Update for an automation installation in the course of operation

A control apparatus for a process automation installation, said control apparatus stipulating a starting time for an update and being configured to:

• produce a control output, said update requiring at least a predetermined downtime;
• detect a current operating state for at least one peripheral component;
• use the detected operating state as a basis for a controlled system model of a process, said controlled system model simulating what state trajectory the at least one peripheral component runs through within the downtime for a predetermined stationary control output;
• check to determine whether the state trajectory is within a range of permissible operating states, wherein the range of permissible operating states includes operating states which the process and/or the at least one peripheral component has a permissible operating value;
• and
• start the update only when the state trajectory is entirely within the range of permissible operating states for the downtime.

A process automation installation having at least one peripheral component and a control apparatus, said control apparatus stipulating a starting time for an update, said process automation installation comprising:

• at least one peripheral component;
• and
• a first control apparatus configured to:
• produce a control output, said update requiring at least a predetermined downtime;
• detect a current operating state for at least one peripheral component;
• use the detected operating state as a basis for a controlled system model of a process, said controlled system model simulating what state trajectory the at least one peripheral component runs through within the downtime for a predetermined stationary control output;
• check to determine whether the state trajectory is within a range of permissible operating states, wherein the range of permissible operating states includes operating states which the process and/or the at least one peripheral component has a permissible operating value;
• and
• start the update only when the state trajectory is entirely within the range of permissible operating states for the downtime.