Control system with ability to maintain safety functionality during update

A control system comprising:

• memory comprising machine-readable instructions;
• and
• processing circuitry to execute the machine-readable instructions to:
• execute a safety function associated with equipment in the control system concurrently on a primary control device and a secondary control device;
• halt execution of the safety function on the secondary control device;
• update the secondary control device while the execution of the safety function is halted on the secondary control device;
• synchronize second safety data that is associated with the safety function and stored in memory of the secondary control device with first safety data that is associated with the safety function and stored in memory of the primary control device after updating the secondary control device;
• restart the execution of the safety function on the secondary control device after synchronizing the second safety data with the first safety data;
• halt execution of the safety function on the primary control device after restarting the execution of the safety function on the secondary control device;
• update the primary control device while the execution of the safety function is halted on the primary control device;
• synchronize the first safety data with the second safety data after updating the primary control device;
• and
• restart the execution of the safety function on the primary control device after synchronizing the first safety data with the second safety data.

One or more non-transitory computer-readable storage media having instructions stored thereon that, when executed by processing circuitry, cause the processing circuitry to:

• execute a safety function associated with equipment in the control system concurrently on a primary control device and a secondary control device;
• halt execution of the safety function on the secondary control device;
• update the secondary control device while the execution of the safety function is halted on the secondary control device;
• synchronize second safety data that is associated with the safety function and stored in memory of the secondary control device with first safety data that is associated with the safety function and stored in memory of the primary control device after updating the secondary control device;
• restart the execution of the safety function on the secondary control device after synchronizing the second safety data with the first safety data;
• halt execution of the safety function on the primary control device after restarting the execution of the safety function on the secondary control device;
• update the primary control device while the execution of the safety function is halted on the primary control device;
• synchronize the first safety data with the second safety data after updating the primary control device;
• and
• restart the execution of the safety function on the primary control device after synchronizing the first safety data with the second safety data.