Fail-safe bus system for a process system

A bus system for a process system, comprising:

• a transmitting first bus subscriber which transmits bus messages and a receiving first bus subscriber which receives bus messages, wherein the transmitting first bus subscriber and the receiving first bus subscriber are connected to one another via a first data bus, wherein the transmitting first bus subscriber transmits first control commands to the receiving first bus subscriber, wherein the receiving first bus subscriber executes the first control commands of the transmitting first bus subscriber;
• a transmitting second bus subscriber;
• and
• a receiving second bus subscriber;
• wherein the transmitting second bus subscriber and the receiving second bus subscriber are connected to one another via a second data bus;
• wherein the transmitting second bus subscriber transmits second control commands to the receiving second bus subscriber;
• wherein the receiving second bus subscriber executes the second control commands of the transmitting second bus subscriber;
• wherein the transmitting first bus subscriber and the transmitting second bus subscriber are connected to a transmitting substitute bus subscriber via a monitoring communication channel;
• wherein the transmitting substitute bus subscriber functionally monitors the transmitting first bus subscriber and the transmitting second bus subscriber;
• wherein the first data bus and the second data bus can be connected to one another and disconnected from one another via a switching device which can be controlled by a circuit, wherein the first data bus and the second data bus are disconnected from one another in a simultaneous go state of the transmitting first bus subscriber and of the transmitting second bus subscriber;
• wherein, in a fault state of the transmitting first bus subscriber or in a fault state of the transmitting second bus subscriber, the circuit connects the first data bus and the second data bus to one another via the switching device so that, in the fault state of the transmitting first bus subscriber, the transmitting substitute bus subscriber is connected to the receiving first bus subscriber via the monitoring communication channel, the transmitting second bus subscriber, the first data bus, and the second data bus, and in the fault state of the transmitting second bus subscriber, the transmitting substitute bus subscriber is connected to the receiving second bus subscriber via the monitoring communication channel, the transmitting first bus subscriber, the first data bus, and the second data bus;
• and
• wherein, in the fault state of the transmitting first bus subscriber, the transmitting substitute bus subscriber transmits the first control commands to the receiving first bus subscriber or, in the fault state of the transmitting second bus subscriber, the transmitting substitute bus subscriber transmits the second control commands to the receiving second bus subscriber.