Abstract: A network having a plurality of subscribers has at least one message transmitter and at least one message receiver. The at least one message transmitter sends messages at predefined time intervals. The message receiver receives the messages at the predefined time intervals. A delay time of the messages is monitored on the basis of time outs. In addition, at least one of the subscribers repeatedly estimates a current delay time using a time measurement between sending out a request message and receiving a response message. The estimated delay time is compared with a predefined threshold value. If the estimated delay time exceeds the defined threshold value, an error signal is generated.

Abstract: The invention relates to a safety controller and to a method for loading a new operating program onto such a safety controller. The safety controller has an input module for automatically reading process signals, a failsafe signal processing module for automatically processing the process signals, and a failsafe output module which produces control signals as a function of the signal processing module. The signal processing module comprises at least one programmable processor and at least one read only memory. A current operating program for the processor is stored in a non-volatile form in the read only memory. A download device for transferring a new operating program is provided in the safety controller, with the download device enabling or inhibiting the transfer of a new operating program in a failsafe manner as a function of enabling information.

Abstract: In a method for transmitting data in a control system, a first station generates a data frame having a plurality of data fields. At least one data field to be filled with transmission data is clearly assigned to each further station. The data frame is transmitted as an outgoing data frame from one station to the next, with every further station filling the respectively assigned data field with transmission data. The last station returns the data frame as a returning data frame to the series of stations. The stations read extraneous transmission data from the data fields in the returning data frame. Preferably, the respective data fields are individually assigned to the stations.

Abstract: A network having a plurality of subscribers has at least one message transmitter and at least one message receiver. The at least one message transmitter sends messages at predefined time intervals. The message receiver receives the messages at the predefined time intervals. A delay time of the messages is monitored on the basis of time outs. In addition, at least one of the subscribers repeatedly estimates a current delay time using a time measurement between sending out a request message and receiving a response message. The estimated delay time is compared with a predefined threshold value. If the estimated delay time exceeds the defined threshold value, an error signal is generated.

Abstract: The invention relates to a safety controller and to a method for loading a new operating program onto such a safety controller. The safety controller has an input module for automatically reading process signals, a failsafe signal processing module for automatically processing the process signals, and a failsafe output module which produces control signals as a function of the signal processing module. The signal processing module comprises at least one programmable processor and at least one read only memory. A current operating program for the processor is stored in a non-volatile form in the read only memory. A download device for transferring a new operating program is provided in the safety controller, with the download device enabling or inhibiting the transfer of a new operating program in a failsafe manner as a function of enabling information.

Abstract: In a method for transmitting data in a control system, a first station generates a data frame having a plurality of data fields. At least one data field to be filled with transmission data is clearly assigned to each further station. The data frame is transmitted as an outgoing data frame from one station to the next, with every further station filling the respectively assigned data field with transmission data. The last station returns the data frame as a returning data frame to the series of stations. The stations read extraneous transmission data from the data fields in the returning data frame. Preferably, the respective data fields are individually assigned to the stations.

Abstract: The invention relates to a safety controller and to a method for loading a new operating program onto such a safety controller. The safety controller has an input module for automatically reading process signals, a failsafe signal processing module for automatically processing the process signals, and a failsafe output module which produces control signals as a function of the signal processing module. The signal processing module comprises at least one programmable processor and at least one read only memory. A current operating program for the processor is stored in a non-volatile form in the read only memory. A download device for transferring a new operating program is provided in the safety controller, with the download device enabling or inhibiting the transfer of a new operating program in a failsafe manner as a function of enabling information.

Abstract: The invention relates to a method for adjusting the data transmission rate in a fieldbus system (10) which is suitable to control safety-critical processes and which comprises at least one subscriber (12, 14) connected to a fieldbus (20), wherein in a first phase the subscriber/subscribers log on at a unit (30/central unit) centrally connected to the fieldbus with a first low data transmission rate. In a second phase the central unit (30) sets the data transmission rate at the subscriber/subscribers (12, 14) to a predetermined higher second value. In a third phase the subscriber/subscribers (12, 14) log on again at the central unit with a higher data transmission rate; and the central unit (30) shuts down the fieldbus (20) if it detects a deviation of the number of subscribers (12, 14) logged on in the first and the third phase.

Abstract: The invention relates to a safety controller and to a method for loading a new operating program onto such a safety controller. The safety controller has an input module for automatically reading process signals, a failsafe signal processing module for automatically processing the process signals, and a failsafe output module which produces control signals as a function of the signal processing module. The signal processing module comprises at least one programmable processor and at least one read only memory. A current operating program for the processor is stored in a non-volatile form in the read only memory. A download device for transferring a new operating program is provided in the safety controller, with the download device enabling or inhibiting the transfer of a new operating program in a failsafe manner as a function of enabling information.

Abstract: The present invention describes a method of allocating a defined user address to a safe bus user when connecting it to a field bus of a safe control system. The method comprises the step of sending out a first registration message from the safe bus user to an administration unit connected to the field bus. The first registration message contains a predetermined universal address. The method further comprises the step of sending out an address allocation message from the administration unit to the safe bus user, wherein the address allocation message contains the defined user address. Finally, the method comprises the step of storing the defined user address in a memory of the safe bus user.

Abstract: The present invention relates to an apparatus for controlling safety-critical processes. The apparatus includes at least one safe control unit for controlling the safety-critical processes and at least two safe signal units which are connected via I/O channels to the safety-critical processes. The safe control unit and the safe signal units are connected to a common fieldbus. The safe signal units communicate with the safe control unit, but not with one another, when the apparatus is in the control mode. The safe signal units have an evaluator for evaluating a fault message which is broadcasted across the fieldbus, as well as a switching device which autonomously change the safety-critical process to a safe state when a fault message which is evaluated as being relevant occurs.

Abstract: The present invention describes a control system for controlling safety-critical processes. The control system has a first control unit for controlling a safety-critical process and at least one signal unit linked to the safety-critical process via I/O channels. It further comprises a field bus connecting said first control unit and said signal unit, and a bus master for controlling communication on said field bus. Said first control unit and said signal unit each comprise safety-directed arrangements for ensuring failsafe communication among each other. Said bus master is connected to said field bus separately from said first control unit and said signal unit.

Abstract: The present invention describes a control system for controlling safety-critical processes. The control system has a first control unit for controlling a safety-critical process and at least one signal unit linked to the safety-critical process via I/O channels. It further comprises a field bus connecting said first control unit and said signal unit, and a bus master for controlling communication on said field bus. Said first control unit and said signal unit each comprise safety-directed arrangements for ensuring failsafe communication among each other. Said bus master is connected to said field bus separately from said first control unit and said signal unit.

Abstract: The present invention relates to an apparatus for controlling safety-critical processes. The apparatus includes at least one safe control unit for controlling the safety-critical processes and at least two safe signal units which are connected via I/O channels to the safety-critical processes. The safe control unit and the safe signal units are connected to a common fieldbus. The safe signal units communicate with the safe control unit, but not with one another, when the apparatus is in the control mode. The safe signal units have an evaluator for evaluating a fault message which is broadcasted across the fieldbus, as well as a switching device which autonomously change the safety-critical process to a safe state when a fault message which is evaluated as being relevant occurs.

Abstract: The invention relates to a method for adjusting the data transmission rate in a fieldbus system (10) which is suitable to control safety-critical processes and which comprises at least one subscriber (12, 14) connected to a fieldbus (20), wherein in a first phase the subscriber/subscribers log on at a unit (30/central unit) centrally connected to the fieldbus with a first low data transmission rate. In a second phase the central unit (30) sets the data transmission rate at the subscriber/subscribers (12, 14) to a predetermined higher second value. In a third phase the subscriber/subscribers (12, 14) log on again at the central unit with a higher data transmission rate; and the central unit (30) shuts down the fieldbus (20) if it detects a deviation of the number of subscribers (12, 14) logged on in the first and the third phase.

Abstract: The present invention describes a method of allocating a defined user address to a safe bus user when connecting it to a field bus of a safe control system. The method comprises the step of sending out a first registration message from the safe bus user to an administration unit connected to the field bus. The first registration message contains a predetermined universal address. The method further comprises the step of sending out an address allocation message from the administration unit to the safe bus user, wherein the address allocation message contains the defined user address. Finally, the method comprises the step of storing the defined user address in a memory of the safe bus user.

Abstract: A system architecture uses at least two processors (2, 3), which jointly control a process and constantly compare their data with each other. A program complex which has been checked with respect to the possible errors, as well as a non-checked program complex, runs on one of the two processors (2). In order to rule out interference in the checked program complex by the non-checked one, the peripheral hardware (12) which interact with the checked program complex are provided with inhibit inputs (16), and the tested program complex, via the inhibit inputs (16), blocks the peripheral hardware (12) which are reserved for it before it gives up command to the non-checked program complex.