System and method for delivering operating software updates to security-oriented devices

Abstract

The invention relates to a system, comprising a security-oriented device (1) and an electronic storage device (2) separate from the device, in which exactly one data content for the device (1) is stored. The exactly one data content is an operating software update or an address. The electronic storage device (2) comprises a first connection device (3) for mechanically and electrically coupling to the device (1), wherein the first connection device (3) has a first mechanical coding mechanism. The device (1) comprises a storage device (11), a microcontroller (10) and a second connection device (5) for mechanically and electrically coupling to the electronic storage device (2), in which an operating system is stored, wherein the second connection device (5) has a second mechanical coding mechanism. The microcontroller (10) is designed to detect whether the electronic storage device (2) is connected to the second connection device (5) of the device (1) via its first connection device (3) and, in this case, is also designed to download the exactly one data content stored in the electronic storage device (2) to the storage device (11) of the device (1).

Description

Technical Field

[0001] The invention relates to a system comprising a safety-oriented device, in particular a safety-oriented input / output module or a safety-oriented control device, and comprising an electronic storage device separate therefrom, in which exactly one data content for the device is stored, and a method for transferring exactly one data content from the electronic storage device to the safety-oriented device within the system. Background Art

[0002] In order to reduce the risk to people or the environment in the automation process, machines and facilities must implement safety functions, such as shutting down the machine after pressing the emergency stop button, or switching the equipment to a safe state after detecting a fault. In this regard, error-proof automation systems are increasingly used in automated processes, machines and facilities. Generally, these error-proof automation systems implement actual safety functions such as emergency stop, two-hand connection, working mode selection switch or the like on the one hand, and on the other hand can also implement fault identification and countermeasures according to mechanisms such as those specified in standards such as IEC 61508, ISO13849 and other mechanisms according to the current prior art. If it is ensured by appropriate measures that the electrical, electronic and / or programmable electronic system and individual subsystem modules or also individual hardware and / or software components effectively meet specific safety functions, then the system or the corresponding subsystem module is considered to be safe or safety-oriented within the scope of the following description and claims.

[0003] Safety-oriented devices, such as safety-oriented input / output modules and control devices of machines or installations, comprise one or more integrated processors and control devices, which usually have an operating system. In order to keep the operating system up to date and, in particular, to eliminate errors in the operating system or to expand the functionality of the respective safety-oriented device, it is necessary to be able to load operating software updates onto the safety-oriented device, which operating software updates can be initiated by the respective safety-oriented device.

[0004] In some safety-oriented devices, for example in at least some modules with protection class IP20, the housing of the device must be opened and a new operating system must be run in the device using a special programming adapter. This can usually only be done directly at the manufacturer of the respective device and cannot be done on site by the user of the input / output module. However, this is problematic, especially in the case of input / output modules with protection class IP67, since these cannot be opened. Therefore, in the case of an operating system fault being identified or in the case of a need to update the operating system, only replacement of these input / output modules by new input / output modules with a correspondingly updated operating system is considered, and destruction of the input / output modules with the non-updated operating system is considered.

[0005] Furthermore, in the field of functional safety technology, it must be ensured that when updating an operating system, a version of an operating software update suitable for the respective device is also used within the scope of the update. Installation of an incorrect version of an operating software update or an operating software update that is not suitable for the respective device on the respective device must be avoided in any case.

[0006] In order to ensure this, EP 1 532 494 B1 also discloses a method for running a new operating system on a safety controller and a corresponding operating program, wherein the user, rather than the manufacturer, independently runs the new operating program, i.e., new firmware, on the existing safety controller. The manufacturer retains control via the safety device with the aid of special permission information, because the takeover of the new operating program can only be performed when the takeover is permitted in the permission information on the manufacturer side. Therefore, it is possible to check whether the new operating program is a version suitable for the corresponding safety controller with the aid of the method disclosed in EP 1 532 494 B1.

[0007] US 2015 / 0050678 A1 discloses an analytical measuring device having a housing and an analytical module that can be electrically and mechanically connected to the housing. The analytical module has a memory in which firmware updates for different measuring devices can be stored. The analytical module can be detachably connected to the housings of the different analytical measuring devices in order to transfer the corresponding firmware updates to the corresponding housings. Summary of the invention

[0008] The object of the present invention is to provide a system comprising a security-oriented device and an electronic storage device separate therefrom, as well as a method in which data content for the device, in particular operating software updates, can be transmitted to the device in an alternative, simplified and improved manner in comparison with the prior art in a version suitable for the device.

[0009] As already mentioned at the outset, within the scope of the present invention, a safety-oriented or safety-related device is preferably a safety-oriented input / output module or a safety-oriented control device, which generates safety-related input signals and / or generates safety-related output signals or reacts to safety-related input signals in order to perform safety-related control functions in the field of functional safety. Functional safety is described, for example, in the technical handbook "Functional Safety of Machinery and Equipment, Implementation of the European Machinery Directive in Practice" by Patrick Gehlen, published by the publisher Publi cis Publishing, 2nd edition 2010 (Funktionale Sicherheit von Maschinen und Anlagen, Umsetzung der The method is described in detail in Maschinenrichtl in der Praxis, 2. Überarbeitete Auflage, 2010, Published by Publishers Verlag).

[0010] The object of the invention is achieved by the features of claim 1 and is designed and improved by the features of the dependent claims.

[0011] Therefore, a system is provided, which comprises a security-oriented device and an electronic storage device separated therefrom, in which exactly one data content for the device is stored. The exactly one data content is an operating software update or an address. The address is preferably a secure address. The electronic storage device has a first connection device for mechanical and electrical coupling with the security-oriented device, wherein the first connection device comprises a first mechanical coding mechanism. The security-oriented device has a storage device in which an operating system is stored, a microcontroller and a second connection device for mechanical and electrical coupling with the electronic storage device, wherein the second connection device comprises a second mechanical coding mechanism. The first mechanical coding mechanism and the second mechanical coding mechanism are constructed to complement each other. The microcontroller of the device is constructed to identify whether the electronic storage device is connected to the second connection device of the device via its first connection device. If this is the case, the microcontroller is also constructed to download exactly one data content stored in the electronic storage device from the electronic storage device to the storage device of the device.

[0012] In the scope of the present invention, a safety-oriented device, in particular a safety-oriented input / output module or a safety-oriented control device, in particular with a firmware or operating system, which needs to be updated from time to time. In addition, a safety-oriented device can also be, for example, a laser scanner, a frequency converter or a light barrier.

[0013] In contrast to the prior art, an electronic storage device is used for updating the operating system, on which only exactly one data content is stored, which data content is either an operating software update or an address. If exactly one data content is an address, this address is downloaded once to the storage device of the device for enabling the security-oriented device to communicate, for example, with other devices in the network infrastructure. In other words: With the help of this address, the security-oriented device can be addressed in a targeted manner by other devices. If exactly one data content is an operating software update, this operating software update always corresponds to a specific version that is suitable and designed for the device. Since only one data content and thus only one operating software update is stored on the electronic storage device and a mechanical coding mechanism is used, it is possible to avoid, in contrast to electronic storage devices that, for example, store multiple operating software update versions, erroneous transmission of an incorrect version of the operating software update from the electronic storage device to the device (for example due to confusion or even intentional) can be avoided.

[0014] Furthermore, the system provides that the first connection device of the electronic storage device comprises a first mechanical coding mechanism, and the second connection device of the safety-oriented device comprises a second mechanical coding mechanism, wherein the first and second mechanical coding mechanisms are designed to complement each other. This has the advantage that the electrical coupling of the electronic storage device to the device and thus the transfer of exactly one data content from the electronic storage device to the device is achieved, in particular only when the first and second mechanical coding mechanisms are correspondingly constructed to complement each other and the electronic storage device is therefore correctly coupled to the device mechanically via their corresponding mechanical coding mechanisms. Correct mechanical coupling means that the first mechanical coding mechanism is mechanically coupled to the second mechanical coding mechanism in a manner provided and envisaged for this purpose, and in particular, the first mechanical coding mechanism is not forcibly coupled to the second mechanical coding mechanism in a manner contrary to that intended and envisaged. In other words: the mechanical coding mechanism ensures that only electronic storage devices that exactly belong to or match the respective device can be connected to the device.

[0015] By combining precisely one data content stored on the electronic storage device with the mechanical coding according to the invention, it can be ensured in a simple manner that not only the correct version of the operating software update but also the version suitable for the device can be transferred from the electronic storage device to the device. Thus, for example, the identifiability of the device can be ensured by the mechanical coding, so that only operating software updates suitable for the operating system of the device are always stored on the electronic storage device. By storing only a single data content and therefore in particular only a single operating software update on the device, it can also be ensured that this operating software update is also available in the correct version for the device.

[0016] The microcontroller of the device is provided and constructed for controlling and monitoring the device. For the transmission of data content from the electronic storage device to the device, the microcontroller only needs to be provided and constructed to recognize whether the electronic storage device is connected to the second connection device of the device. If this is the case, the microcontroller must be provided and constructed to download the data content stored on the electronic storage device to the storage device of the device. Therefore, for example, it is not necessary to automatically check by the microcontroller whether the data content and in particular the operating software update are correct and suitable data content or correct and suitable for the operating software update of the device. Since the microcontroller does not need to be constructed in a complex manner in terms of transmitting data content, in particular the operating software update, this reduces the cost of the microcontroller and thus reduces the cost of the device.

[0017] In the system of electronic memory devices and devices according to the invention, the process of downloading operating software updates runs automatically without having to check license information or activation codes, for example as in EP 1 532 494 B1, or without the user having to specify which operating software update should be downloaded. The system of electronic memory devices and devices is therefore less complex and therefore less cost-effective than the prior art described at the outset and is also less prone to errors, which is an important aspect, in particular with regard to functional safety.

[0018] The device preferably has a sensor which is designed to detect whether the electronic memory device is correctly mechanically coupled to the device.

[0019] In one embodiment of the present invention, the sensor of the device is a touch sensor configured to send an electrical signal to the microcontroller indicating that the electronic storage device is properly mechanically coupled to the device. Once the microcontroller receives a signal from the touch sensor that there is a proper mechanical coupling between the electronic storage device and the device, the microcontroller downloads exactly one data content stored in the electronic storage device to the storage device of the device.

[0020] The touch sensor can also display, for example, a light signal or a triggering sound signal, which indicates whether the electronic storage device is correctly mechanically coupled to the device. For example, an LED electrically coupled to the touch sensor can display a green light when there is a correct mechanical coupling between the electronic storage device and the device, and display a red light when there is no correct mechanical coupling between the electronic storage device and the device. This can indicate to the user in advance that the transmission of exactly one data content for the device from the electronic storage device to the device cannot be determined due to the lack of correct mechanical coupling between the electronic storage device and the device.

[0021] In one embodiment of the invention, the first mechanical coding mechanism has a defined first mechanical configuration, and the second mechanical coding mechanism has a defined second mechanical configuration, which is complementary to the defined first mechanical configuration. The first and second defined mechanical configurations can be constructed as any geometric shape. Thus, for example, it can be a groove or multiple grooves or a distinct grid or pattern on at least a part of the surface of the electronic storage device or device facing the device or the electronic storage device when the electronic storage device is electrically and mechanically coupled to the device. The first and second defined mechanical configurations can also take the form of one or more elements protruding from the electronic storage device or the surface of the device, such as pins, blocks, prisms, etc., or a corresponding recess or a combination of protruding elements and recesses that are shaped complementary thereto.

[0022] According to an advantageous development of the invention, the electronic memory device can store a data content identifier which indicates whether a data content stored in the electronic memory device is an operating software update or an address for a security-oriented device. For this purpose, the microcontroller can be designed to first read out and interpret the data content identifier from the electronic memory device when the electronic memory device is connected to the second connection device of the device via its first connection device, and then download the operating software update or the address to the memory device based on the interpreted data content identifier and preferably start it there.

[0023] The addresses are used for the communication of the safety-oriented device, for example with other input / output modules in the network infrastructure, and are downloaded once by the microcontroller into the memory device of the device.

[0024] In addition, the present invention also relates to a method for transmitting exactly one data content from an electronic storage device to a safety-oriented device within the system of the present invention as described above. First, within the scope of the method according to the present invention, the device is separated from the voltage source. In the voltage-free or current-free state of the device, the first connection device of the electronic storage device is electrically and mechanically coupled to the second connection device of the device, wherein the electrical coupling is only performed when the first coding mechanism is correctly mechanically coupled to the second coding mechanism. After the device is connected to the voltage source, the microcontroller of the device preferably recognizes when the device is started whether the electronic storage device is connected to the second connection device of the device. If this is the case, the microcontroller downloads exactly one data content stored in the electronic storage device from the electronic storage device to the storage device of the device. Subsequently, the electronic storage device is electrically and mechanically decoupled from the device.

[0025] Preferably, in the above method, the microcontroller can also identify whether the electronic storage device is connected to the device for the first time. If this is the case, the microcontroller interprets exactly one data content of the electronic storage device as an address. However, if this is not the case, the microcontroller interprets exactly one data content of the electronic storage device as an operating software update.

[0026] For this purpose, the electronic storage device can store a data content identifier which indicates whether exactly one data content stored in the electronic storage device is an operating software update or an address for a security-oriented device, wherein before exactly one data content stored in the electronic storage device is downloaded from the electronic storage device to a storage device of the device, the data content identifier is read from the electronic storage device and interpreted by the microcontroller, wherein subsequently, in particular under the control of the microcontroller, the operating software update or the address is downloaded to the storage device as a function of the interpreted data content identifier and preferably also started there. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention is described in detail below based on some embodiments in conjunction with the accompanying drawings.

[0028] Out:

[0029] Figure 1 An exemplary system consisting of an electronic storage device and a security-oriented device according to a first embodiment is shown.

[0030] Figure 2 An exemplary system consisting of an electronic storage device and a security-oriented device according to a second embodiment is shown.

[0031] Figure 3 An exemplary system consisting of an electronic storage device and a security-oriented device according to a third embodiment is shown, and

[0032] Figure 4 An exemplary system consisting of an electronic storage device and a security-oriented device according to a fourth embodiment is shown. DETAILED DESCRIPTION

[0033] Figure 1 The diagrammatic representation, not to scale, shows a security-oriented device 1 and an electronic storage device 2 separated therefrom ( Figure 1 In the first embodiment of the system (top), the safety-oriented device in the illustrated case is, by way of example, a safety-oriented input / output module ( Figure 1 According to an exemplary embodiment, a first data content, preferably exactly one data content, is stored in the electronic memory device 2, which first data content is for the safety-oriented input / output module 1 (in Figure 1), wherein exactly one data content is an operating software update or an address for an input / output module 1 .

[0034] Figure 1 The electronic storage device 2 has a first connection device 3 for mechanically and electrically coupling with the input / output module 1, and Figure 1 The input / output module 1 shown in FIG. 1 has a second connection device 5 for mechanically and electrically coupling to the electronic storage device 2 at its first connection device 3. For the electrical coupling, both the first connection device 3 of the electronic storage device 2 and the second connection device 5 of the input / output module are connected at Figure 1 In the embodiment shown in FIG, electrical interfaces 9a and 9b are respectively provided, so that the electronic storage device 2 can be electrically coupled to the electrical interface 9b of the input / output module 1 via its electrical interface 9a. For mechanical coupling, the first connection device 3 of the electronic storage device 2 includes a first mechanical coding mechanism 4, and the second connection device 5 of the input / output module 1 includes a second mechanical coding mechanism 6, which is constructed complementary to the first mechanical coding mechanism 4.

[0035] The first mechanical encoding mechanism 4 of the electronic memory device 2 preferably has a defined first mechanical configuration 7. Figure 1 In the embodiment, the defined first mechanical configuration 7 of the first mechanical coding mechanism 4 consists of two elements, namely two blocks, which protrude from the surface of the electronic storage device 2 facing the input / output module 1 when the electronic storage device 2 is electrically and mechanically coupled to the input / output module 1. However, various other geometric shapes can also be considered, and the number of protruding elements can also arbitrarily start from one protruding element. Instead of the protruding element, a recess constructed complementary thereto can also be constructed on the electronic storage device 2, or a combination of a protruding element and a recess can also be constructed as the defined first mechanical configuration 7. The second mechanical coding mechanism 6 of the input / output module 1 preferably has a defined second mechanical configuration 8, which is constructed complementary to the defined first mechanical configuration 7 of the first mechanical coding mechanism 4. In Figure 1 In the example shown in , the defined second mechanical configuration 8 of the second mechanical encoding mechanism 6 consists of two square recesses 7. These square recesses 7 are constructed on the surface of the input / output module 1 facing the electronic storage device 2 when the electronic storage device 2 is electrically and mechanically coupled to the input / output module 1, so that these square recesses basically completely accommodate the two protruding blocks 7 of the first mechanical encoding mechanism 4 of the electronic storage device 2.

[0036] Figure 1The safety-oriented input / output module 1 shown in also comprises an interface 12, which is used to connect, for example, field devices (not shown), such as actuators or sensors. In this case, the sensor is particularly designed to generate safety-related input signals, and the actuator is particularly designed to generate safety-related output signals. The safety-related input signal can, for example, indicate that an emergency stop button has been actuated, while the safety-related output signal generated by the actuator can, for example, shut down a motor. In addition, the input / output module 1 comprises a microcontroller 10 for controlling and monitoring the input / output module 1, and a memory device 11, in which an operating system is stored and which is electrically coupled to the microcontroller 10. In Figure 1 In the embodiment shown in , the input / output module 1 advantageously also has a sensor 13, which is electrically coupled to the second mechanical coding mechanism 6 and preferably to the microcontroller 10 and is advantageously configured as a touch sensor 13. The touch sensor 13 is particularly configured to send an electrical signal to the microcontroller 10 in a state of electrical and mechanical coupling (not shown) of the electronic storage device 2 to the input / output module 1, which electrical signal indicates that the electronic storage device 2 is correctly mechanically coupled to the input / output module 1. Correct mechanical coupling means that the first mechanical coding mechanism 4 is mechanically coupled to the second mechanical coding mechanism 6 in a manner provided and envisaged therefor, and in particular, that the first mechanical coding mechanism 4 is not forcibly inserted into the second mechanical coding mechanism 6 in a manner that is contrary to the intended use (e.g., breaking off at least one protruding block). The microcontroller 10, the storage device 11 and the touch sensor 13 are arranged in a manner that is not incompatible with the intended use (e.g., breaking off at least one protruding block). Figure 1 are shown with dashed lines because they are Figure 1 1 is located inside the input / output module 1 and is not visible from the external view of the input / output module 1 shown.

[0037] According to an advantageous improvement, the safety-oriented device 1 can also be constructed as multi-channel, for example dual-channel. In this case, the input / output module 1 includes at least one further microcontroller 15 and a further storage device 16, which controls and monitors the input / output module 1, in which an operating system is stored and which is electrically coupled to the microcontroller 15. It should be noted that the microcontroller 10 and the microcontroller 15 can be different. For example, they come from different manufacturers. The touch sensor 13 is particularly constructed to send an electrical signal to the microcontroller 15 even in a state where the electronic storage device 2 is electrically and mechanically coupled to the input / output module 1 (not shown), which electrical signal indicates that the electronic storage device 2 is correctly mechanically coupled to the input / output module 1. The microcontroller 15 and the storage device 16 are in a state where the electronic storage device 2 is electrically and mechanically coupled to the input / output module 1. Figure 1 are shown with dashed lines because they are Figure 1The electronic storage device 2 is located inside the input / output module 1 and is not visible from the external view of the input / output module 1 shown. According to this exemplary embodiment, the electronic storage device 2 stores the input / output module 1 ( Figure 1 The second data content is the address of the operating software update or the input / output module 1, which can be the same as the address represented by the first data content. It should be noted that the two storage devices 11 and 16 respectively form a physical memory or can be implemented by a common memory in which the two storage devices respectively form a storage area.

[0038] The operating principle of the system consisting of a safety-oriented input / output module 1 and an electronic memory device 2 according to a first exemplary embodiment will be described in more detail below. Exactly one data content of the safety-oriented input / output module 2 is stored in the electronic memory device 2, which data content is transferred from the electronic memory device 2 to the storage device 11 of the input / output module 2 as follows. First, the input / output module 2 is disconnected from a voltage source, which is not shown in the drawing. Subsequently, the electronic memory device 2 is electrically and mechanically coupled to the second connection device 5 of the input / output module 1 via its first connection device 3. However, the electrical coupling is only achieved if the first mechanical coding mechanism 4 and the second mechanical coding mechanism 6, which is designed complementary thereto, are correctly mechanically coupled, which electrical coupling is achieved in the following manner: Figure 1 In the exemplary embodiment of the present invention, this is achieved by coupling the electrical interface 9a of the electronic storage device 2 with the electrical interface 9b of the input / output module 1, but this is not shown in detail. If the input / output module 1 preferably comprises a sensor 13, in particular a touch sensor 13, the touch sensor detects whether a correct mechanical coupling exists. If this is the case, the touch sensor 13 sends a corresponding signal to the microcontroller 10 and advantageously also to an LED display 14 mounted on the input / output module 1, which then displays green light. However, if there is no correct mechanical coupling, the touch sensor 13 also signals the microcontroller 10 and the LED display 14. Subsequently, the LED display 14 displays red light and the microcontroller 10 does not take further steps with respect to the electronic storage device 2. Therefore, when an incorrect mechanical coupling is reported by the touch sensor 13, the microcontroller 10 does not download exactly one data content stored in the electronic storage device 2 to the storage device 11 of the input / output module 1.

[0039] After successful mechanical and electrical coupling, the input / output module 1 is connected to a voltage source. The microcontroller 10 of the input / output module 1 preferably already detects during uploading whether the electronic memory device 2 is connected to the second connection device 5 of the input / output module 1 via its first connection device 3. If this is the case, the microcontroller 10 downloads exactly one data content stored in the electronic memory device 2 from the electronic memory device 2 to the memory device 11 of the input / output module 1. Preferably, the microcontroller 10 also detects whether the electronic memory device 2 is connected to the input / output module 1 for the first time. If this is the case, the microcontroller 10 interprets exactly one data content of the electronic memory device 2 as an address, which is used for the communication of the input / output module 1, for example, with other input / output modules in the network infrastructure, and downloads this address to the memory device 11 of the input / output module 1. However, if the electronic memory device 2 is not connected to the input / output module 1 for the first time, the microcontroller 10 interprets exactly one data content of the electronic memory device 2 as an operating software update, downloads the operating software update to the memory device 11 of the input / output module 1, and in particular starts the operating software update in order to update the operating system stored in the memory device 11. Finally, the electronic memory device 2 is electrically and mechanically decoupled from the input / output module 1 and is thus removed from the input / output module 1.

[0040] According to an advantageous embodiment, a data content identifier can be stored in the electronic memory device 2, 2', 2", 2'"', which indicates whether exactly one data content stored in the electronic memory device 2, 2', 2", 2'" is an operating software update or an address for the safety-oriented device 1, 1', 1", 1'"'. In this regard, the microcontroller 10 can be designed to first read and interpret the data content identifier from the electronic memory device 2, 2', 2", 2'"', when the electronic memory device 2, 2', 2", 2'" is connected to the second connection device 5, 5', 5", 5'"' of the safety-oriented device 1, 1', 1", 1'" via its first connection device 3, 3', 3", 3'" and then download the operating software update or the address to the memory device 11 based on the interpreted data content identifier and then start it if necessary. The microcontroller 10 knows the location where the data content identifier is stored in the electronic memory device. In practice, this is advantageously done in such a way that, when the safety-oriented device is used for the first time, an electronic memory device is first connected in which addresses, in particular secure addresses, are stored as data contents for the safety-oriented device. Subsequently, i.e. during operation, operating software updates can usually be downloaded to the safety-oriented device using the electronic memory device and started there.

[0041] In order to be able to perform the downloading of operating software updates efficiently and energy-savingly, the electronic memory device 2, 2', 2", 2'" can additionally store an operating software update identifier if exactly one of the data contents is an operating software update. The operating software update identifier can be, for example, a checksum which is formed by the operating software update and is stored together with it in the electronic memory device 2. The microcontroller 10 can be designed for

[0042] i) reading the operating software update identifier from the electronic storage device after reading and interpreting the data content identifier,

[0043] ii) In response to the read operating software update identification, a check is made as to whether the relevant operating software update is stored in the storage device, and only if the relevant operating software update is not stored in the storage device 11, exactly one data content is downloaded to the storage device. For this purpose, an identification, for example a checksum of the operating software update stored in the electronic storage device, can also be stored in the microcontroller 10, and the microcontroller 10 then compares this identification with the read operating software update identification. If no operating software update has been downloaded to the storage device 11 at all, then no update identification has been stored in the safety-oriented device either. If the microcontroller 10 determines that the read operating software update identification and the identification stored in the storage device 11 are inconsistent, it causes the operating software update to be downloaded from the electronic storage device and stored in the storage device 11 together with the operating software update identification. The inconsistency detected by the microcontroller 10 is, for example, due to the fact that no operating software update has been downloaded to the safety-oriented device at all. It should also be noted that the microcontroller 10 can use the operating software update identification as a starting address at which exactly one data content is found in the electronic storage device. If a file directory structure is used on the electronic storage device, the file name can also be used as the operating software update identifier, and the microcontroller 10 can find exactly one data content through the file name.

[0044] The mode of operation of the system consisting of the safety-oriented input / output module 1 and the electronic memory device 2 is explained in greater detail below according to an advantageous development, according to which the safety-oriented device 1 is of dual-channel design.

[0045] The electronic memory device 2 stores first and second data contents for the safety-oriented input / output module 2, which may be operating system updates or addresses, respectively. The first and second data contents are transferred from the electronic memory device 2 to the storage device 11 or storage device 16 of the input / output module 1 in the following manner. First, the input / output module 1 is disconnected from a voltage source, which is not shown in the drawing. The electronic memory device 2 is then electrically and mechanically coupled to the second connection device 5 of the input / output module 1 via its first connection device 3. However, the electrical coupling only takes place if the first mechanical coding mechanism 4 and the second mechanical coding mechanism 6, which is constructed complementary thereto, are correctly mechanically coupled, and this electrical coupling is performed in the following manner: Figure 1 In the exemplary embodiment of the present invention, this is achieved by coupling the electrical interface 9a of the electronic storage device 2 with the electrical interface 9b of the input / output module 1, but this is not shown in detail. If the input / output module 1 preferably includes a sensor 13, in particular a touch sensor, the touch sensor detects whether a correct mechanical coupling exists. If a correct mechanical coupling exists, the touch sensor 13 sends a corresponding signal to the microcontroller 10 and the microcontroller 15 and advantageously also to the LED display 14 installed on the input / output module 1, which then displays green light. However, if there is no correct mechanical coupling, the touch sensor 13 also informs the microcontroller 10 and the microcontroller 15 and the LED display 14 with a signal. Subsequently, the LED display 14 displays red light and the microcontroller 10 does not take any further steps with respect to the electronic storage device 2. When the touch sensor 13 reports an incorrect mechanical coupling, the microcontroller 10 therefore in particular does not download the first data content stored in the electronic memory device 2 to the memory device 11 of the input / output module 1, and the microcontroller 15 therefore in particular does not download the second data content stored in the electronic memory device 2 to the memory device 16 of the input / output module 1.

[0046] After successful mechanical and electrical coupling, the input / output module 1 is connected to a voltage source. The microcontrollers 10 and 15 of the input / output module 1 preferably already recognize during uploading whether the electronic memory device 2 is connected via its first connection device 3 to the second connection device 5 of the input / output module 1. If this is the case, the microcontroller 10 downloads the first data content stored in the electronic memory device 2 from the electronic memory device 2 to the storage device 11 of the input / output module 1, and the microcontroller 15 downloads the second data content stored in the electronic memory device 2 from the electronic memory device 2 to the storage device 16 of the input / output module 1.

[0047] Since the electronic memory device 2, the operating software update or the address memory device can be used, a data content identifier can be stored in the electronic memory device 2, which indicates that the first data content and the second data content stored in the electronic memory device 2 are respectively an operating software update or respectively an address for the safety-oriented device 1. The first microcontroller 10 can be designed to first read and interpret the data content identifier from the electronic memory device 2 when the electronic memory device 2 is connected to the second connection device 5 of the input / output module 1 via its first connection device 3, 3', 3", 3'" and then download the corresponding operating software update or the corresponding address to the first memory device 11 according to the interpreted data content identifier, wherein the second microcontroller 15 can be designed to first read and interpret the data content identifier from the electronic memory device 2 when the electronic memory device 2 is connected to the second connection device 5 of the input / output module 1 via its first connection device 3 and then download the corresponding operating software update or the corresponding address to the second memory device 16 according to the interpreted data content identifier.

[0048] In order to be able to perform operating software updates efficiently and energy-savingly, if the first data content and the second data content are operating software updates, respectively, a first operating software update identifier corresponding to the first data content and a second operating software update identifier corresponding to the second data content may also be stored in the electronic storage device 2. The first operating software update identifier and the second operating software update identifier may, for example, be checksums, respectively, which are formed by the first operating software update or the second operating software update. The first operating software update identifier and the second operating software update identifier are stored in the electronic storage device 2 together with the first data content and the second data content, wherein there is a logical or physical association between the first operating software update identifier and the first data content and between the second operating software update identifier and the second data content. In this case, the first microcontroller 10 may be constructed to,

[0049] i) after reading and interpreting the data content identifier, reading a first operating software update identifier from the electronic storage device,

[0050] ii) in response to the read first operating software update identification, checking whether the relevant first operating software update is stored in the storage device 11, and only if the relevant first operating software update is not stored in the storage device 11, downloading the first data content to the first storage device 11. In a similar manner, the second microcontroller 15 can be configured to:

[0051] i) after reading and interpreting the data content identifier, reading the second operating software update identifier from the electronic storage device,

[0052] ii) in response to the read second operating software update identifier, checking whether the relevant second operating software update is stored in the storage device 16, and only if the relevant second operating software update is not stored in the storage device 16, downloading the second data content to the second storage device 16. It should be noted that the microcontroller 10 can use the first operating software update identifier as a starting address for finding the first data content in the electronic storage device. If a file directory structure is used on the electronic storage device 2, the file name can also be used as the first operating software update identifier, and the microcontroller 10 can find the first data content with the file name. Similarly, according to an embodiment, the microcontroller 15 can use the second operating software update identifier as a starting address for finding the second data content in the electronic storage device. If a file directory structure is used on the electronic storage device 2, the file name can also be used as the second operating software update identifier, and the microcontroller 15 can find the second data content with the file name.

[0053] Attached Figure 2 , 3 and 4 with Figure 1 The difference is essentially that the first mechanical coding mechanism 4', 4", 4"' of the first connecting device 3', 3", 3"' of the respectively shown electronic memory device 2', 2", 2"' and the second mechanical coding mechanism 6', 6", 6"' of the second connecting device 5', 5", 5"' of the respectively shown safety-oriented input / output module 1', 1", 1"' have the same Figure 1 Different defined first mechanical configurations 7', 7", 7'" and defined second mechanical configurations 8', 8", 8'" are shown.

[0054] exist Figure 2 In the embodiment, the first mechanical coding mechanism 4' ( Figure 2 The electronic storage device 2' has a first mechanical configuration 7' ​​which is preferably defined by two specially structured areas, in particular provided with grooves, on the surface of the electronic storage device 2'. The number and arrangement of the specially structured areas can vary. When the electronic storage device 2' is electrically and mechanically coupled to the input / output module 1', special structures such as grooves, wavy structures, comb-like structures and more can be provided on the entire surface of the storage device 2' facing the input / output module 1'. Different types of structuring can also serve as the defined first mechanical configuration 7'. The second mechanical coding mechanism 6' ( Figure 2 The lower part) accordingly has a defined second mechanical configuration 8 ′ which is designed complementary to the defined first mechanical configuration 7 ′.

[0055] exist Figure 3In the electronic storage device 2″, the first mechanical encoding mechanism 4 of the first connecting device 3″ ( Figure 3 The electronic storage device 2" preferably has a defined first mechanical configuration 7", which consists of two protruding elements, more precisely two blocks, but the two protruding elements are arranged on the electrical interface 9a. As an alternative to the blocks, various other geometric shapes can also be considered. In addition, starting from one protruding element, the number of protruding elements can be arbitrary. Instead of a protruding element, a recess constructed complementary thereto, or a combination of a protruding element and a recess can also be constructed in the electronic storage device 2" as a defined first mechanical configuration 7". The second mechanical coding mechanism 6" of the second connecting device 5" of the input / output module 1" ( Figure 3 The lower part) has a defined second mechanical configuration 8" which is constructed complementary to the defined first mechanical configuration 7", more precisely in Figure 3 In the form of two square recesses at the electrical interface 9b.

[0056] exist Figure 4 In the electronic storage device 2″′, the first mechanical coding mechanism 4″′ of the first connecting device 3″′ ( Figure 4 The upper part) preferably has a defined first mechanical configuration 7"', which consists of protruding elements in the form of prisms. The second mechanical coding mechanism 6"' ( Figure 4 At the bottom) there is a defined second mechanical formation 8'' which is designed complementary to the defined first mechanical formation 7'', more precisely in the form of a prismatic recess.

[0057] Even in the attached Figure 2 , 3 , 4, the safety-oriented input / output modules 1', 1", 1"' shown respectively also have at least a microcontroller 10, a storage device 11 and an interface 12 for connecting safety-oriented devices, such as sensors or actuators. Similarly, the corresponding safety-oriented input / output modules 1', 1", 1"' are Figure 2 , 3 , 4 preferably have a sensor 13 coupled to the second mechanical encoding mechanism 6', 6", 6"' and preferably also electrically coupled to the microcontroller 10, which sensor 13 is advantageously coupled to the LED display 14 of the input / output module 1', 1", 1"' and is constructed as a touch sensor 13.

[0058] Alternative Figures 1 to 4 The safety-oriented input / output modules 1 , 1 ′, 1 ″, 1 ′″ shown by way of example in FIG. 1 can use, in particular, safety-oriented controllers or, for example, laser scanners, frequency converters or light barriers as safety-oriented devices.

[0059] Some exemplary aspects are summarized again below.

[0060] A system is provided, comprising: a safety-oriented device 1, 1', 1", 1"' having at least a first microcontroller 10 and a second microcontroller 15, and an electronic storage device 2, 2', 2", 2"' separate from the safety-oriented device, in which first data content and second data content for the safety-oriented device 1, 1', 1", 1"' are stored. The first data content and the second data content can each be an operating software update or each be an address. The electronic storage device 2, 2', 2", 2"' can include a first connecting device 3, 3', 3", 3"' for mechanical and electrical coupling to the device 1, 1', 1", 1"', wherein the first connecting device 3, 3', 3", 3"' has a first mechanical coding mechanism 4, 4', 4", 4"'. The safety-oriented device 1, 1', 1", 1"' can include a first memory device 11 corresponding to a first microcontroller 10, a second memory device 16 corresponding to a second microcontroller 15 and a second connecting device 5, 5', 5", 5"' for mechanically and electrically coupling to an electronic memory device 2, 2', 2", 2"', wherein a first operating system is stored in the first memory device 11 and a second operating system is stored in the second memory device 16, and the second connecting device 5, 5', 5", 5"' has a second mechanical coding mechanism 6, 6', 6", 6"', wherein the first mechanical coding mechanism 4, 4', 4", 4"' and the second mechanical coding mechanism 6, 6', 6", 6"' are constructed to complement each other. The first microcontroller 10 of the security-oriented device 1, 1', 1", 1"' can be designed to recognize whether the electronic memory device 2, 2', 2", 2"' is connected to the second connection device 5, 5', 5", 5"' of the security-oriented device 1, 1', 1", 1"' via its first connection device 3, 3', 3", 3"'. In this case, the first microcontroller 10 can also be designed to download the first data content stored in the electronic memory device 2, 2', 2", 2"' from the electronic memory device 2, 2', 2", 2"' to the first memory device 11 of the device 1, 1', 1", 1"', and wherein the second microcontroller 15 of the security-oriented device 1, 1', 1", 1"' can be designed to recognize whether the electronic memory device 2, 2', 2", 2"' is connected to the second connection device 5, 5', 5", 5"' of the device 1, 1', 1", 1"' via its first connection device 3, 3', 3", 3"'. In this case, second microcontroller 15 can also be designed to download second data contents stored in electronic memory device 2 , 2 ′, 2 ″, 2 ′″ from electronic memory device 2 , 2 ′, 2 ″, 2 ′″ into second memory device 16 of device 1 , 1 ′, 1 ″, 1 ′″.

[0061] The safety-oriented device 1 , 1 ′, 1 ″, 1 ′″ is preferably designed as a multi-channel device.

[0062] Preferably, the electronic memory device 2, 2', 2", 2'" can store a data content identifier, which indicates whether the first data content and the second data content stored in the electronic memory device 2, 2', 2", 2'" are respectively operating software updates or respectively addresses for the safety-oriented device 1, 1', 1", 1'". The first microcontroller 10 can be designed to first read and interpret the data content identifier from the electronic memory device 2, 2', 2", 2'" when the electronic memory device 2, 2', 2", 2'" is connected to the second connecting device 5, 5', 5", 5'" of the safety-oriented device 1, 1', 1", 1'" via its first connecting device 3, 3', 3", 3', and then download the corresponding operating software update or the corresponding address into the first memory device 11 based on the interpreted data content identifier. In a similar manner, the second microcontroller 15 can be designed to first read and interpret the data content identifier from the electronic memory device 2, 2', 2", 2'" when the electronic memory device (2, 2', 2", 2'") is connected to the second connecting device 5, 5', 5", 5'" of the device 1, 1', 1", 1'" via its first connecting device 3, 3', 3", 3'" and then download the corresponding operating software update or the corresponding address to the second memory device 16 based on the interpreted data content identifier.

[0063] If the first data content and the second data content are respectively operating software updates, then preferably the electronic storage device 2, 2', 2", 2'" can store a first operating software update identifier corresponding to the first data content and a second operating software update identifier corresponding to the second data content. The first microcontroller 10 can then be configured to:

[0064] i) after reading and interpreting the data content identifier, reading a first operating software update identifier from the electronic storage device,

[0065] ii) in response to the read first operating software update identification, checking whether the relevant first operating software update is stored in the storage device 11, and only if the relevant first operating software update is not stored in the storage device 11, downloading the first data content to the first storage device 11. The second microcontroller 15 can be configured to:

[0066] i) after reading and interpreting the data content identifier, reading the second operating software update identifier from the electronic storage device,

[0067] ii) in response to the read second operating software update identification, checking whether the relevant second operating software update is stored in the storage device 16, and only if the relevant second operating software update is not stored in said storage device 16, downloading the second data content to the second storage device 16.

[0068] Description of Reference Numerals

[0069] 1, 1', 1", 1'": Safety-oriented input / output module as an example of a safety-oriented device

[0070] 2, 2', 2", 2'": Electronic storage devices

[0071] 3, 3', 3", 3'": First connection device

[0072] 4, 4', 4", 4'": The first mechanical coding mechanism

[0073] 5, 5', 5", 5'": Second connection device

[0074] 6, 6', 6", 6'": Second mechanical coding mechanism

[0075] 7, 7', 7", 7'": defined first mechanical configuration

[0076] 8, 8', 8", 8'": defined second mechanical configuration

[0077] 9a, 9b: Electrical interfaces for storage media and input / output modules

[0078] 10: Microcontroller

[0079] 11: Storage device

[0080] 12: Interface to field devices

[0081] 13: Sensor

[0082] 14: LED display

[0083] 15: Microcontroller

[0084] 16: Storage device

Claims

1. A system comprising a security-oriented device (1, 1', 1", 1'") and an electronic storage device (2, 2', 2", 2'") separate from the device, in which only exactly one data content for the security-oriented device (1, 1', 1", 1'") is stored, wherein The exactly one data content is an operating software update or an address, wherein the electronic storage device (2, 2', 2", 2'") comprises a first connection device (3, 3', 3", 3'") for mechanically and electrically coupling to the safety-oriented device (1, 1', 1", 1'"), wherein the first connection device (3, 3', 3", 3'") has a first mechanical coding mechanism (4, 4', 4", 4'"), and wherein the safety-oriented device (1, 1', 1", 1'") has a storage device ( 11), a microcontroller (10) and a second connection device (5, 5', 5", 5'") for mechanically and electrically coupling to an electronic memory device (2, 2', 2", 2'"), in which an operating system is stored, wherein the second connection device (5, 5', 5", 5'") has a second mechanical coding mechanism (6, 6', 6", 6'"), wherein the first mechanical coding mechanism (4, 4', 4", 4'") and the second mechanical coding mechanism (6, 6', 6", 6'") are designed to complement each other, The microcontroller (10) of the safety-oriented device (1, 1', 1", 1"') is designed to recognize whether the electronic storage device (2, 2', 2", 2"') is connected to the second connection device (5, 5', 5", 5"') of the safety-oriented device (1, 1', 1", 1"') via its first connection device (3, 3', 3", 3"') and whether the first connection device (3, 3', 3", 3"') is connected to the second connection device (5, 5', 5", 5"') In this case, the invention is also configured to download exactly one data content stored in the electronic storage device (2, 2', 2", 2'") from the electronic storage device (2, 2', 2", 2'") to the storage device (11) of the security-oriented device (1, 1', 1", 1'") without the microcontroller (10) of the security-oriented device (1, 1', 1", 1'") checking whether the data content is correct and suitable data content for the security-oriented device (1, 1', 1", 1'") 2. The system according to claim 1, characterized in that The exactly one data content is a data content designed as an operating software update.

3. The system according to claim 1, characterized in that The electronic memory device (2, 2', 2", 2'" stores a data content identifier, which indicates whether exactly one data content stored in the electronic memory device (2, 2', 2", 2'" is an operating software update or an address for the safety-oriented device (1, 1', 1", 1'"); the microcontroller (10) is designed to first read and interpret the data content identifier from the electronic memory device (2, 2', 2", 2'") when the electronic memory device (2, 2', 2", 2'") is connected to a second connection device (5, 5', 5", 5'") of the safety-oriented device (1, 1', 1", 1'" via its first connection device (3, 3', 3", 3'"); and then download the operating software update or the address to the memory device (11) of the safety-oriented device (1, 1', 1", 1'" based on the interpreted data content identifier.

4. The system according to claim 3, It is characterized in that If the exactly one data content is an operating software update, the electronic memory device (2, 2', 2", 2'") stores an operating software update identifier, and the microcontroller is designed to: i) reading the operating software update identifier from the electronic storage device after reading and interpreting the data content identifier, ii) in response to the read operating software update identification, checking whether the relevant operating software update is stored in the storage device (11), and only downloading exactly one data content to the storage device if the relevant operating software update is not stored in the storage device.

5. The system according to claim 1, characterized in that The safety-oriented device (1, 1', 1", 1'") has a sensor (13) which is designed to detect whether the electronic storage device (2, 2', 2", 2'") is correctly mechanically coupled to the safety-oriented device (1, 1', 1", 1'").

6. The system according to claim 5, characterized in that The sensor (13) is a touch sensor (13) and is designed to send an electrical signal to the microcontroller (10), which indicates that the electronic storage device (2, 2', 2", 2'") is correctly mechanically coupled to the safety-oriented device (1, 1', 1", 1'").

7. The system according to any one of claims 1 to 6, characterized in that The first mechanical encoding mechanism (4, 4', 4", 4"') has a defined first mechanical configuration (7, 7', 7", 7"'), and the second mechanical encoding mechanism (6, 6', 6", 6"') has a defined second mechanical configuration (8, 8', 8", 8"'), which is complementary to the first defined mechanical configuration (7, 7', 7", 7"').

8. A method including A system comprising a safety-oriented device (1, 1', 1", 1'") designed as a multi-channel device, comprising at least a first microcontroller (10) and a second microcontroller (15), and an electronic storage device (2, 2', 2", 2'") separate from the safety-oriented device, in which first and second data contents for the safety-oriented device (1, 1', 1", 1'") are stored, wherein: The first data content and the second data content are respectively operating software updates or respectively addresses, wherein the electronic storage device (2, 2', 2", 2'") comprises first connecting means (3, 3', 3", 3'") for mechanically and electrically coupling to the safety-oriented device (1, 1', 1", 1'"), wherein the first connecting means (3, 3', 3", 3'") has a first mechanical coding mechanism (4, 4', 4", 4'"), and wherein the safety-oriented device (1, 1', 1", 1'") comprises first storage means (11) corresponding to the first microcontroller (10), which is connected to the first microcontroller (10) and the first microcontroller (10) is connected to the first microcontroller (10). a second memory device (16) corresponding to the second microcontroller (15) and a second connection device (5, 5', 5", 5"') for mechanically and electrically coupling with the electronic memory device (2, 2', 2", 2"'), a first operating system being stored in the first memory device and a second operating system being stored in the second memory device, wherein the second connection device (5, 5', 5", 5"') has a second mechanical coding mechanism (6, 6', 6", 6"'), wherein the first mechanical coding mechanism (4, 4', 4", 4"') and the second mechanical coding mechanism (6, 6', 6", 6"') are constructed to complement each other, The first microcontroller (10) of the safety-oriented device (1, 1', 1", 1"') is designed to recognize whether the electronic storage device (2, 2', 2", 2"') is connected to the second connection device (5, 5', 5", 5"') of the safety-oriented device (1, 1', 1", 1"') via its first connection device (3, 3', 3", 3"') and whether the first connection device (3, 3', 3", 3"') is connected to the second connection device (5, 5', 5", 5"') In the case of a safety-oriented device (1, 1', 1", 1", the first data content stored in the electronic storage device (2, 2', 2", 2"') is downloaded from the electronic storage device (2, 2', 2", 2"') to the first storage device (11) of the safety-oriented device (1, 1', 1", 1"'), without the first microcontroller (10) of the safety-oriented device (1, 1', 1", 1"') verifying whether the data content is correct and suitable data content for the safety-oriented device (1, 1', 1", 1"'), and wherein the second microcontroller (15) of the safety-oriented device (1, 1', 1", 1"') is designed to detect whether the electronic storage device (2, 2', 2", 2"') is connected to the second connecting device (5, 5', 5", 5"') of the safety-oriented device (1, 1', 1", 1"') via its first connecting device (3, 3', 3", 3"') and whether the first connecting device (3, 3', 3", 3"') is connected to the second connecting device (5, 5', 5", 5"') In this case, the second data content stored in the electronic storage device (2, 2', 2", 2'") is downloaded from the electronic storage device (2, 2', 2", 2'") to the second storage device (16) of the safety-oriented device (1, 1', 1", 1'") without the second microcontroller (15) of the safety-oriented device (1, 1', 1", 1'") checking whether the data content is correct and suitable data content for the safety-oriented device (1, 1', 1", 1'") 9. The system according to claim 8, characterized in that The first data content is data content configured as an operating software update, and the second data content is data content configured as an operating software update.

10. The system according to claim 8, characterized in that The electronic storage device (2, 2', 2", 2'" stores a data content identifier, which indicates that the first data content and the second data content stored in the electronic storage device (2, 2', 2", 2'" are respectively operating software updates or respectively addresses for the safety-oriented device (1, 1', 1", 1'"); the first microcontroller (10) is configured to first read and interpret the data content identifier from the electronic storage device (2, 2', 2", 2'") when the electronic storage device (2, 2', 2", 2'") is connected to the second connection device (5, 5', 5", 5'" of the safety-oriented device (1, 1', 1", 1'") via its first connection device (3, 3', 3", 3') and then download the corresponding operating software update or the corresponding address to the first storage device (11) according to the interpreted data content identifier, and The second microcontroller (15) is designed to first read and interpret the data content identifier from the electronic storage device (2, 2', 2", 2'") and then download the corresponding operating software update or the corresponding address to the second storage device (16) when the electronic storage device (2, 2', 2", 2'") is connected to the second connection device (5, 5', 5", 5'") of the safety-oriented device (1, 1', 1", 1'") via its first connection device (3, 3', 3", 3'") 11. The system according to claim 10, It is characterized in that If the first data content and the second data content are operating software updates, respectively, the electronic storage device (2, 2', 2", 2'") stores a first operating software update identifier corresponding to the first data content and a second operating software update identifier corresponding to the second data content, and the first microcontroller (10) is configured to: i) after reading and interpreting the data content identifier, reading a first operating software update identifier from the electronic storage device, ii) in response to the read first operating software update identification, checking whether the relevant first operating software update is stored in the first storage device (11), and only if the relevant first operating software update is not stored in the first storage device (11), downloading the first data content to the first storage device (11), and The second microcontroller (15) is configured to: i) after reading and interpreting the data content identifier, reading the second operating software update identifier from the electronic storage device, ii) in response to the read second operating software update identification, checking whether the relevant second operating software update is stored in the second storage device (16), and only downloading the second data content to the second storage device (16) if the relevant second operating software update is not stored in the second storage device (16).

12. The system according to claim 8, characterized in that The safety-oriented device (1, 1', 1", 1'") has a sensor (13) which is designed to detect whether the electronic storage device (2, 2', 2", 2'") is correctly mechanically coupled to the safety-oriented device (1, 1', 1", 1'").

13. The system according to claim 12, characterized in that The sensor (13) is a touch sensor (13) and is designed to send an electrical signal to the first microcontroller (10), which indicates that the electronic storage device (2, 2', 2", 2'") is correctly mechanically coupled to the safety-oriented device (1, 1', 1", 1'").

14. The system according to claim 13, characterized in that The touch sensor (13) is designed to send an electrical signal to the second microcontroller (15), which indicates that the electronic storage device (2, 2', 2", 2'") is correctly mechanically coupled to the safety-oriented device (1, 1', 1", 1'").

15. The system according to any one of claims 8 to 14, characterized in that The first mechanical encoding mechanism (4, 4', 4", 4"') has a defined first mechanical configuration (7, 7', 7", 7"'), and the second mechanical encoding mechanism (6, 6', 6", 6"') has a defined second mechanical configuration (8, 8', 8", 8"'), which is complementary to the first defined mechanical configuration (7, 7', 7", 7"').

16. A method for transferring exactly one data content from an electronic storage device (2, 2', 2", 2'") to a security-oriented device (1, 1', 1", 1'") within a system according to any of the preceding claims 1 to 4, comprising the following steps: disconnecting the safety-oriented device (1, 1', 1", 1'") from a voltage source, A first connection device (3, 3', 3", 3'") of an electronic storage device (2, 2', 2", 2'") is electrically and mechanically coupled to a second connection device (5, 5', 5", 5'") of the safety-oriented device (1, 1', 1", 1'"), wherein: The electrical coupling is only performed if the first mechanical coding mechanism (4, 4', 4", 4'") is correctly mechanically coupled to the second mechanical coding mechanism (6, 6', 6", 6'"), connecting the safety-oriented device (1, 1', 1", 1'") to the voltage source, A microcontroller (10) of the safety-oriented device (1, 1', 1", 1"') detects whether a first connection device (3, 3', 3", 3"') of the electronic memory device (2, 2', 2", 2"') is connected to a second connection device (5, 5', 5", 5"') of the safety-oriented device (1, 1', 1", 1"') and, if the first connection device (3, 3', 3", 3"') is connected to the second connection device (5, 5', 5", 5"'), downloading exactly one data content stored in the electronic storage device (2, 2', 2", 2'") from the electronic storage device (2, 2', 2", 2'") to the storage device (11) of the security-oriented device (1, 1', 1", 1'") without the microcontroller (10) of the security-oriented device (1, 1', 1", 1'") verifying whether the data content is correct and suitable data content for the security-oriented device (1, 1', 1", 1'"), An electronic memory device (2, 2', 2", 2'") is electrically and mechanically decoupled from the safety-oriented device (1, 1', 1", 1'").

17. The method according to claim 16, characterized in that The exactly one data content is a data content designed as an operating software update.

18. The method according to claim 16, wherein: The electronic storage device (2, 2', 2", 2'") stores a data content identifier, which indicates whether exactly one data content stored in the electronic storage device (2, 2', 2", 2'") is an operating software update or an address for the security-oriented device (1, 1', 1", 1'"), wherein the data content identifier is read from the electronic storage device (2, 2', 2", 2'") and interpreted by the microcontroller (10) before downloading exactly one data content from the electronic storage device (2, 2', 2", 2'") into a storage device (11) of the security-oriented device (1, 1', 1", 1'"), wherein the operating software update or the address is subsequently downloaded to the storage device (11) based on the interpreted data content identifier.

19. A method for transferring data contents from an electronic storage device (2, 2', 2", 2'") to a multi-channel safety-oriented device (1, 1', 1", 1'") in a system according to any one of the preceding claims 8 to 11, comprising the following steps: disconnecting the safety-oriented device (1, 1', 1", 1'") from a voltage source, A first connection device (3, 3', 3", 3'") of an electronic storage device (2, 2', 2", 2'") is electrically and mechanically coupled to a second connection device (5, 5', 5", 5'") of a device (1, 1', 1", 1'"), wherein: The electrical coupling is only performed when the first mechanical coding mechanism (4, 4', 4", 4'") is correctly mechanically coupled to the second mechanical coding mechanism (6, 6', 6", 6'"), connecting the safety-oriented device (1, 1', 1", 1'") to the voltage source, A first microcontroller (10) of the safety-oriented device (1, 1', 1", 1"') detects whether a first connecting device (3, 3', 3", 3"') of the electronic storage device (2, 2', 2", 2"') is connected to a second connecting device (5, 5', 5", 5"') of the safety-oriented device (1, 1', 1", 1"') and, if the first connecting device (3, 3', 3", 3"') is connected to the second connecting device (5, 5', 5", 5"') downloading a first data content stored in an electronic storage device (2, 2', 2", 2'") from the electronic storage device (2, 2', 2", 2'") to a first storage device (11) of the security-oriented device (1, 1', 1", 1'"), without the first microcontroller (10) of the security-oriented device (1, 1', 1", 1'") verifying whether the data content is correct and suitable data content for the security-oriented device (1, 1', 1", 1'"), The second microcontroller (15) of the safety-oriented device (1, 1', 1", 1"') detects whether the first connecting device (3, 3', 3", 3"') of the electronic storage device (2, 2', 2", 2"') is connected to the second connecting device (5, 5', 5", 5"') of the safety-oriented device (1, 1', 1", 1"') and, if the first connecting device (3, 3', 3", 3"') is connected to the second connecting device (5, 5', 5", 5"') downloading the second data content stored in the electronic storage device (2, 2', 2", 2'") from the electronic storage device (2, 2', 2", 2'") to the second storage device (16) of the security-oriented device (1, 1', 1", 1'") without the second microcontroller (15) of the security-oriented device (1, 1', 1", 1'") verifying whether the data content is correct and suitable data content for the security-oriented device (1, 1', 1", 1'"), An electronic memory device (2, 2', 2", 2'") is electrically and mechanically decoupled from the safety-oriented device (1, 1', 1", 1'").

20. The method according to claim 19, characterized in that The first data content is data content configured as an operating software update, and the second data content is data content configured as an operating software update.

Images