CONTROL SYSTEM AND METHOD FOR CONTROLLING A DEVICE OR PLANT

Description

[0001] The invention relates to a control system for controlling a device or system, wherein at least one safety function is provided with respect to the control of the device or system. The invention further relates to an associated method.

[0002] The use of fail-safe controllers in industrial automation is widespread, with typical applications such as safe interlocking or limit value monitoring. However, the trend towards efficient and flexible production also increases the demands on safety programs, and the reliable monitoring of such dynamic processes and systems in real time requires more complex safety solutions.

[0003] Solutions exist in the prior art that employ coded processing to meet safety requirements. In this approach, safety-relevant processing steps are performed via two diverse paths using coded data and operations, eliminating the need for hardware redundancy while simultaneously ensuring consistency and scalability.

[0004] Furthermore, so-called lockstep processors are known. With regard to logical processing, lockstep processors offer a generally cost-effective option that achieves on-chip redundancy through their intrinsic multi-core architecture and suitable execution and comparison mechanisms.

[0005] From the German patent application WO 2016 / 138956 A1, it is known to execute program parts that cannot be processed using code in hardware redundancy. This requires two processor units for the non-coded execution. Utility model DE 20 2015 004120 U1 discloses a safety control system for a packaging machine with a master safety controller and a slave safety controller that communicate with each other via fieldbus systems.

[0006] The patent application DE102020127515A1 discloses a device for controlling a safety-critical process with a first and second safe signaling unit that communicate via a power grid.

[0007] The publication of the European patent application EP3470939A1 shows a monitoring of the security integrity of a security function provided by a security system, whereby security parameters are passed along a security chain.

[0008] Against this background, an object of the present invention is to improve the error-free and high-performance processing of programs with complex safety requirements. This object is achieved by the features of the independent claims. Advantageous embodiments are specified in the dependent claims.

[0009] The invention relates to a control system for controlling a device or system as defined in claim 1.

[0010] A safety-related control device, as defined in this application, is designed and configured in such a way as to guarantee, as far as possible, that no hazardous condition can arise during the operation of the safety-related control device – for example, due to a component failure. Furthermore, a safety-related control device can be designed and configured in such a way that no unacceptable risk can arise from the device or system during its operation.

[0011] According to the present application, a safety function is understood to be a function that must meet safety-related criteria so that the system on which the safety function is executed becomes a safety-related system. These criteria are defined or standardized, for example, by safety specifications. For instance, specifications must be met that define the initiation of stop processes, the maintenance of distances to zone boundaries, etc. In particular, the safety standards IEC 61508 and ISO 10218, which must be complied with depending on the application, should be mentioned here. A safety-related function of the controller refers specifically to a safety-related stop or brake function.

[0012] Furthermore, the implementation of safety functions must be designed to ensure so-called functional safety, meaning that system or component failures or errors are detected and lead to the device or system entering a safe state. A functionally safe implementation includes, in addition to processing, calculating, or verifying values ​​to generate control outputs, a check for the error-free execution of each processing step. For example, each functionally safe processing step can be formed by an arithmetically coded processor instruction and / or coded data values, and / or it can be checked whether the result of the processing step lies within a predetermined interval of permissible values ​​to verify the plausibility of the result.The additional check provided by the functional safety mechanism does not change the result, but merely generates an additional signal indicating either that the processing step was error-free (no bit errors and / or the result of the processing step within a permissible value interval) or that the processing step was faulty (bit errors, implausible result outside the value interval). In the case of a faulty processing step, the result is discarded and the safe state is initiated.

[0013] The safety function in this case includes a safety subfunction. The safety subfunction is subject to the same safety requirements as the safety function. The safety subfunction can be implemented as an external component or encapsulated. Specifically, inputs to the safety subfunction, which are passed to it by the safety function, and outputs to the safety subfunction, which are supplied by the safety subfunction to the safety function, are defined. Furthermore, input values ​​are transmitted directly to the safety subfunction, for example, from a sensor connected to the second safety-related control device. The safety subfunction may, for example, include particularly computationally intensive, complex, or time-consuming sections of the control program.The safety sub-function section of the program, for example, has particularly high complexity and performance requirements. This complexity, and the associated long processing times, arise primarily from the safety requirement and the related need for safety-oriented processing.

[0014] The safety sub-function is advantageously processed on the second safety device, which is based on a processor unit. This second processor unit is preferably optimized for the safety-related processing of the complex program sections. This particularly advantageously leaves the functionality of the first safety device unchanged.

[0015] The first safety device is, for example, a so-called F-PLC, i.e., a fail-safe PLC for controlling devices, systems, or system components. This can be used in the usual way for less complex program sections and, in particular, can be connected to fail-safe sensors and actuators as usual. Outsourcing certain program sections to the second safety device allows for flexible use of the control system, even for applications such as safety-related robotics, since Cartesian calculations in three-dimensional space with corresponding arithmetic, especially trigonometric, operations are often necessary in these applications, and the use of floating-point numbers is frequently required.

[0016] The first safety device can advantageously include a software-based mechanism for the safety-related execution of the safety function, which can be selected independently of the overall complexity of the safety function. Only through diversity in the software execution of the safety function on the first safety device can this section of the program then be executed in a safety-related manner. The associated advantages of software redundancy can be utilized, in particular the ability to use it in combination with non-safety-related hardware or the scalability.

[0017] The second safety device can now advantageously be tailored and optimized to meet the requirements of the safety sub-function. The safety-related mechanism provided for in the first safety device should not also be provided in the second safety device; instead, a mechanism better suited for safety-related processing in complex control program sections is chosen.

[0018] The processor unit implements a mechanism that provides on-chip redundancy. This eliminates the need for complex software processing via diverse paths for the complex sub-function, as well as a fully dual-channel, redundant hardware implementation requiring multiple PLCs. This avoids the high costs associated with complex, customized architectures, partly due to a lack of standards, or manual program modifications requiring appropriate structuring of the user program. At the same time, high performance is achieved without the drawback of slow cycle times. In this context, the term "processor unit" refers to hardware consisting of a single processor, as opposed to processing program code on hardware with multiple processors.

[0019] To ensure the system's security, secure communication between the safety devices is provided via a safety-oriented communication link, in particular using a secure protocol, such as the PROFIsafe protocol. This is especially advantageous for detecting message errors during data exchange between the safety devices.

[0020] The proposed control system enables fail-safe and high-performance processing of safety subprograms with complex safety requirements while simultaneously connecting to a fail-safe control system that operates with diverse processing paths and is freely programmable by the user.

[0021] Outsourcing the safety subroutine frees up resources on the coded controller, which can then be advantageously used for other safety or standard operations.

[0022] According to one embodiment, the first safety-oriented control device is designed and configured to perform at least one safety function using a coded procedure, in particular a "Coded Processing" procedure.

[0023] A coded processing method is based on the principle of diverse execution of software code on a single processor unit. In particular, safety-relevant processing steps are performed via two diverse paths using coded data and operations, which eliminates the need for hardware redundancy for this processing step and simultaneously ensures consistency and scalability of the solution.

[0024] For example, so-called "Diversified Encoding" is used, which is based on two different implementations of the same security function. These two implementations are: Native Execution: Native execution corresponds to the execution of the original security function without coding. The source code for the original security function forms the source code of the native execution. Native execution operates on native (original) input values ​​and the native state. It only modifies the native state. The result of native execution is the native output. Coded Execution: Coded execution (using coded processing) is based on the coded version of the security function. It operates on coded input values ​​and the coded state. The result is the coded output.

[0025] Both executions are completely independent calculations, but they operate on the same values. The coded input values ​​are the coded versions of the native input values. The source code of the native security function is used to generate the source code of the coded execution. This generation can be done either manually or—recommended for reproducibility—with a suitable tool.

[0026] According to one embodiment, the second safety-related control unit is designed and configured to execute at least one safety sub-function using an uncoded method. By using an uncoded method on the second safety-related control unit, the subroutine with high performance or complexity requirements can be offloaded to a second fail-safe, high-performance control unit, e.g., through suitable on-chip hardware redundancy.

[0027] All existing tools for automation and the integration of sensors and actuators can be used to advantage on the first safety-related control unit. To execute the complex subroutine with high performance requirements, which cannot be performed on the first safety-related control unit with a sufficiently long cycle time or with reasonable effort due to the coded processing used there, the second safety-related control unit is used as a safety coprocessor.

[0028] Especially for calculations or program sections where data is to be stored in arrays, as a matrix, or as a vector, standard safety programs on PLCs, such as those typically used on the first safety-related control device, reach their limits. Furthermore, there are no suitable methods for storing persistent data. Dynamic variables that change during the process and are stored as intermediate values, for example, for more accurate estimation of the positions of moving devices in industrial plants, can be advantageously used on the second safety-related control device.

[0029] The second safety-related control unit is connected to the first safety-related control unit via a secure protocol for communicating the relevant inputs and outputs of the subroutine. The complex subroutine can be executed efficiently on the co-processor using all available operations, and the results can be safely communicated back to the F-PLC.

[0030] In some variants, the second safety-related control device is hard-coded. Advantageously, this allows it to be optimized for specific applications and hardware used, for example, by inlineing or by locating certain functions in high-performance areas. Furthermore, it is advantageous to be able to perform preliminary testing, particularly with certification of the specific application.

[0031] In alternative versions, the second safety-related control device is freely programmable, so that the second safety-related control device can be provided in a quasi-standardized form for a large number of applications, and application-specific adjustments can be made by the end user, for example in the form of a safety app.

[0032] According to one embodiment, the second safety-related control device is designed and configured to implement hardware redundancy on the processor unit, particularly based on a multi-core architecture with lockstep cores. This achieves on-chip redundancy, i.e., redundant execution on a single processor unit. When using lockstep cores, for example, two or more cores execute identical code. An independent comparator compares the results and detects errors based on differing values ​​during execution. For instance, lockstep cores exploit a delay of a few clock cycles in processing identical instructions and utilize minor variations in the spatial arrangement of the cores to achieve diversity. Temporal and spatial distinctions are necessary, for example, to eliminate common-cause errors.

[0033] According to the invention, the first safety-related control device is designed and configured to process output data received from the second safety-related control device via the safety-related communication link for the execution of the at least one safety function. Thus, an intermediate value required in a safety function is calculated and provided by the second safety-related control device. For example, values ​​relating to positions, speeds, accelerations, orientations, etc., are provided, which are then further processed by the first safety-related control device during the execution of the safety function.For example, this enables complex calculations involving trigonometric functions or floating-point numbers on the coprocessor, and only values ​​are returned to the safety PLC using coded processing, which can also be further processed in coded form without any effort.

[0034] Furthermore, the first safety-related control device initiates the adoption of a safe state if, for example, the first safety-related control device detects a system error or fault state of the first safety-related control device by means of coding-based diverse program processing.

[0035] According to one embodiment, the second safety-related control device is designed and configured to initiate a safety measure depending on the result of the safety sub-function. In some embodiments, the initiation of a safety measure is carried out directly by the second safety-related control device.

[0036] For this purpose, actuators, or in particular only a specific part of the actuators, can be directly connected to the second safety-related control unit. For example, special drives that effect the movement of a kinematic system in three-dimensional space can be controlled directly by the co-processor's control unit. Emergency stops are thus implemented particularly advantageously and directly without delay caused by communication channels, etc.

[0037] The second safety-related control device is also designed and configured, due to the diverse execution of the program code, to detect system errors. Advantageously, if corrupt system behavior is detected, such as the failure of a component like a sensor, or any other system error, the second safety-related control device initiates a safety measure that ensures a safe state is reached. For example, values ​​are directly specified to the actuators that lead to the safe state being reached.

[0038] According to one embodiment, the first safety-related control device is designed and configured to initiate a safety measure based on output data received via the safety-related communication link. The initiation of safety measures by the first safety-related control device then occurs via the actuators connected to it, without the second safety-related control device being detectable by the actuators. For example, stops are initiated if calculations performed during the execution of the safety function on the first safety-related control device reveal zone or limit violations, or if information regarding a stop to be initiated, in particular a stop ID, is provided by the second safety-related control device.Furthermore, the first safety-related control device also initiates the assumption of a safe state if, for example, the second safety-related control device detects a system error or fault state of the second safety-related control device.

[0039] Initiating the safety measure can, in turn, consist of assuming a safe state due to a detected system fault. The second safety-related control device then, for example, provides substitute values ​​to the first safety-related control device, or communication with the first safety-related control device is blocked. The first safety-related control device then continues to operate in some variations, since a fault was only detected on the second safety-related control device. In alternative configurations, the first safety-related control device also initiates the assumption of a safe state as a precautionary measure, since the substitute values ​​are considered insufficient for the functional safety of the system.

[0040] The invention further relates to a method for controlling a device or system as defined in claim 7.

[0041] According to one embodiment, the first safety-related control device executes the at least one safety function using a coded method, in particular a "coded processing" method. According to another embodiment, the second safety-related control device executes the at least one safety sub-function using an uncoded method.

[0042] According to one embodiment, the second safety-related control device implements hardware redundancy on the processor unit, in particular based on a multi-core architecture with lockstep cores.

[0043] According to the invention, the first safety-oriented control device processes output data received from the second safety-oriented control device via the safety-oriented communication link for the execution of the at least one safety function.

[0044] According to one embodiment, the second safety-related control device initiates a safety measure depending on a result of the safety sub-function. According to another embodiment, the first safety-related control device initiates a safety measure depending on output data received via the safety-related communication link.

[0045] The invention is explained in more detail below with reference to exemplary embodiments and the figures. The figures show: Figure 1 is a schematic representation of components of the control system according to a first embodiment of the invention; Figure 2 is a schematic representation of components of the control system according to a second embodiment of the invention; Figure 3 is a schematic representation of components of the control system according to a third embodiment of the invention; Figure 4 is a schematic representation of components of the control system according to a fourth embodiment of the invention.

[0046] In the figures, functionally equivalent elements are provided with the same reference symbols, unless otherwise specified.

[0047] In Figure 1A first embodiment is shown in which a first safety-oriented control device, in particular a failsafe PLC (F-PLC), is provided in a control system C for a plant with motion-controlled components, on which control program code is executed in a safety-oriented manner by utilizing a coded processing method. The control program code is executed diversely in software, so that the probability of undetected system errors or execution errors is low, corresponding to the safety requirements of the system.

[0048] The first embodiment involves a system that uses robotic arms to enter areas where people are present. Accordingly, the control system C is subject to safety requirements that ensure safety-oriented monitoring of movements, the initiation of appropriate safety measures depending on the movement pattern or course, the provision of emergency stop procedures, etc.

[0049] A safety user program is created on the failsafe PLC (F-PLC) that implements the safety requirements and includes a safety function (F). Safety function F comprises several safety function blocks that define how the drives should react to the activation of emergency stop switches or how axial safety functions are parameterized. For example, one safety function block within safety function F includes axial speed monitoring, axial force monitoring, and axial torque monitoring, where limit values ​​are specified for the respective parameters. For instance, a limit torque is specified for each axis; if this torque is exceeded, the kinematics initiate a stop.

[0050] For example, the speed of a moving end effector in Cartesian space should be reduced when it approaches a safety zone that it is not allowed to enter. Furthermore, a stop should be initiated when it reaches the zone boundary.

[0051] For this type of safety monitoring, the current position of the robot and its axis segments in space is determined and compared with defined spatial areas specified by zones. This requires calculations based, for example, on trigonometric relationships between kinematic axes. Furthermore, parameters are specified that describe the kinematics or kinematic properties, such as dimensions or radii of movement. These specifications are specific to the system or machine manufacturer and therefore individual and generally cannot be influenced by a system operator. The values ​​specified as parameters are thus often only expressible using floating-point numbers.

[0052] This functionality with complex calculations based on arithmetic operations is encapsulated in a safety sub-function F' and outsourced as a modular software component for execution to the second safety-oriented control unit as a Safety Co-Processor F-CP.

[0053] The safety user program for operating the robot is programmed on the failsafe PLC (F-PLC). Sensors S0 and S12 are also connected to the failsafe PLC (F-PLC) and provide values ​​for positions, speeds, switch states, etc.

[0054] Safe inputs IF'1, IF'2 for the safety subfunction, such as axis values ​​from encoders required for the execution of the safety subfunction, are transmitted from the failsafe PLC F-PLC to the safety co-processor F-CP via a secure communication link P, specifically based on a secure telegram, for example according to the PROFIsafe standard. Furthermore, data R1, R2 from the safety co-processor F-CP are delivered back to the failsafe PLC F-PLC via the secure communication link P.

[0055] According to the first embodiment, the safety subfunction F' determines values ​​for quantities such as position and velocity in Cartesian space from kinematic dimensions, axis values ​​of the individual kinematic axes, or axial error values. These values ​​are calculated using trigonometric relationships and based on input values ​​that include floating-point numbers. Advantageously, this calculation is performed uncoded on the safety co-processor F-CP, on which the safety-related execution relies on hardware redundancy using lockstep processors. This allows for the straightforward implementation of the arithmetic operations without the auxiliary conversions that would be necessary with coded processing.

[0056] The results R1, R2 of the safety subfunction F' are further processed by the safety function F on the safety co-processor F-CP. For example, the position of the end effector is returned to the failsafe PLC F-PLC, and a subsequent check, which includes exceeding limit values ​​or entering restricted zones, and the output of the corresponding check results O1, O2, are performed on the F-PLC.

[0057] The failsafe PLC F-PLC is also connected to actuators A0 and A12, such as the axis drives, for implementing the reactions. Within the framework of the safety function F, reactions are predefined that are to occur when predefined limits are violated, for example, the conditions for disabling drives. The comparison of values ​​determined by both the safety function F and the safety sub-function F' with predefined limit values ​​is thus performed on the failsafe PLC F-PLC, according to the first embodiment.

[0058] The failsafe PLC (F-PLC) is considered the main loop of the safety program and is essentially the central point of contact for the kinematics. The safety sensors S0 and S12 are also connected to the failsafe PLC (F-PLC).

[0059] Sensors S0 and actuators A0 are provided, which independently of the processing on the Safety Co-Processor F-CP supply values ​​at inputs and receive values ​​at outputs.

[0060] According to a second embodiment, the F-CP safety co-processor receives all necessary data, such as the axis positions of all involved axes, via defined interfaces. In particular, associated counter values ​​or timestamps are also transmitted to ensure the comparability of the different axis values ​​and to compensate for time delays in data provision or transmission.

[0061] For example, in a failsafe motion monitoring system, the user can also select which zones of a zone monitoring system are active, or which cones are monitored. This is implemented via interfaces to the user program on the failsafe PLC.

[0062] Input data relating to the safety sub-function F' is essentially forwarded from the safety function F to the safety sub-function F' and transmitted to the safety co-processor F-CP via a secure communication connection P.

[0063] For example, the safety co-processor is a multi-core processor with several safety cores. On the F-CP safety co-processor, each safety core is a dual-core processor that performs data processing according to the lockstep mechanism. A so-called master and a so-called checker perform the same steps, but on geometrically slightly offset cores of the processor, for example, slightly rotated and with different timing constraints. This ensures that an error propagating through both paths does not lead to identical results on the two cores. If the results of both calculations on the dual-core processor match, the result is recognized as correct and further processed by the safety subfunction F'.

[0064] In Figure 2This illustrates that the safety co-processor F-CP provides a stop operation identifier as the result STOP-ID of the safety sub-function F'. The safety sub-function F' thus not only provides values ​​for further processing by the safety function F of the failsafe PLC F-PLC, but also delivers a STOP-ID result that can be directly passed on as the STOP output from the safety function F to an actuator A12. For example, this directly triggers a stop on a drive.

[0065] For example, in certain variants, the safety function F determines which action is initiated when a STOP-ID result from the safety subfunction F' is present. Thus, while the STOP-ID result is not processed further, the safety function F allows a user to define the assignment of results from the safety subfunction F' to actions initiated by the failsafe PLC F-PLC.

[0066] The outputs of the safety subfunction F' described so far are results obtained when the calculations on the Safety Co-Processor F-CP are executed correctly and without errors. These results can describe whether or not limits or zones have been violated, as described above, as raw or intermediate values ​​that are further processed on the failsafe PLC, or they can be the final results of a safety function block, with the corresponding possibility of directly outputting a programmed response to an actuator in the event of a zone or limit violation.

[0067] Figure 3 Figure 3 illustrates a third embodiment in which a fault E' is detected on the safety co-processor F-CP. For example, a hardware failure in one of the processor cores is detected, or another fault in a semiconductor component of the processor.

[0068] As a result, the safety co-processor F-CP sends a notification of the system error E' back to the failsafe PLC F-PLC. In addition, substitute values ​​X1 and X2 are provided, which also indicate that a "stop" has occurred. Since it cannot be guaranteed that the safety co-processor F-CP is still functioning correctly in the fault state, communication is terminated for safety reasons, and the safe substitute values ​​are provided.

[0069] For example, several safety sub-functions F' and F'' run on the safety co-processor F-CP. If a system error E' is detected on the safety co-processor F-CP, all applications executed by the safety sub-functions F' and F'' are interrupted. The failsafe PLC F-PLC continues to run, but initiates safe states E for all processes or actions that depend on the results of one of the safety sub-functions F' and F''.

[0070] For example, the Safety Co-Processor F-CP implements safe motion monitoring as its first safety sub-function F' and safe force monitoring as its second safety sub-function F''. The Safety Co-Processor F-CP is freely programmable and allows the execution of arbitrarily complex, user-defined, safety-related subroutines. By offloading the subroutine, resources are freed up on the code-based controller, which can then be advantageously used for other safety or standard operations.

[0071] According to a fourth embodiment, the safety co-processor F-CP implements safe person detection in industrial environments using RTLS (Real Time Locating System) as a safety sub-function F'. Safe real-time localization is particularly important for stopping moving machine parts or autonomous mobile robots (AMRs) when people are nearby, for example in factories, production halls, or warehouses.

[0072] Figure 4 The fourth embodiment illustrates this. The offloading of the safety subfunction F' to the safety co-processor F-CP for uncoded execution is carried out according to one of the examples above. A result of the safety subfunction F', assuming correct execution—that is, as long as the safety co-processor reliably executes the program code without errors—is also returned to the failsafe PLC F-PLC according to one of the examples above.

[0073] The F-CP safety co-processor is not freely programmable, so software and hardware are jointly optimized for the execution of RTLS functionality.

[0074] If a system error is detected during the safety-related execution of the program code on the Safety Co-Processor F-CP, only a diagnostic message is output to the Failsafe PLC F-PLC. Communication of result values ​​is prevented via the safe communication link P. The measures for bringing moving components to a safe state due to a detected person in the vicinity of the components are initiated directly by the Safety Co-Processor F-CP. For this purpose, it is directly connected to actuator A12', and the output of a detected system error E' leads, for example, to the safe stop of a robot gripper arm or an AMR. The Failsafe PLC F-PLC only receives the information that a stop has been initiated. The Failsafe PLC F-PLC itself is also connected to actuator A0 and initiates reactions depending on the result of safety functions F executed on the Failsafe PLC F-PLC.

[0075] Due to the direct connection of the Safety Co-Processor F-CP with actuator A12' for disabling corresponding drives, a particularly fast reaction is necessary in safety-critical environments with real-time requirements.

[0076] In some versions, sensors can also be directly connected to the Safety Co-Processor F-CP to ensure particularly high response times.

[0077] In summary, a first safety-related control unit operating using code serves as the basis for integration into the automation environment and is, in particular, freely programmable by the user. The advantages of coded processing, such as consistency and scalability, are fully exploited. Complex calculations in program code, which are either impossible, slow, or require enormous manual effort with programming languages ​​used in common failsafe PLCs like FBD or LAD, are executed as safety sub-functions on the second safety-related control unit, enabling the implementation of complex functions. These include, for example, inverse operations, the use of floating-point numbers, sine or square root functions, etc.

[0078] The security subroutine runs uncoded on the co-processor using suitable hardware redundancy and implements performance-critical program components.

Claims

1. Control system (C) for controlling an apparatus or system, wherein at least one safety function (F) is provided with regard to the control of the apparatus or system, wherein the at least one safety function (F) has at least one safety sub-function (F') which is subject to the same requirements with regard to safety as the safety function and can be outsourced or encapsulated for execution, wherein the control system (C) comprises a first safety-oriented control device (F-PLC) and a second safety-oriented control device (F-CP), wherein the first safety-oriented control device (F-PLC) and the second safety-oriented control device (F-CP) are communicatively coupled via a safety-oriented communication link (P), wherein the first safety-oriented control device (F-PLC) is designed and configured for executing the at least one safety function (F), wherein the second safety-oriented control device (F-CP) is based on a processor unit and is designed and configured for executing the at least one safety sub-function (F') using input data (IF'1, IF'2) received via the safety-oriented communication link (P) from the first safety-oriented control device (F-PLC), wherein the first safety-oriented control device (F-PLC) is designed and configured to process output data (R1, R2) received from the second safety-oriented control device (F-CP) via the safety-oriented communication link (P) for executing the at least one safety function (F).

2. Control system (C) according to Claim 1, wherein the first safety-oriented control device (F-PLC) is designed and configured for executing the at least one safety function (F) using a coded working method, in particular a "coded processing" method.

3. Control system (C) according to Claim 1 or 2, wherein the second safety-oriented control device (F-PLC) is designed and configured for executing the at least one safety sub-function (F') using an uncoded working method.

4. Control system (C) according to one of the preceding claims, wherein the second safety-oriented control device (F-CP) is designed and configured to implement hardware redundancy on the processor unit, in particular based on a multi-core architecture with lockstep cores.

5. Control system (C) according to one of the preceding claims, wherein the second safety-oriented control device (F-CP) is designed and configured to initiate a safety measure depending on a result of the safety sub-function (F').

6. Control system (C) according to one of the preceding claims, wherein the first safety-oriented control device (F-PLC) is designed and configured to initiate a safety measure depending on output data received via the safety-oriented communication link (P).

7. Method for controlling an apparatus or system, wherein the apparatus or system is controlled by means of at least one safety function (F), wherein the at least one safety function (F) has at least one safety sub-function (F') which is subject to the same requirements with regard to safety as the safety function and can be outsourced or encapsulated for execution, wherein a control system (C) comprises a first safety-oriented control device (F-PLC) and a second safety-oriented control device (F-CP), wherein the first safety-oriented control device (F-PLC) and the second safety-oriented control device (F-CP) exchange data via a safety-oriented communication link (P), wherein the first safety-oriented control device (F-PLC) executes the at least one safety function (F), wherein the second safety-oriented control device (F-CP) is based on a processor unit and executes the at least one safety sub-function (F') using received input data (IF'1, IF'2), wherein the first safety-oriented control device (F-PLC) processes output data received from the second safety-oriented control device via the safety-oriented communication link (P) for executing the at least one safety function.

8. Method according to Claim 7, wherein the first safety-oriented control device (F-PLC) executes the at least one safety function (F) using a coded working method, in particular a "coded processing" method.

9. Method according to Claim 7 or 8, wherein the second safety-oriented control device (F-CP) executes the at least one safety sub-function (F') using an uncoded working method.

10. Method according to one of Claims 7 to 9, wherein the second safety-oriented control device (F-CP) implements hardware redundancy on the processor unit, in particular based on a multi-core architecture with lockstep cores.

11. Method according to one of Claims 7 to 10, wherein the second safety-oriented control device (F-CP) initiates a safety measure depending on a result of the safety sub-function.

12. Method according to one of Claims 7 to 11, wherein the first safety-oriented control device (F-PLC) initiates a safety measure depending on output data received via the safety-oriented communication link (P).

13. Method according to one of Claims 7 to 12, wherein the received input data (IF'1, IF'2) are received via the safety-oriented communication link (P) from the first safety-oriented control device (F-PLC) or via a sensor connected to the second safety-oriented control device (F-CP).