Safety inspection device

Abstract

In order to provide a flexible testing device for measuring an object to be tested, the invention provides a plurality of (n) safety components (11, 12, 13), wherein a safety module (M) which can be set to active or inactive and a readiness state (r) which can be set to active or inactive are provided in a ring-shaped testing device, wherein the safety components (11, 12, 13) each periodically carry out a plurality of functional tests (T), wherein as one of the functional tests (T) the cyclical and error-free reception of a data packet (DP) is checked, and the selection of the safety modules (M) which can be set to active or inactive and a readiness state (r) which can be set to active or inactive are selected. One of the safety components (11, 12, 13) acts as a bus master (BM), which cyclically sends a bus check signal (B) in a data packet (DP1) to the next safety component (11, 12, 13) arranged in the transmission direction, wherein the bus check signal (B) is respectively forwarded by the safety component (11, 12, 13) in a data packet (DP2, DP3), and the bus master (BM) determines a closed ring check device when receiving the bus check signal (B) in the data packet (DP3).

Description

Technical Field

[0001] The present invention relates to a method for operating an inspection device comprising a plurality of safety components, wherein the safety components each have a signal input for receiving a data packet and a signal output for sending a data packet, wherein a safety module that can be set to active or inactive and a ready state that can be set to active or inactive are respectively provided on the safety components, wherein the safety module of the safety component is set to inactive when the ready state of the corresponding safety component is inactive. Background Art

[0002] The tester can be used to perform measurements on dangerous test objects (e.g. current transformers). Since dangerous test objects may store dangerous amounts of energy, adequate safety measures must be taken when performing measurements. For this reason, the tester can be expanded into a test device by means of other components. For example, a dangerous work area can be provided with a warning light and an emergency stop switch as components. The emergency stop switch enables the current amplifier and voltage amplifier in the tester to be quickly and safely disconnected. The warning light can, for example, indicate whether the test object or work area is safe (discharge) or unsafe (current diversion). As a further component, a connection safety device (Einschaltsicherung) of the tester can be provided to prevent unauthorized connection. The activation of the connection safety device can be an important safety aspect, especially when working on a wiring system. The test device usually comprises a plurality of components, including a tester, a warning light, an emergency stop switch, a connection safety device, etc.

[0003] One possibility for constructing such a testing device is to use a safety circuit with discrete signals. Here, the components of the testing device are interconnected via a safety fieldbus, where communication between the components occurs via safety-enforced signals. Therefore, the safety fieldbus is configured and tested by the manufacturer. For safety reasons, users cannot and are not permitted to modify the safety fieldbus. For this reason, users cannot integrate other components into the testing device or transmit additional information, such as for diagnostic purposes. Therefore, in addition to high safety standards for communication between the components, a long service life is also expected for all components. Because these components are securely connected to each other, cabling installation is expensive. Furthermore, identifying and avoiding cabling faults (cable breaks, short circuits, crosstalk, etc.) is complex. These problems are known in the prior art. DE 10 2017 13 0 167 A1 describes a method for detecting faults in network connections, focusing on the secure transmission of test data over the network connection. However, as is typical in the prior art, DE 10 2017 13 0 167 A1 only provides limited information on the network users or components themselves and their individual testing. Summary of the Invention

[0004] It is therefore an object of the present invention to provide a flexible testing device for measuring an object under test.

[0005] According to the invention, the object is achieved by connecting the signal inputs and signal outputs of the safety components in such a way that the safety components form a ring-shaped checking device for the transmission direction of the data packets, wherein the safety components each cyclically carry out a plurality of function tests and set the readiness state of the safety component to active if a plurality of function tests are successful and to inactive if at least one of the function tests fails, wherein one of the function tests is to check the cyclical, error-free reception of the data packets. One of the safety components is selected as a bus master and cyclically sends a bus check signal in the data packets to the next safety component arranged in the transmission direction, wherein the bus check signal is respectively forwarded in the data packets by the safety components, and wherein the bus master determines a closed ring-shaped checking device upon receipt of the bus check signal in the data packets.

[0006] The ring check device thus forms a ring bus including the safety components. The signal outputs of the safety components are each connected in a ring-shaped manner to the signal inputs of the other safety components, so that the check device has exactly one transmission direction for transmitting data packets. To check whether the ring check device is closed, one of the safety components is identified as the bus master. The bus master cyclically sends a bus check signal in a data packet via the safety components of the check device, wherein each safety component further transmits the bus check signal in a data packet. If the bus check signal reaches the bus master again, the bus master can determine that the check device is closed. The cycle duration for sending the data packet is preferably set to 10 ms to 100 ms, wherein a shorter cycle duration improves the reaction time, especially in the event of a functional test failure.

[0007] Whether the respective safety component is actually in an activated ready state depends on the type of safety component and the respective functional test.

[0008] Unlike the safety bus according to the prior art, the transmission of data packets between the safety components themselves does not necessarily have to be safe. Instead, the safety components carry out a number of functional tests, of which at least one basic functional test is carried out in the form of a check for the periodic, error-free reception of data packets. In addition to this functional test, other functional tests can also be carried out. Only when all functional tests are successful is the readiness state of the corresponding safety component set to active. If one or more of the functional tests fail, the readiness state of the safety component is set to inactive. This communication connection between the safety components is called a so-called "black channel", which means that the communication between the safety components is not considered functionally safe.

[0009] Preferably, the bus master cyclically tests whether its readiness state is active when determining a closed ring check device and, if the readiness state is active, sends a readiness signal in a data packet to the next safety component located in the transmission direction, wherein the safety component respectively checks whether its readiness state is active when receiving the readiness signal and, if the readiness state is active, sends a readiness signal in a data packet to the next safety component located in the transmission direction.

[0010] Therefore, if the bus master determines, by receiving the bus check signal, that the ring check device is closed and its readiness state is active, it sends the readiness signal to the next safety component arranged in the transmission direction, that is, to the safety component whose signal input is connected to the signal output of the bus master. This safety component receives the readiness signal and checks its own readiness state. If its readiness state is active, it sends the readiness signal in a data packet to the next safety component arranged in the transmission direction, and so on. Unlike the bus check signal, when the ring check device is closed, the readiness signal is not necessarily passed on to the bus master in the corresponding data packet, but only when all safety components actually have an active readiness state.

[0011] Preferably, upon receiving the ready signal, the bus master determines that the checking device is ready for operation and sends an activation signal in a data packet to the next safety component arranged in the transmission direction, wherein each of the safety components activates its safety module upon receiving the activation signal and passes on the activation signal in the data packet.

[0012] If all safety modules are active, the inspection device is activated and can exchange safety-related information via the safety components. Safety-related information represents information required for performing measurements in the inspection structure.

[0013] Therefore, the control device only provides a functionally safe communication channel for sending and receiving safety-related information if all safety components have an activated safety module. If this is the case, it is also possible to combine all safety components in the control device for safety-related information between the safety components.

[0014] The safety component may include, for example, an output unit for outputting safety-related information, an input unit for inputting safety-related information, a power unit for inputting / outputting safety-related information, etc. However, if the safety module of the safety component is activated, the safety component can only read safety-related information from a data packet and / or write safety-related information to a data packet.

[0015] As an input unit, for example, an opening unit for opening the inspection device or a key switch for securing the inspection device against unauthorized persons can be provided. A locking unit, such as an emergency stop switch, can also be provided as an input unit to deactivate individual or all safety components or their functions. A start switch can also be provided to finally initiate a measurement by the inspection device.

[0016] As power units, for example, current amplifiers, voltage amplifiers, "switch boxes" for disconnecting dangerous voltages / currents, etc. can be provided in the safety component. In this case, disconnection of the power unit must be ensured if the safety module is not activated.

[0017] As output units, for example, warning lights or display units for measured values may be provided, wherein, for example, a warning color (eg red) may be displayed when the power unit is active and a readiness color (eg green) may be displayed when the power unit is de-energized.

[0018] The safety component may include one or more output units, input units, power units, or a combination thereof.

[0019] For example, a safety component can trigger an emergency stop based on safety-related information received in a data packet. This emergency stop is again transmitted as safety-related information in the data packet, where another safety component reads this safety-related information and displays a warning light. Another safety component can, for example, deactivate its power unit. A hazardous state of a safety component's power unit can also be transmitted as safety-related information in a data packet, read again, and output. For example, the definition of "hazardous" is used in the IEC 61508 standard, preferably version 2.0, or the ISO 13849 standard, preferably versions ISO 13849-1:2015 and ISO 13849-2:2012.

[0020] Preferably, after sending the ready signal and if no ready signal is received, the bus master sends an emergency stop signal in a data packet to the next safety component arranged in the transmission direction. Upon receiving the emergency stop signal, each of these safety components deactivates its safety module and continues to transmit the emergency stop signal in the data packet. If the bus master does not return its ready signal within the planned period, the bus master concludes that at least one safety component has an inactive ready state. Subsequent transmission of the emergency stop signal ensures that all safety modules of all safety components are also inactive.

[0021] Preferably, after sending the bus check signal and if no bus check signal is received, the bus master sends an emergency stop signal in a data packet to the next safety component arranged in the transmission direction, wherein each of these safety components deactivates its safety module upon receiving the emergency stop signal and continues to forward the emergency stop signal in the data packet. This ensures that all safety modules are effectively deactivated, particularly in the event of a safety component ring break and in a configuration in which a safety component always sends a data packet, even if no data packet is received by the safety component.

[0022] Preferably, the safety component performs a safety test and, if the safety test fails, deactivates its readiness and sends an emergency stop signal in a data packet to the next safety component arranged in the transmission direction. Upon receiving the emergency stop signal, the safety component deactivates its safety module and sends the emergency stop signal in the data packet. During the safety test, the safety-critical functions of the safety component are checked. If the safety test fails, the readiness and, therefore, the safety module, are immediately deactivated, and a data packet containing the emergency stop signal is also immediately sent, in order to deactivate all other safety modules of all other safety components as quickly as possible.

[0023] Preferably, the bus master is selected by the component identification of the safety component. Preferably, the safety component with the lowest component identification is selected as the bus master.

[0024] The safety component may send a component identification using a bus check signal in a data packet, wherein the bus master identifies the safety component by using the component identification received using the bus check signal.

[0025] Preferably, the bus master sends the component identification back to the respective safety component in a data packet, wherein if the bus master does not receive the safety component's identification, the safety component sets its readiness state to inactive.

[0026] The bus master can send bus check signals, ready signals, activation signals, emergency stop signals, etc. in the same data packet or in separate data packets. If the bus check signal and ready signal are sent in a data packet, the bus master can determine that the ring check device is still closed when the ready signal is received in the data packet. The bus master can also determine that all safety components are in an active ready state only if the data packet received by the bus master also contains the ready signal.

[0027] If the safety module is active, safety-related information such as bus check signals, ready signals, activation signals, emergency stop signals, etc. can also be sent in the same data packet. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Please refer to the attached Figure 1 6, the present invention is explained in more detail. These figures show advantageous embodiments of the present invention by way of example, schematically and non-limitingly.

[0029] Figure 1 Shows safety components,

[0030] Figure 2 Shows an inspection device comprising three safety components,

[0031] Figure 3 shows the sending of bus check signal,

[0032] Figure 4a shows the sending of a readiness signal, wherein a safety component has an inactive readiness state,

[0033] Figure 4b shows the sending of a readiness signal, wherein all safety components have an activated readiness state,

[0034] Figure 5 shows the sending of the activation signal,

[0035] Figure 6a Showing ring break,

[0036] Figure 6b Indicates the sending of an emergency stop signal. DETAILED DESCRIPTION

[0037] exist Figure 1Figure 1 shows safety components 11, 12, and 13. These components have signal inputs Rx for receiving data packets DP1, DP2, and DP3, and signal outputs Tx for transmitting data packets DP1, DP2, and DP3. These components also have a readiness state r, which can be set to active or inactive. These components include a security module M, which can be set to active or inactive. However, this module is always inactive when the readiness state r is inactive. However, this does not mean that the security module M must always be active when the readiness state r is active.

[0038] The safety components 11, 12, 13 cyclically carry out at least one functional test T. If all functional tests T are successful, the readiness state r is set to active. If only one functional test T fails, the readiness state r is set to inactive, thereby also making the safety module M inactive, or, if already inactive, remaining inactive.

[0039] In the illustrated figures, an activated readiness state r and an activated security module M are essentially shown as "1," while an inactive readiness state r and an inactive security module M are essentially shown as "0." A failed functional test T is shown as a crossed-out T; if a functional test T is successful, it is shown as a T.

[0040] exist Figure 2 The structure of the inspection device composed of multiple safety components 11, 12, 13 is shown in FIG. Figure 1 As described. The safety components 11, 12, 13 are connected to each other in the form of a ring bus as a ring inspection device, in which the signal input Rx of the safety components 11, 12, 13 is connected to the signal output Tx of another safety component 11, 12, 13 respectively. Figure 2 For example, the signal output terminal Tx of the first safety component 11 is connected to the signal input terminal Rx of the second safety component 12, the signal output terminal Tx of the second safety component 12 is connected to the signal input terminal Rx of the third safety component 13, and the signal output terminal Tx of the third safety component 13 is connected to the signal input terminal Rx of the first safety component 11.

[0041] Of course, in the figures shown, only a plurality of three safety components 11 , 12 , 13 are selected as an example, and the inspection device may include any number of safety components 11 , 12 , 13 .

[0042] The safety components 11 , 12 , 13 perform at least one check of the cyclical, error-free reception of the data packets DP as a functional test T. This can be done, for example, by a checksum check, a sequence check, a timeout, etc. By performing this check of the error-free reception of the received data packets DP, a so-called black channel is formed between the safety components 11 , 12 , 13 .

[0043] If all function tests T of the safety components 11, 12, 13 are successful in the current cycle, the readiness state r of the safety components 11, 12, 13 is set to active, provided that the readiness state is not already active. If the safety module M and the readiness state r are already active, the safety module M remains active, provided that no other safety measures have deactivated the safety module M. Figure 2 In FIG, only basic functional tests T(DP1), T(DP2), T(DP3) are provided for checking the cyclical, error-free reception of data packets DP on the safety components 11, 12, 13. If these functional tests T(DP1), T(DP2), T(DP3) fail, the corresponding readiness state r is set to inactive. If the functional tests T(DP1), T(DP2), T(DP3) succeed (this means that "all" functional tests T for each safety component 11, 12, 13 succeed, since this is the only functional test T provided), the corresponding readiness state is set to active.

[0044] Furthermore, according to the present invention, one of the safety components 11, 12, 13 is selected as the bus master BM, wherein the selection of the bus master BM can be performed with the aid of the component identification, for example the identification number UID, of the safety components 11, 12, 13. For example, the safety components 11, 12, 13 with the lowest identification number UID can be selected. Figure 3 In the example, the first safety component 11 with UID1 is selected as the bus master BM. According to the present invention, the bus master BM checks whether the safety components 11, 12, and 13 actually form a ring check arrangement, i.e., a ring bus. To this end, the bus master BM sends a bus check signal B in a data packet DP1 to the next safety component arranged in the transmission direction, here, the second safety component 12. If there is a connection between the safety components 11, 12, and 13, the bus check signal B is received in data packets DP1, DP2, and DP3 by all safety components 11, 12, and 13 present in the ring bus via the signal input Rx and forwarded via the signal output Tx.

[0045] Since each safety component 11, 12, 13 therefore expects cyclical data packets DP1, DP2, DP3 (with bus check signal B), a check for cyclical, error-free reception of these data packets DP can be performed as a (basic) functional test T. If the data packets DP1, DP2, DP3 are not received as expected or if the error check and thus the (basic) functional test T fail, the corresponding safety component 11, 12, 13 deactivates its readiness state r.

[0046] Optionally, in this case, the safety components 11, 12, 13 can also send an emergency stop signal N in the data packets DP1, DP2, DP3, and the emergency stop signal is further transmitted by all safety components 11, 12, 13 in the data packets DP1, DP2, DP3 respectively, and all safety components 11, 12, 13 that receive the emergency stop signal deactivate their safety modules M, which is another safety mechanism.

[0047] exist Figure 3 Therefore, the first safety component 11, acting as the bus master BM, transmits a bus check signal B via its signal output Tx to the signal input Rx of the second safety component 12 in data packet DP1. The second safety component 12 transmits the bus check signal B in data packet DP2 via its signal output Tx to the signal input Rx of the third safety component 13. The third safety component 13 then transmits the bus check signal B via its signal output Tx to the signal input Rx of the first safety component 11, which is the bus master BM, in data packet DP3. Of course, the bus master BM only receives the bus check signal B when the ring bus is closed. Therefore, the bus master BM can ensure that the ring bus is closed by receiving the bus check signal B.

[0048] The safety components 11, 12, 13 are advantageously designed so that they transmit their identification numbers UID1, UID2, UID3 respectively with the bus check signal B in the data packet, as also in Figure 3 As shown in . Accordingly, the bus master BM can be designed to identify the safety components 11, 12, 13 by means of the identifiers UID1, UID2, UID3 received with the bus check signal B. As shown in Figure 3As shown in , the second safety component 12 thus uses the data packet DP1 of the bus master BM to obtain the bus check signal B, adds its identification number UID1, and transmits a data packet DP2 containing the bus check signal B to the third safety component 13. This third safety component, in turn, adds its identification number UID3 and transmits the bus check signal B in the data packet DP3 to the first safety component 11, which constitutes the bus master BM. In the data packet DP containing the bus check signal B, the bus master BM not only receives the information that the ring bus is closed, but also the identification numbers UID2 and UID3 of the other safety components 12 and 13; the bus master BM already knows its own identification number UID1. Therefore, the safety components 11, 12, and 13 in the testing device are known to the bus master BM via their identification numbers UID1, UID2, and UID3.

[0049] In the further course of the safety components 11, 12, 13, a function test T is also permanently and cyclically carried out, however, at least a basic function test T (checking the cyclic and error-free reception of the data packets DP1, DP2, DP3). Figures 3 to 5 Not shown for reasons of clarity.

[0050] Likewise, the bus master BM further checks the closed loop check means by sending a bus check signal B.

[0051] The bus master BM can now also send the corresponding identification numbers UID2, UID3 back to the corresponding safety components 12, 13 (not shown). Thus, each safety component 11, 12, 13 can itself check whether the ring bus is actually closed. Preferably, the safety components 12, 13 can be configured such that if they do not have their identification numbers UID2, UID3 returned by the bus master BM, they set their readiness state r to inactive, as this can indicate a fault in the ring bus.

[0052] If the bus master BM receives the bus check signal B via its signal input Rx (with which a closed ring bus is determined) and the readiness state r of the bus master BM is active, the bus master BM transmits the readiness signal R in the data packet DP via its signal output Tx to the other (here second) safety component 12 arranged in the transmission direction, such as Figure 4a 、 4bAs shown in . Each safety component 11, 12, 13 checks whether its readiness state r is active when receiving a data packet DP1, DP2, DP3 with a readiness signal R. If the readiness state r is inactive, the corresponding safety component 11, 12, 13 does not send the readiness signal R in the data packet DP1, DP2, DP3. However, if the safety component 11, 12, 13 receives the readiness signal R in the data packet DP and its readiness state r is active, the safety component 11, 12, 13 transmits the readiness signal R in the data packet via its signal output Tx to the signal input Rx of the connected safety component 11, 12, 13.

[0053] exist Figure 4a It is assumed that the third safety component 13 has an inactive readiness state r. Therefore, the bus master BM transmits a readiness signal R in data packet DP1 to the second safety component 12. Since the second safety component 12 has an active readiness state r, it passes the readiness signal R on to the third safety component 13 in data packet DP2. However, the third safety component 13 has an inactive readiness state r and therefore does not pass the readiness signal R on to the first safety component 11 (here acting as the bus master BM) in data packet DP3. The bus master BM therefore concludes that not all safety components have an active readiness state r=1.

[0054] If the bus master BM does not receive the ready signal R, it advantageously sends an emergency stop signal N (not shown) in a data packet DP1, which is forwarded by the safety components 11, 12, 13. Upon receiving the emergency stop signal N, the safety components 11, 12, 13 deactivate their safety modules M, if they are not already deactivated. This provides an additional safety measure and ensures that all safety modules M are deactivated.

[0055] And in Figure 4b It is assumed that all safety components 11, 12, 13 have an activated readiness state r. Therefore, the readiness signal R is directed in the data packet DP1 to the second safety component 12, which, due to its activated readiness state r, directs the readiness signal R in the data packet DP3 to the third safety component 13. The third safety component 13, due to its activated readiness state r, directs the readiness signal R in the data packet DP3 to the first safety component 11, which is the bus master BM. The bus master BM thus determines that all safety components 11, 12, 13 have an activated readiness state r and thus detects that the checking device is ready for operation. It should be noted that this is not only the case when the readiness state r of the third safety component 13 is activated (FIG. 4B), but also when the readiness state r of the third safety component is inactivated ( Figure 4a), the bus master BM receives the bus check signal B in the data packet DP3. This means that a closed loop check mechanism exists in both cases. If this were not the case, the bus master BM would not receive the data packet DP3 at all and therefore would not receive the bus check signal B (and of course no ready signal R, etc.).

[0056] Figure 5 The following situation is shown: the bus master BM has determined that the testing device is ready for operation by receiving a readiness signal R. Therefore, the bus master BM sends an activation signal A to all other safety components 12, 13, namely in a data packet DP1 to the next safety component connected in the transmission direction (here, the second safety component 12), which in turn transmits the activation signal A in a data packet DP2 to the next safety component connected in the transmission direction (here, the third safety component 13), etc. Upon receiving the activation signal A in the data packet DP, the other safety components 12, 13 each switch their safety module M to active, thereby activating the ring-shaped testing device.

[0057] The safety components 11 , 12 , 13 are only allowed to send and receive safety-relevant information M1 , M2 , M3 when the safety module M is respectively active.

[0058] exist Figure 5 It is assumed that all safety components 11 , 12 , 13 have received the activation signal A (and moreover cyclically).

[0059] The first safety component 11 includes an input unit, such as a switch, and can add safety-related information M1 to the data packet DP1 based on the activated safety module M. Thus, the first safety component 11 can indicate, for example, a measurement start command as the safety-related information M1.

[0060] The second safety component 12 includes a power unit. Because its safety module M is active, the second safety component 12 can read safety-related information M1 from the data packet DP1 and add safety-related information M2 to the data packet DP2. Thus, for example, the second safety component 12 can activate its power unit based on the safety-related information M1 from the first safety component 11 in the form of a measurement start command and also add safety-related information M2 to the data packet DP2 in the form of measured values.

[0061] The third safety component 13 comprises an output unit which can now output the safety-related information M1, M2 contained in the data packet DP2, for example, safety-related information M1 about the input unit from the first safety component 11, such as a measurement start command, or safety-related information M2 about the power unit from the second safety component 12, such as a measured value. Thus, the safety components 11, 12, 13 can, when the safety module M is activated, add the safety-related information M1, M2, M3 to the data packets DP1, DP2, DP3 and / or, depending on the design of the safety components 11, 12, 13, read them from the data packets DP1, DP2, DP3. The input unit, power unit and output unit are only Figure 5 and 6a , since only the safety module M of the safety component 11 , 12 , 13 is active here.

[0062] exist Figure 5 4 , the data packets DP1 , DP2 , DP3 also contain a bus check signal B and a readiness signal R, wherein the bus master BM also monitors the closed ring check device and the activated readiness r of all safety components 11 , 12 , 13 .

[0063] Safety components 11, 12, 13 can also perform a safety test S (not shown) and, if the safety test fails, deactivate their safety modules M and output an emergency stop signal N in data packets DP1, DP2, DP3 to other safety components 11, 12, 13 arranged in the control device. Upon receiving the emergency stop signal N, these safety components not only forward this emergency stop signal in data packets DP1, DP2, DP3 but also deactivate their safety modules M. A failed safety test S therefore immediately triggers the transmission of data packets DP1, DP2, DP3 containing the emergency stop signal N, thereby deactivating the safety modules M of all safety components 11, 12, 13. The bus master BM can also transmit the emergency stop signal N if it does not receive the activation signal A it sent in data packet DP3 at the signal input Rx.

[0064] Unlike the safety test S, a failure of a functional test T (which is not safety-critical) only results in the deactivation of the readiness state r of the safety component 11, 12, 13. The bus master BM only detects the deactivation of the readiness state r when it sends and does not receive a readiness signal R. Other safety components 11, 12, 13 that failed the functional test T can remain in the activated readiness state r.

[0065] exist Figure 6a 、 6bFIG shows a ring break between the second safety component 12 and the third safety component 13, that is, an interruption of the communication line. Figure 6a In this example, a ring break occurs after the bus master BM receives data packet DP3. Therefore, the bus master BM has not yet received any information about the ring break when sending data packet DP1. Consequently, data packet DP1 with bus check signal B (and here also readiness signal R, activation signal A, and safety-related information M1, M2, M3) reaches the second safety component 12. This second safety component also has not yet detected a ring break at this point in time and therefore sends data packet DP2. However, this data packet does not reach the third safety component 13.

[0066] Here, the third safety component 13 is configured so that it does not send data packet DP3 if it does not receive data packet DP2. Consequently, the bus master BM fails its cyclical function test T and deactivates its readiness state r. Therefore, the bus master BM sets its readiness state r to inactive and sends a data packet DP with an emergency stop signal N to deactivate the safety modules M of all safety components 11, 12, and 13. The emergency stop signal N reaches the second safety component 12 in data packet DP1, thereby deactivating its safety module M.

[0067] If the third safety component 13 is configured to send data packet DP3 even if the third safety component 13 does not receive data packet DP2 (not shown), the bus master BM remains in its ready state r active despite a successful basic function test T of the bus master BM. In this case, it is advantageous if the bus master BM is configured to issue an emergency stop signal N if it does not receive the bus check signal B. However, due to the ring break, the bus master BM will still not receive the bus check signal B and, therefore, can send the emergency stop signal N in data packet DP1 when data packet DP1 is configured in this manner. Therefore, the bus master BM will never receive the bus check signal B in the event of a ring break and thus confirms that the ring check device is no longer closed ( FIG. 6B ).

[0068] However, due to the ring break, the second safety component 12 cannot transmit the emergency stop signal N in the data packet DP2 to the third safety component 13. However, the third safety component 13 periodically performs at least one basic functional test T(DP) and waits for at least one data packet DP2 for verification. This functional test T therefore fails, causing the third safety module 13 to switch its operating state r to inactive, thereby also switching the safety module M to inactive.

[0069] Thus, in the illustrated testing device, the first and third safety components 11, 12, 13 remain with an inactive safety module M. The second safety component 12 can be in an active readiness state r as long as the associated functional test T has not failed. However, this is only possible if the first safety component 11 is configured to send a data packet DP even if it has not received a data packet DP (e.g., with a bus check signal B), because otherwise the basic functional test T of the second safety component 12 would fail.

[0070] The checking device can now be supplemented in a simple manner, for example, by a further safety component between the second safety component 12 and the third safety component 13. Alternatively, a different arrangement of the safety components 11, 12, 13 or simply a closed loop break is also possible.

[0071] Only when the ring break is eliminated is the bus master BM identified as described above, data packets DP1, DP2, DP3 are sent with a bus check signal B for identifying a closed ring check device, data packets DP1, DP2, DP3 are sent with a readiness signal R, and if all safety components 11, 12, 13 have an activated readiness state r, an activation signal A is sent to the safety module M of the safety components 11, 12, 13 for activating the check device. Safety-related information M1, M2, M3 can then be exchanged between the safety components 11, 12, 13.

Claims

1. A method for operating a testing device comprising a plurality of (n) safety components (11, 12, 13), wherein: The safety components (11, 12, 13) respectively have a signal input (Rx) for receiving a data packet (DP1, DP2, DP3) and a signal output (Tx) for sending a data packet (DP1, DP2, DP3), wherein a safety module (M) that can be set to active or inactive and a ready state (r) that can be set to active or inactive are respectively provided on the safety components (11, 12, 13), wherein the safety module (M) of the safety component (11, 12, 13) is set to inactive in the inactive ready state of the corresponding safety component (11, 12, 13), characterized in that the signal input (Rx) and the signal output (Tx) of the safety components (11, 12, 13) are connected so that the safety components (11, 12, 13) form a ring-shaped inspection device with a transmission direction for the data packet (DP1, DP2, DP3), and the safety components (11, 12, 13) are respectively periodically A plurality of functional tests (T) are carried out, and the readiness state (r) of the safety component is set to active when the plurality of functional tests (T) are successful, and the readiness state of the safety component is set to inactive when at least one of the functional tests (T) fails, wherein, as one of the functional tests (T), the cyclical, error-free reception of data packets is checked, and one of the safety components (11, 12, 13) is selected as a bus master (BM), which cyclically sends a bus check signal (B) in a data packet (DP1) to the next safety component (11, 12, 13) arranged in the transmission direction, wherein the bus check signal (B) is respectively forwarded by the safety components (11, 12, 13) in data packets (DP2, DP3), and the bus master (BM) determines a closed ring check device upon receipt of the bus check signal (B) in a data packet (DP3).

2. The method according to claim 1, characterized in that The bus master (BM) periodically checks whether its readiness state (r) is active when determining a closed ring check device, and sends a readiness signal (R) in a data packet (DP1) to the next safety component (11, 12, 13) located in the transmission direction when the readiness state (r) is active, and the safety components (11, 12, 13) respectively check whether their readiness state (r) is active when receiving the readiness signal (R), and send a readiness signal (R) in a data packet (DP2, DP3) to the next safety component (11, 12, 13) located in the transmission direction when the readiness state (r) is active.

3. The method according to claim 2, characterized in that The bus master (BM) determines that the checking device is ready for operation when receiving a readiness signal (R) and sends an activation signal (A) in a data packet (DP1) to the next safety component (11, 12, 13) arranged in the transmission direction, wherein the safety component (11, 12, 13) activates its safety module (M) when receiving the activation signal (A) and passes on the activation signal (A) in the data packet (DP2, DP3).

4. The method according to claim 3, characterized in that The bus master (BM) sends an emergency stop signal (N) in a data packet (DP1) after sending a ready signal (R) and when no ready signal (R) is received to the next safety component (11, 12, 13) arranged in the transmission direction, wherein the safety component (11, 12, 13) deactivates its safety module (M) when receiving the emergency stop signal (N) and continues to forward the emergency stop signal (N) in the data packet (DP2, DP3).

5. The method according to any one of claims 1 to 3, characterized in that The bus master (BM) sends an emergency stop signal (N) in a data packet (DP1) to the next safety component (11, 12, 13) arranged in the transmission direction after sending a bus check signal (B) and when the bus check signal (B) is not received, wherein the safety component (11, 12, 13) deactivates its safety module (M) when receiving the emergency stop signal (N) and continues to transmit the emergency stop signal (N) in the data packet (DP2, DP3).

6. The method according to any one of claims 1 to 3, characterized in that The safety components (11, 12, 13) carry out a safety test (S) and, if the safety test (S) fails, the corresponding safety component (11, 12, 13) deactivates its readiness state (r) and sends an emergency stop signal (N) in a data packet (DP1, DP2, DP3) to the next safety component (11, 12, 13) arranged in the transmission direction, wherein, upon receiving the emergency stop signal (N), the safety component (11, 12, 13) deactivates its safety module (M) and sends the emergency stop signal (N) in the data packet (DP1, DP2, DP3).

7. The method according to any one of claims 1 to 3, characterized in that A bus master (BM) is selected via a component identifier (UID1, UID2, UID3) of the safety component (11, 12, 13).

8. The method according to any one of claims 1 to 3, characterized in that The safety components (11, 12, 13) send component identifications (UID1, UID2, UID3) using bus check signals (B) in data packets (DP1, DP2, DP3), and a bus master (BM) is identified by the component identifications (UID1, UID2, UID3) received using the bus check signals (B).

9. The method according to claim 8, characterized in that The bus master (BM) sends back the component identification (UID1, UID2, UID3) in the data packet (DP1) to the corresponding safety component (11, 12, 13), and if the safety component (11, 12, 13) does not receive its identification (UID1, UID2, UID3) from the bus master (BM), the safety component sets its readiness state (r) to inactive.

10. The method according to claim 7, characterized in that The safety component (11, 12, 13) with the lowest component identification (UID1, UID2, UID3) is selected as the bus master (BM).

Images