METHOD FOR SEPARATING SAFETY-RELATED DATA PROCESSING PLANTS AGAINST INFLUENCE FROM OTHER DATA NETWORKS AND APPARATUS SUITABLE THEREFOR

摘要

The method involves securing data processor arrangements against unintentional and inadmissible influence from other data networks, with which the data processors are connected over communication services. A filter function is used, to delete all messages, which are recognised as ambiguous with respect to their safety. The data messages delivered over the communication services are filtered in at least two independent observation units connected in series with each other, and preceding the security-related data processor. The messages are encoded in a first observation unit and are decoded again in the second observation unit which follows in the data transfer direction. Test data are formed, at least indirectly, through programs and necessary unchangeable data implemented in both observation units, and are compared with the reference data stored in the observation units and/or test- and/or reference data originating in the partner observation unit. If a test is not successfully completed within a defined crash recognition time, the observation unit which recognised the crash is irreversibly switched off.