled upon detecting the first or second fault condition, respectively. A safe operating state is entered when either the first or second safety program detects the third fault condition. The industrial control system operates at a first safety level while both the first and second safety programs monitor the industrial control system for the third fault condition and at a second safety level, lower than first safety level, when either the first or second fault condition is detected.

Abstract: A circuit may include one or more first ports that may receive one or more input signals from a first device, such that the one or more first ports may couple to a control system. The control system may generate one or more output signals based on the one or more input signals. The circuit may also include one or more second ports that may couple to a second device, such that the one or more second ports may couple to the one or more first ports via a direct connection. The control system may also couple the one or more output signals to the one or more second ports.

Abstract: A circuit may include one or more first ports that may receive one or more input signals from a first device, such that the one or more first ports may couple to a control system. The control system may generate one or more output signals based on the one or more input signals. The circuit may also include one or more second ports that may couple to a second device, such that the one or more second ports may couple to the one or more first ports via a direct connection. The control system may also couple the one or more output signals to the one or more second ports.

Abstract: A safety controller with redundant controllers, each executing safety tasks and comparing their results, provides an improved interface in which a user interacts with a single processor and the second processor is invisible. The interacting processor provides for the transmission of programs and variables to both processors when they are safety tasks and coordinates synchronization of the two programs and comparison of their operation all without additional user input.

Abstract: Re-certification of a control program loaded in a safety controller is avoided through the use of a digital snapshot and digital signature, the snapshot providing a rapidly loadable memory image file and the signature providing a confirmation that the file loaded matches a previously certified copy so as to avoid the need for time consuming re-certification.

Abstract: A safety controller provides for reliable mixed execution of standard and safety control programs held in a common memory by providing a hardware lock that is locked at times when the safety program is not executing to minimize potential corruption of the safety program by the standard program.

Abstract: A safety controller executes a control program in two processing units to detect processor failure by comparison of the execution in each unit. This comparison is made rapid by synchronizing the input variables at the beginning of the task and comparing output variables at a conclusion of the task, avoiding line-by-line comparison of input and output variables. Intermediate variables, that are neither input nor output values, are compared at a less frequent interval.