Patent ID: 11914338
Assignee: SIEMENS AKTIENGESELLSCHAFT
Field: Control (Instruments)
Classification: CPC G | IPC G

Claim 0:
1. A method for operating a redundant automation system for controlling a technical process, a first subsystem, a second subsystem, a third subsystem and an output device for the process being operated in a communications network such that communication paths between them are utilized to exchange data, the method comprising:
forwarding, by the first subsystem with a first control program with a first program cycle, first output data to the output device in a cycle-oriented manner via a peripheral protocol, an active first application relationship being established as an active first application state between the first subsystem and the output device;
calculating, in parallel to the first subsystem, by one of (i) the second subsystem with a second control program with a second program cycle output data and (ii) the third subsystem with a third control program with a third program cycle third output data in readiness for assuming control of the technical process; and
establishing a passive second application relationship as a second application state between the second subsystem and the output device and establishing a passive third application relationship as a third application state between the third subsystem and the output device;
wherein the first, second and third subsystems are operated such that the first, second and third subsystems have knowledge of one another via respective calculated output data;
wherein the second subsystem sends a second output acknowledgement, and the third subsystem sends a third output acknowledgement to the first subsystem;
wherein the first subsystem forwards the first output data to the output device only when the second output acknowledgement and third output acknowledgement have arrived in the first subsystem;
wherein in each subsystem of the first, second and third subsystems a comparator is cyclically operated, which compares the first, second and third output data with one another, and the comparator of each subsystem is operated so that no further action is performed for each comparison in which all output data are the same as a result;
wherein in a comparison in which deviations between the first, second, and third output data are established, that subsystem of one of the first, second and third subsystems is recognized as being faulty via a majority decision in which deviations of its own output data from other output data are greatest;
wherein in an event that the first subsystem has been identified as being faulty, the second application relationship is transferred from the passive second application state into an active second application state and the first application relationship is correspondingly transferred from the active first application state into a passive first application state, and from then on, the second output data is provided for the technical process via the output device;
wherein the second and the third subsystems follow the first subsystem in time and the first subsystem implements exchanges of data via the communication paths asynchronously in time;
wherein a first follow-up system is formed from the first subsystem and the second subsystem and a second follow-up system is formed from the first subsystem and the third subsystem; and
wherein synchronization data for the first follow-up system and the second follow-up system is identical and is transmitted by the first subsystem via multicast-based communication.