Abstract: A method for implementing program execution integrity (PEI) for a communication-based sensor includes receiving an output communication message from the sensor, the output communication message including sensor output data internally processed within the sensor. The output communication message further includes raw data used by the sensor in internally processing the sensor output data. The raw data is independently processed, and the results thereof are compared with the internally processed sensor output data so as to verify the processing integrity of the sensor to a desired tolerance.

Abstract: A power management system for a plurality of rechargeable vehicles comprising an administrator interface for transmitting messages to a rechargeable station network using a processor in communication with data storage; a dynamic information database comprising a classification for at least one user, a rechargeable station identification, a user contact device information, discretionary power consumption information, and at least one dispatchable or non-dispatchable power source; and computer instructions in the data storage for instructing the processor to provide at least one message to the rechargeable station network. An administrator initiates distribution of the at least one message, which is transmitted through at least one industry standard protocol, and the administrator manages distribution and usage of the dispatchable power and non-dispatchable power to the rechargeable station network.

Abstract: Network appliances for use in combination with a network based full service, multi-media surveillance system provide a wide range of monitoring techniques utilizing digital network architecture. The appliances may be connected to the surveillance system for transmitting event data, video and/or image monitoring information, audio signals and other data over significant distances using digital data transmission over networks such as a local area network (LAN), a wireless LAN (WLAN), a wide area network such as the Internet for other networks, permitting remote manual and/or automatic assessment and response. The wireless LAN connectivity permits local distribution of audio, video and image data with relatively high bandwidth without requirement of a license and without relying on a common carrier and the fees associated therewith.

Abstract: A method of comparing output information from dissimilar processors includes storing a task in a first memory and storing the task in a second memory at substantially the same time as the first memory. The time of the storing being is controlled by a first arbitration logic and a second arbitration logic. The method also includes receiving the task by a first processor from the first memory and receiving the task by a second processor from the memory at substantially the same time as the first processor. The time being received is controlled by a first arbitration logic and a second arbitration logic. The second processor being dissimilar to the first processor. The method further includes computing a first output by the first processor based on the task and computing a second output by the second processor based on the task. The method still further includes, synchronizing the first and second outputs so that the first and second outputs are output at substantially the same time.

Abstract: A detection system in which a single sensor (14) is employed to detect two, or more, levels, or ranges, of a parameter. The output signal from the sensor (14) is fed to a detection circuit (12) for amplification and thence to a control circuit (24). The control circuit (24) is switchable, either manually, or preferably programmably, for example by a timer, between two or more modes of operation for processing the output signal from the sensor (14) in a different manner, for example using different algorithms, according to the condition that is to be detected. The switching of the control circuit (24) between its modes results in a signal being sent to the detection circuit (12) to change its sensitivity to the signal received from the sensor (14), thereby to maintain accuracy of measurement of the parameter in both or all modes of operation.

Abstract: A method and system for assessing or otherwise determining defective operation of an electronic control unit (ECU). The ECU may be a vehicle or non-vehicle ECU having any number of modules configured to provide and/or support any number of operations. The defective ECU operations may be determined as a function of a voltage drop across a shunt included on the ECU.

Abstract: A communication system that provides communication of information between an end user device and a remote end user. The system includes a communication node mounted on the upper part of a utility pole, and drawing its power from the utility pole through a standard NEMA Locking 3 Pole Receptacle, and adapted to communicate with a nearby user device using the low-power communication protocol, such as the ZigBee protocol (ANSI IEEE 802.15.4) or Radio Frequency Identification Device (RFID) technology, and also adapted to communicate with a neighborhood mesh network of nodes mounted on utility poles. The neighborhood mesh network is capable of communicating, through a regional computer network, with the remote end user.

Abstract: A web-based geographic network status tool uses an animation process that sequentially displays web pages, one after the other. Each page reflects the status of the network for a different time block. The animation optionally includes two layers. One layer shows which elements (towers) are faulty and why (e.g., subject to power failure, undergoing software or hardware problems, transport problems). The other layer displays if the problem has been perpetuated for more than one time block.

Abstract: A monitoring system for detecting faults in an apparatus, such as a ski lift, employs a communication network onto which a sensor bus controller periodically transmits a safety message and receives a echo of each safety message. Different sensors are coupled to sensor adapter modules that in turn are connected in a series to the communication network. After the last sensor adapter module in the series, each safety message is echoed back along the communication network. Each sensor adapter module, upon receiving a safety message, increments a count in that message and transmits the resultant safety message to another module. When a sensor indicates a fault condition, the associated sensor adapter module blocks propagation of safety messages along the communication network. The sensor bus controller determines, in response to a failure to receive the echo and to the count in the echo, whether a fault occurred.

Abstract: An apparatus for monitoring an access portal through an enclosure around a hazard comprises a line-scan camera mounted above the portal so that its linear field of view extends along a generally opposite threshold of the portal and can detect electromagnetic radiation reflected from an object passing through the portal. The apparatus distinguishes signals from the camera corresponding to items that are intended to pass through the portal for example on a conveyor from signals corresponding to items, particularly intruders that are not intended to pass through the portal. The apparatus preferably comprise an elongate sodium discharge lamp mounted above the portal and provided with a reflector so that monochromatic light therefrom is concentrated in a narrow strip extending along the threshold and the camera is sensitive only to this monochromatic light.

Abstract: A security system can detect if a first network is compromised and automatically access a second network to communicate an alert to a monitor. The second network could be a wireless network of a neighbor. An incentive could be provided to the neighbor to allow the security system to access the neighbor's network and communicate an alert to at least one monitor. The monitor could include an emergency responder, a security monitoring service, and a cellular telephone of an entity of the security system.

Abstract: A sensor monitoring system is described that identifies inaccurate or degraded sensor data and corresponding sensors. The system analyzes a plurality of sensors to determine reliable sensors and isolate or reinterpret unreliable sensor data. An analysis component analyzes a traffic representation that varies as context varies and determines the probability that current sensor data is invalid. Learning and reasoning are performed from a case library of sensor failure data to build predictive models of sensor health that can provide inferences about the output of sensors. Resulting inferences about sensor reliability can be employed in base-level inferences and predictions about traffic flow.

Abstract: A security system comprises a system control panel for arming and disarming the security system. A door sensing unit comprises a first radio frequency (RF) transceiver interconnected with the system control panel over a network. The first RF transceiver is mounted proximate to a door that defines at least a portion of a perimeter around an area to be monitored by the security system. The first RF transceiver has an RF detection field proximate to the door. A disarm device comprises a second RF transceiver that automatically transmits a disarm device packet. The first RF transceiver receives the disarm device packet when the second RF transceiver is within the RF detection field. The first RF transceiver sends a disarm message to the system control panel over the network to disarm the security system based on at least the disarm device packet.

Abstract: A system and method for electrophysiological monitoring system including a plurality of sensors configured to detect one or more health parameters of a patient and a monitoring device configured to receive a plurality of sensing signals from the sensors and output a monitoring signal representative of an alarm sequence, wherein the alarm sequence comprises a set of alarm events identified in the sensing signals. The system also includes an on-line monitoring module configured to generate a suffix tree data structure in response to the monitoring signal to identify alarm patterns from the set of alarm events and classify the alarm sequence in response to the occurrences of alarm patterns in the alarm sequence. The on-line monitoring module is further configured to alert monitoring personnel of an alarm condition after processing the alarm sequence in real-time.

Abstract: A method for monitoring an alarm zone within a perimeter, border and/or building includes capturing video image data of an alarm event detected in the alarm zone, and automatically establishing a cell phone session with an end-user to verify a true or false nature of the detected alarm. The end-user may use the cell phone display to review the video during the cell phone session, and may use the cell phone's key for the verifying. The novel monitoring method with end-user alarm event verification avoids false alarms being raised where the nature of the detected alarm event is false, and the verifying occurs before a false alarm is raised/communicated.

Abstract: An optical transponder, system, method, and program wherein the transponder monitors for at least one of a failure or an alarm signal. In response to detecting a failure or alarm signal (communication), the transponder performs at least one of a predetermined action and propagating an alarm communication to a network, based on a configuration property. The transponder can have a configuration property specifying a predetermined action for shutting off a laser if an alarm signal indicating a network failure is detected. As an example, some transponders can be configured to either provide an alarm communication, and/or shut off a laser, depending upon which communication interface detects a network failure or receives an alarm signal. Also, other transponders can be configured to propagate existing alarm communications, without generating new alarm communications or shutting off lasers.

Abstract: The present invention relates to sending control or monitoring information between two hardware devices utilizing email. Control information relating to either a first hardware device or a second hardware device is determined. This information is incorporated into an email message. Directing information for directing the control information is incorporated into the email message. Two hardware devices can then operate cooperatively over different remote networks. These networks only need to be compatible in the ability to exchange email for communication to persist between the two hardware devices. The control information and/or the directing information can encrypt. The control information and/or the directing information can be encoded. In embodiments of the present invention the encoding map is encrypted.

Abstract: An apparatus and method are provided for a security device for residential and/or commercial buildings. A motion detector is installed on a fixture such as a wall or ceiling. A wireless remote is used after installation of the motion detector to set the motion detector to a walk test mode, eliminating the need for the installer to open up the motion detector to switch it to a walk test mode. After walk testing the motion detector, the wireless remote is used to set the motion detector back to a normal mode, eliminating the need for the installer to open up the motion detector and avoiding the problem of the installer forgetting to switch it back to a normal mode. The motion detector can also switch back to a normal mode after a predetermined amount of time by use of a timer.

Abstract: A fault-tolerant timeout protocol for distributed sensor arrays and networks in which each sensor has a plurality of backup nodes, each of which is operable to send priority information which includes the product of the time needed for the backup node to transmit sensor information to a base station and the number of tasks offered to the backup node. In another embodiment, the base station stores the two values and calculates their product. In both cases, the lowest resulting value is used by the base station to select the backup node, which then sends backup sensor information. Another aspect of the present invention is a fault-tolerant sensor integration algorithm. The algorithm creates an abstract sensor defined as an interval having values above and below the reading of an associated physical sensor, and finds a range of values common to more than half of the abstract sensors.

Abstract: Provided is a method for designing, managing and executing response plans. Specific plan and resources are defined and a defined plan is executed either automatically or manually according to pre-determined or “real-time” parameter definitions. An executed plan notifies, by various user-defined means, actively or pre-defined parties in a near simultaneous fashion of security communications, notifications, directives and/or information. One embodiment of the system includes a component that requires a notified party to acknowledge a particular notification event by responding with a personal identification number (PIN) or calling a specified telephone number and entering the PIN. The system enables parties to be organized into groups based upon member profiles. Individual parties can be assigned to sub-groups, enabling specifically designed communications to go to the parties of any particular sub-group.

Abstract: A system and method is provided for indicating a masking event using transmission wiring delegated for indicating intrusion and tampering events. The method of indicating a masking event utilizes measurable changes in resistance to indicate the current masking state of a detector. When a detector is not masked, a first resistance value is measurable on the transmission wiring, while when a detector is masked, a second resistance value is measurable on the transmission wiring. The transmission wiring connects the detector to a control unit that executes a security-related response based on the value of the measured resistance.

Abstract: The invention relates to a seismic warning system comprising of two or more sensors for detecting shock signals and electronic signal processing elements for processing and analyzing said signals. According to the invention, the system has at least two detection units, each comprising a shock sensor and electronic signal processing elements. The signal processing elements of each detection unit are configured in such a way that they detect the primary waves of earthquakes using the signals of the shock sensors. The detection units are interconnected via an electronic data bus.

Abstract: The present invention is an access control door controller which utilizes three relays, 16 alarm inputs, tamper switch, a Weigand reader, a RS 232 reader and a IP core module to enable access control alarm monitoring, inter locking of doors and/or energy management for a room with the help of a software. The present invention utilizes a distributed communication (peer to peer) thus creating a door access controller System network with a truly distributed intelligence permitting exchange of information between all controllers which may be situated in a single site or over multiple sites connected on a common network. The full system can be configured on the widely used TCP/IP network thus avoiding the need for extensive wiring traditionally required for Access Control System. The controller, with its associated software can support multiple types of readers and can directly interface IP cameras for an integrated TCP/IP based Access Control/CCTV Solution.

Abstract: In a remote monitoring system, a supervision terminal (37) monitors the status of the communication link (32, 34, 36) between the supervision terminal and each of a plurality of remote terminals (33) connected to the supervision terminal via a data network (35). The remote terminals may be used to emulate a line interface for monitor devices such as fire alarms (31), while providing continual assurance of the integrity of the link between the supervision terminal and the alarm.

Abstract: A system enables safe and prompt communication in case of accident or fire. Detecting an emergency event, detection device 10 transmits emergency event information to each floor device 30 and to monitoring center device 40. Upon receipt of emergency event information, each of floor devices 30 and monitoring center device 40 display at least emergency event information and a point(s) of emergency contact. Each of floor devices 30 and monitoring center device 40 display image information taken by camera 20 related to the detection device which has detected the emergency event. Each of floor devices 30 and monitoring center device 40 may have call with the point(s) of emergency contact when the point(s) of emergency contact displayed is touched. In the call with the point(s) of emergency contact, each of the floor devices 30 and the monitoring center device 40 transmit the image information displayed to the point(s) of emergency contact.

Abstract: The system for detecting a failure on a communication network according to an objective basis by analyzing an alarm log output by a management server of the communication network and evaluating a degree of abnormality of the communication network tracing back to a more significant factor causing the alarm, calculates an occurrence intensity of the more significant factor 500 causing an alarm based on the recording contents of the alarm, and detects a failure derived from the more significant factor of the communication network based on the calculated intensity of occurrence of said more significant factor 500.

Abstract: A sensor system that provides an adjustable threshold level for the sensed quantity is described. The adjustable threshold allows the sensor to adjust to ambient conditions, aging of components, and other operational variations while still providing a relatively sensitive detection capability for hazardous conditions. The adjustable threshold sensor can operate for extended periods without maintenance or recalibration. A portable monitoring unit working in communication with the sensor system provides immediate communication of conditions detected by the sensors. The portable monitoring unit allows building or complex management to be in communication with a sensor system at all times without requiring someone to be physically present at a monitoring site. The portable monitoring unit can be equipped with an auditory device for alerting management or a screen for displaying pertinent information regarding an occurring situation so that management can quickly identify and resolve the problem.

Abstract: A device, for controlling a vehicle-occupant restraining device in a vehicle having a trailer, includes an arrangement for controlling the vehicle-occupant restraining device as a function of at least one signal of the trailer.

Abstract: A vehicle customizing system is highly reliable in the event of communication failures. For setting control characteristic values pertaining to functions of control units to control characteristic values favored by the user, the functions and the present control characteristic values set for the functions are displayed on a display unit. The control characteristic values, which are changed using the display unit, are stored in first function information tables of the control units, which directly perform the functions. Even in the event of a communication failure, the control units are capable, on their own, of controlled objects in order to perform the functions thereof based on the control characteristic values stored in the first function information tables.

Abstract: A vehicle control module for controlling an actuator unit in response to an input having a first processor, a first communication link coupled to the first processor, and a second processor coupled to the first processor via the first communication link. The first processor is configured to generate a first value based on the input, transmit the first value to the actuator unit, and receive a second value from the actuator unit based on a data received by the actuator unit from the first processor. The first communication link is configured to transfer the input and the second value to the second processor. The second processor is configured to determine a third value based on the input, and verify the first value based on a comparison of the second value with the third value.

Abstract: In a particular embodiment, the disclosure is directed to a system including a data management system configured to receive sensor data associated with a sensor, a monitoring system coupled to the data management system, and an alert handling system responsive to the data management system and configured to access an alert profile associated with an error object provided by the monitoring system. The monitoring system is configured to provide the error object in response to a monitoring algorithm associated with the sensor data received by the data management system.

Abstract: Systems and methods for detecting power outages in communication networks are described. In one implementation, an alarm associated with a network error is detected. Attempts are made to contact the network equipment originating the alarm. The alarm is linked to an error that is identified as either a power outage or another type of error depending on the results of the attempts to contact the network equipment originating the alarm.

Abstract: One embodiment of the present invention provides a system that performs a real-time root-cause-analysis for a degradation event associated with a component under test. During operation, the system monitors a telemetry signal collected from the component, and while doing so, attempts to detect an anomaly in the telemetry signal. If an anomaly is detected in the telemetry signal, the system performs a failure analysis on the telemetry signal in real-time while the telemetry signal is degrading. Next, the system identifies a failure mechanism for the component based on the failure analysis.

Abstract: A network communication device is provided, comprising a control processor for controlling operation of the device, a reset module which is controllable independently of the control processor for performing a reset operation of the device, and a reset control interface for receiving a reset signal, the reset module being responsive to the reset signal for performing the reset operation. A monitor is provided for monitoring the status of the control processor and an interface is adapted to transmit information relating to the monitored status from the device. A second, inactive device is provided to protect the communication device in the event of a control fault which renders the communication device unreachable. The protection device includes a reset interface for transmitting a reset signal to the reset module to enable the communication device to release activity.

Abstract: A method and apparatus for suppressing a duplicated alarm in a communications network are described. In one embodiment, at least one alarm message associated with at least one event is received. A determination of whether the at least one event exists in a database is subsequently made. The at least one event is recorded in the database if the at least one event does not exist in the database. Conversely, the at least one alarm message is suppressed if the at least one event exists in the database.

Abstract: A method for reducing false alarms for a security system when the security system is programmed to automatically arm the security system. The method reduces false alarms by preventing the security system to auto-arm the system in away mode based upon certain detected events within the premises. The method comprise the steps of determining if a current time equals or is within a predetermined detection period, judging whether at least one of a plurality of motion sensors have detected an event within a protected area during the predetermined detection period, determining if a premises exit signal has been generated within a predetermined period from said detected movement, generating an automatic arm adjustment signal based upon said detected event and the premises edit signal; and executing a modification to the programmed automatic arm based upon the automatic arm adjustment signal. The method will also notify the owner that the auto-arm mode failed.

Abstract: A method of operating a safety system for an industrial press having a moveable section and a stationary section, the safety system providing a plurality of continuous planar laser beams having a generally constant lateral width, each laser beam being spaced at varying distances from the moveable section, the method including moving the moveable section towards the stationary section at a relatively high speed; starting deceleration of the moveable section when one said laser beam reaches a speed control point located immediately adjacent the stationary section, moving the moveable section at a final crawl speed when a second said laser beam reaches the speed control point, the moveable section continuing to move at said final crawl speed towards said stationary section.

Abstract: A first gas sensing element is provided in a first position to measure a concentration of a gas continuously, and a second sensing element is provided in a second position to measure the concentration of the gas intermittently. The second position is in close proximity to the first position. A deterioration determination unit is connected with the first and second sensing elements to make a determination as to whether the first sensing element becomes deteriorated, by comparing output values from the first and second sensing elements. A power controller is configured to supply the second sensing element with electric power throughout waiting periods during which the second sensing element stops measuring the concentration of the gas, and an amount of the electric power supplied throughout waiting periods is smaller than that supplied throughout operating periods during which the second sensing element continuously measures the concentration of the gas.

Abstract: A safety shut-off system controls power supply to an appliance to prevent accidental fires and the like. The shut-off system includes a shut-off switch for connection in series with the power supply of the appliance. A controller opens the switch in response to detection by the detector of a prescribed fire condition. Failsafe means are provided on the controller for opening the shut-off switch in response to a malfunction of the detector to, ensure that the appliance is only permitted to operator under safe conditions when the detector is properly operating. In order to avoid false alarms the detector may take various forms including the detection of sound or other conditions which may be indicative of a potential fire. There are also incorporated switching capabilities to control additional a/c outlets, gas, propane and other appliances which work in unison with this system.

Abstract: A monitoring system for use in a building, such as a hospital provides an audible and/or visual alarm. The monitoring system includes a control unit, with a plurality of medical condition monitoring units, such as ventilators, connected thereto. A plurality of speakers and/or light sources are connected to the control unit, and are located at various different spaced-apart areas within the building. An abnormal condition, sensed at one of the plurality of medical condition monitoring units, is reported to the control unit, which in turn causes the plurality of speakers and/or light sources to issue an audible/visual alarm. An adaptor can connect a medical condition monitoring unit to the control unit. The adapter may include circuitry to render an alarm output of the medical condition monitoring unit compatible with the control unit, and to suppress an alarm output for a predetermined period of time.

Abstract: A digital verification control, which is incorporated with an alarm system, includes a first timer device for presetting a single zone verification time in the control panel and second timer device for presetting a multiple zone verification time in the control panel. The single zone verification time is a single detector time delay and arranged when one of the sensors detects at least two triggered signals in the respective detecting area within the single zone verification time, the local warning system is activated for producing a local warning signal. The multiple zone verification time, which is longer than the single zone verification time, is a multiple detector time delay and arranged when the two sensors detect two triggered signals in the detecting areas respectively within the multiple zone verification time, the local warning system is activated for producing the local warning signal.

Abstract: A system, method, and medium for deduplicating multiple status indications within a telecommunications network is provided. A first and second instance of a status indication is received, and a determination is made as to whether the second instance is a duplicate of the first. If it is, it is not permitted to proceed to alarm status. Multiple alarm occurrences are represented as a single display item rather than separate alarms if desired.

Abstract: A monitoring system having a plurality of receivers connected to at least one other receiver such that data can be transmitted from a primary receiver to a backup receiver if a data path to an automation computer or to its printer is down. The system programs a primary data path and at least one backup data path. The system detects an error in the primary data path and determines if a backup receiver's data path is operational. The system automatically transmits data received by a primary receiver to a pre-selected backup receiver based upon an error flag. This allows for each receiver to process calls even though its primary path to the automation system or printer is down or malfunctioning.

Abstract: A high speed, microcomputer based, Fibre Channel compatible and fault tolerant information processing and mass storage system especially suited for information servers and application servers. A unique and extremely versatile system architecture, including a dual loop arbitrated, Fibre Channel capable, multiple-fault tolerant, hot-swappable mass storage disk array, permits combinations of servers and mass storage arrays which can be tailored for a wide variety of applications and which can be configured with emphasis on the system characteristics such as redundancy, speed, processing capability, storage capability, and the like, as desired. A unique backplane and/or midplane arrangement for connecting the system components allows for easy and, in most cases, on-line field upgrading and/or service and at the same time provides for the very effective cooling of components, particularly those such as disk drives which tend to produce a lot of heat.

Abstract: In a remote monitoring system, a supervision terminal, 37, monitors the status of the communication link, 32, 34, 36, between the supervision terminal and each of a plurality of remote terminals, 33, connected to the supervision terminal via a data network, 35. The remote terminals may be used to emulate a line interface for monitor devices such as fire alarms, 31, while providing continual assurance of the integrity of the link between the supervision terminal and the alarm.

Abstract: A security device includes a plurality of security detectors intercommunicating with each other. Each of the security detectors includes a first device for verifying a single zone verification time of the respective security detector and a second device for verifying a multiple zone verification time with another security detector corresponding to a distance between two security detectors at two different detecting areas. When one of the security detectors detects at least two triggered signals in the respective detecting area within the single zone verification time, the respective security detector activates the local warning system to produce a local warning signal. When two security detectors are intercommunicated with each other to detect two triggered signals in the detecting areas respectively within the multiple zone verification time, at least one of the security detectors activates the local warning system to produce the local warning signal.

Abstract: A switch is disclosed having first and second switch elements each configured to provide power to a sensor when in one state and configured to switch to a second state and provide positional information, for example. The sensor configured to effect the first and second switches to switch to the second state and to switch back to the one state, the first and second switch elements configured to switch alternately and in a complementary way.

Abstract: A docking adapter capable of cooling a memory storage device such as a hard disk drive includes a carrier and a rack. The carrier has a face with a vent, a backplane, a first lateral side and second lateral side extending perpendicularly from the face to the backplane. At least one lateral side of the carrier has a periphery defining an opening. The rack has a first lateral rail and a second lateral rail configured for receiving the carrier. The carrier includes a fan mounted on the lateral rail of the rack to blow air through the opening of the carrier. In an alternate embodiment of the invention, the fan is mounted on the carrier and the rack has a lateral opening. In each case, air is vented directly from the carrier to cool the hard disk drive.

Abstract: A capacitance presence sensing apparatus (10) having a fail-safe circuit (13) and modular units (100). The fail-safe circuit (13) includes delivering a low voltage (FIG. 5) to a sensor and connecting voltage through a resistor to an oscillator (18). An opener ground in the circuit changes frequency of the oscillator (18) to indicate a problem With the fail-safe circuit (13). The apparatus also contains a number of inductance coils (28) which may be selected to tune the frequency of the system. Circuitry is provided in cards which may be combined together with receiver transmitter cards (106) and to easily facilitate the use of the system for desired applications.

Abstract: The invention relates to a method for controlling a safety-critical system, in particular of a motor vehicle, which includes a microcontroller. The microcontroller controls and/or regulates the operating sequences of the safety-critical system, and the microcontroller is composed of a microprocessor and at least one peripheral microprocessor device. In a method for controlling a safety-critical system in which disruption to the operational reliability is to be prevented by changes in the molecular movement of the carrier of the microprocessor, the chip temperature of a chip which is provided with the microprocessor and peripheral device together is measured during an operating sequence and/or program sequence and compared with a maximum permitted chip temperature of the microcontroller. The operating sequence and/or the program sequence is controlled as a function of the temperature comparison.