Abstract: A safety controller with redundant controllers, each executing safety tasks and comparing their results, provides an improved interface in which a user interacts with a single processor and the second processor is invisible. The interacting processor provides for the transmission of programs and variables to both processors when they are safety tasks and coordinates synchronization of the two programs and comparison of their operation all without additional user input.

Abstract: A safety controller executes a control program in two processing units to detect processor failure by comparison of the execution in each unit. This comparison is made rapid by synchronizing the input variables at the beginning of the task and comparing output variables at a conclusion of the task, avoiding line-by-line comparison of input and output variables. Intermediate variables, that are neither input nor output values, are compared at a less frequent interval.

Abstract: A moderator on a communication network periodically transmits a set of parameters for a protocol that is used to communicate over the network. Each node on the network compares the set of protocol parameters from the moderator to a set of parameters stored in that node. If the sets of parameters at a given node do not match, that given node ceases transmitting messages over the network until either the set of protocol parameters from the moderator match the stored set of parameters, or a matching set of parameters is stored in the node. Typically the active node that is assigned the lowest numerical network address functions as the moderator. However, an automatic process is utilized to prevent a node with a non-matching set of the protocol parameters from becoming the moderator for more than a brief period of time. An override procedure is provided to force all the nodes on the network to adopt a common set of protocol parameters in the event that the automatic process fails.