Control System and Method for Safe Control of a Technical System

A method for the safe control of a technical system with a control system, wherein the control system comprises four mutually independent computer subsystems, a primary control system, PCS, (103), a monitoring system, MS, (104), a fallback system, FBS, (105) and a decision system, DS, (101), the method comprising:

• calculating, by the PCS (103), setpoint values for the control of the technical system in each time slice and sends the setpoint values in a message to the MS (104) and the DS (101) before the end of the time slice in each case,
• checking, by the MS (104), the setpoint values it has received from the PCS (103) in each time slice, and transmits the result of this check-TRUE or FALSE-before the end of the time slice in a message to the DS (101),
• calculating, by the FBS (105), setpoint values in each time slice that can bring the system from a present state to a safe state, and wherein the FBS (105) sends these setpoint values in a message to the DS (101),
• receiving, by the DS (101), one message each from the PCS (103), the MS (104) and the FBS (105) in each time slice and, on the basis of the result of the check by the MS (104), decides whether the setpoint values of the PCS (103) or the FBS (105), the so-called “selected” setpoint values, are sent to the actuators (102),
• wherein the actuators (102) are intelligent actuators, IA, which have a first input channel (107) and a second input channel (108),
• wherein if the DS (101) is fault-free, the DS (101) sends the selected setpoint values to the first input channel (107) of the IA (102) in a time-controlled message (217) at an a priori determined periodic first time point (222) in each time slice,
• wherein the DS (101) has a fail-silent behaviour, so that if a fault occurs in the DS (101) no message is sent to the IA (102),
• wherein the FBS (105) is configured to send, in each time slice, its calculated setpoint values in a time-controlled message to the second input channel (108) of the IA (102) at an a priori determined periodic second timepoint_2 (221),
• wherein in each time slice the second timepoint_2 (221) occurs before the first timepoint_1 (222),
• wherein after the first timepoint_1 (222) the IA (102) checks whether the IA (102) has received a message sent by the DS (101) in the present time slice,
• wherein if this is the case, the IA (102) directs the setpoint values contained in the message (217) sent by the DS (101) and received by the IA (102) to the system,
• and
• wherein if this is not the case, the IA (102) directs the setpoint values contained in the message (215) sent by the FBS (105) to the second input channel (108) of the IA (102) to the system, and the IA (102) continues to transmit the setpoint values received from the FBS (105) via the second receive channel (108) to the system in all subsequent time slices until the control system is reinitialized.