Method for programming a safety controller

A safety controller for fail-safe control of a safety-critical process, comprising:

• a plurality of inputs for receiving sensor signals,
• a plurality of outputs for outputting actuator signals,
• at least one processor for cyclically executing program code,
• a first non-volatile memory,
• a second volatile memory, and
• a programming tool for creating a user program which defines logical dependencies between selected sensor signals and selected actuator signals,
• wherein the programming tool has a program editor designed to generate a first program portion and at least one additional program portion,
• wherein the first program portion defines safety-related logical dependencies between some selected sensor signals and some selected actuator signals, and is distinct from the at least one additional program portion,
• wherein the programming tool further has a compiler designed to compile the first program portion and the at least one additional program portion and to link them in order to form an executable original program code for the at least one processor which establishes a control process for the safety controller,
• wherein the original program code has an original first code portion, which represents the first program portion, and at least one original additional code portion, which represents the at least one additional program portion, and
• wherein the programming tool is configured for transferring the original program code into the first memory,
• wherein the programming tool is further designed to modify and to compile the first program portion separately from the additional program portion, in order to obtain a modified first code portion, and
• wherein the programming tool is further configured for transferring the modified first code portion into the second memory while the original program code is executed by means of the at least one processor, and
• wherein the safety controller is configured to execute the modified first code portion in addition to the original additional code portion and instead of the original first code portion by means of the at least one processor without interrupting the control process, in order to generate the actuator signals as a function of the modified first program portion.

A non-transitory computer readable data storage medium encoded with a computer program for a safety controller for fail-safe control of a safety-critical process, wherein the safety controller has a plurality of inputs for receiving sensor signals, a plurality of outputs for outputting actuator signals, at least one processor for cyclically executing the computer program which establishes a control process for the safety controller, a first non-volatile memory, a second volatile memory, and a programming tool for creating a user program which defines logical dependencies between selected sensor signals and selected actuator signals, and wherein the computer program is designed to execute a method comprising the steps of:

• creating a user program which defines logical dependencies between the sensor signals and the actuator signals, using a program editor, wherein the user program has a first program portion and at least one additional program portion, and wherein the first program portion defines safety-related logical dependencies between selected sensor signals and actuator signals, and is distinct from the at least one additional program portion,
• compiling and linking the first program portion and the at least one additional program portion, in order to obtain an executable original program code for the at least one processor, wherein the original program code has an original first code portion which represents the first program portion, and at least one original additional code portion which represents the at least one additional program portion,
• transferring the executable original program code to a first memory of the safety controller,
• executing the executable original program code by means of the at least one processor, in order to generate the actuator signals as a function of the sensor signals,
• modifying the first program portion using the program editor, in order to obtain a modified first program portion, and
• compiling the modified first program portion, in order to obtain a modified first code portion,
• wherein the modified first code portion is transferred to a second memory of the safety controller while the original program code is executed by means of the at least one processor, and
• wherein the modified first code portion is then executed in addition to the original additional code portion and instead of the original first code portion by means of the at least one processor without interrupting the control process, in order to generate the actuator signals as a function of the modified first program portion.