Method for Operating a Redundant Automation System

A method for operating a redundant automation system for controlling a technical process, a first fail-safe subsystem being operated with a first control program divided into first program sections, the control of the technical process being performed by the first fail-safe subsystem, and a second fail-safe subsystem being operated redundantly with a second control program divided into second program sections, the first fail-safe subsystem, with its first control program generates and evaluates events which influence an execution sequence of the first program sections in the first control program according to the events which have occurred and based on the generated or events which have occurred per program section, makes available synchronization data provided with an index, which reflects a respective program section, for the second fail-safe subsystem and makes available original data for an output, the original data being initially held back and not yet being written to the output, and the first subsystem preceding the second subsystem with the processing of the respective first program sections in relation to the index of the processing of the respective second program sections of the second subsystem, the method comprising:

• buffering the synchronization data initially in the second subsystem, the first fail-safe subsystem initially sending the available original data provided with the index of the respective first program section to the second fail-safe subsystem and the second fail-safe subsystem acknowledging this occurrence by acknowledging an output to the first fail-safe subsystem;
• performing an error check in the first fail-safe subsystem at an end of the respective first program section, an error free cycle of the first control program being checked via the error check in the respective first program section;
• deactivating the first fail-safe subsystem and controlling the technical process by the second fail-safe subsystem in an event that an error is identified;
• sending, by the first fail-safe subsystem, an error-free message to the second fail-safe subsystem in an event that no errors are identified to acknowledge the error-free message with an error-free acknowledgment and process the initially buffered synchronization data with the second program section matching the index;
• and
• writing the first original data to the output upon receipt of the error-free acknowledgement by the first fail-safe subsystem.