Functional safety supervision of electric power system

Abstract

The invention relates to functional safety supervision of an electric power system. A method for functional safety supervision of an electrical power system, the electrical power system comprising a control unit (10) and a plurality of devices (21, 22, 23, 24) connected to the control unit (10), the method comprising configuring the plurality of devices (21, 22, 23, 24) as two or more functional safety supervision groups, and transmitting data from one or more of the plurality of devices (21, 22, 23, 24) to the control unit (10) using black channel communication, wherein the transmitting comprises providing, in the transmitting device, an indicator for the data to be transmitted, the indicator indicating a functional safety supervisor group to which the transmitting device considered is configured.

Description

Technical Field

[0001] The present invention relates to functional safety supervision of an electric power system, and more precisely to functional safety supervision of an electric power system comprising a control unit and a plurality of devices connected to the control unit. Background Art

[0002] An inverter is one example of an electric power converter device. Another example of an electric power converter device is a rectifier. Inverters, rectifiers, and / or other such electric power converter devices may be used, for example, in conjunction with an electric motor drive to control the motor. For example, such an electric motor drive may also be configured to operate in both motoring and generating modes.

[0003] For example, various safety functions can be applied to electric motor drives to monitor and ensure their safety in various scenarios and conditions. Several safety regulations and standards govern electric motor drives in various applications. One example of this standard is IEC 61800-5-2, which defines the Safe Torque Off (STO) function. Whenever activated, the STO function puts the electric drive's motor into a no-torque state.

[0004] For example, such functional safety supervision can be implemented by a control unit connected to a power unit (such as an electric power converter device or its power stage). The communication connection between the control unit and the power unit may include a so-called black channel. A black channel generally refers to a communication in which, for example, safety-critical communication may be encoded in a specific manner, such as defined in standard IEC 61508, regardless of the communication protocol used in normal communication. An example of such an implementation is disclosed in document EP2930844B1.

[0005] One problem with the above solution is that in a system comprising several power cells and possibly other devices for which functional safety supervision needs to be implemented, at least some of the power cells may need to be supervised separately from each other and therefore multiple control units may be needed in the system. Summary of the Invention

[0006] Therefore, the object of the present invention is to provide a method and an apparatus for implementing the method in order to overcome the above-mentioned problems or at least alleviate them. The object of the present invention is achieved by a method and an electric power unit, which are characterized by what is stated in the independent claims. Preferred embodiments of the invention are disclosed in the dependent claims.

[0007] The invention is based on the idea of ​​configuring a plurality of devices into two or more functional safety supervision groups and transmitting data from these devices to a control unit using black channel communication in such a way that the data is provided with an indicator indicating the functional safety supervision group to which the transmitting device in question is configured.

[0008] An advantage of the solution of the invention is that the control unit can identify the functional safety supervision group of the device indicated by the indicator provided together with the transmitted data, so a single control unit can be used to supervise multiple devices belonging to different safety supervision groups. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The present invention will be described in more detail below through preferred embodiments in conjunction with the accompanying drawings, in which:

[0010] Figure 1 An example of a system according to an embodiment is shown;

[0011] Figure 2 An example of a system according to an embodiment is shown;

[0012] Figure 3 An example of a system according to an embodiment is shown; and

[0013] Figure 4 An example of a data packet according to an embodiment is shown. DETAILED DESCRIPTION

[0014] The following embodiments are exemplary. Although the description may refer to "one", "an" or "some" embodiments in multiple places, this does not necessarily mean that each such reference refers to the same embodiment, or that the feature applies to only a single embodiment. Individual features of different embodiments may also be combined to provide other embodiments. In general, all terms and expressions used are to be interpreted broadly, and they are intended to illustrate rather than limit the embodiments. Only the components necessary to understand the various embodiments are shown in the figures. The number and / or configuration of the various elements and their implementation may generally vary from the examples shown in the figures. The application of the various embodiments described herein is not limited to any particular system, but they can be used in conjunction with various electrical systems. Furthermore, the use of the various embodiments described herein is not limited to systems employing any particular fundamental frequency or any particular voltage level.

[0015] Figure 1 is a simplified block diagram of an exemplary system, which shows some devices (e.g., apparatuses, devices, units) and functional entities, the implementation and / or number and / or configuration of which may vary from Figure 1 Different than shown in the example. Figure 1The connections shown are logical connections, and the corresponding actual physical connections (which may include wired and / or wireless connections) may be different. Such a system may also include other devices, functional entities and / or structures, some of which may be used for data management and communication in the system or any part of the system. In addition, for example, any communication protocols used may vary and may depend on the characteristics of the system.

[0016] Figure 1 An example of an electric power system is shown, which comprises a control unit (device, arrangement) 10 and a plurality of devices 21, 22, 23, 24 connected to the control unit 10. According to one embodiment, the plurality of devices 21, 22, 23, 24 may comprise at least one power unit and / or at least one auxiliary device, such as a measuring device or a switching device, controlled by the control unit. Figure 1 In the simplified example of FIG, devices 21 and 23 are inverter units, device 22 is a supply unit such as a rectifier, and device 24 is a measuring unit such as a measuring card. The term "inverter" herein generally refers to an electronic device or circuit system capable of converting direct current into alternating current, and the term "rectifier" generally refers to an electronic device or circuit system capable of converting alternating current into direct current. Figure 1 The system may be an electric drive, and the inverter units 21, 23 may be configured, for example, to control corresponding motors (not shown in the figure), and the supply unit 22 may be configured to be connected to an electrical grid (such as an AC network) and to supply electrical energy to the system from the electrical grid (not shown in the figure) and / or to supply electrical energy from the system to the electrical grid. In the present disclosure, the term "power unit" is generally used to refer to a power converter, such as an inverter or a rectifier or a combination thereof. In the case where a power converter device comprises multiple power stages (modules), for example, multiple inverters within a single physical inverter device, the term "power unit" is generally used to refer to a single such power stage. The implementation of such a power unit may vary, but typically the power unit comprises controllable semiconductor switches, such as IGBTs, which are controlled according to control information sent by a control unit. Such a power converter or power unit may have one or more phases, for example, three phases.

[0017] Control unit 10 is configured to implement functional safety supervision of the system. Generally, such functional safety supervision may include, for example, implementing one or more safety functions and / or monitoring the status of one or more safety functions implemented in the system in a manner known per se. Furthermore, such monitoring may include monitoring one or more predetermined parameters and / or characteristics of the system related to such safety functions. Devices 21, 22, 23, and 24 in the system supervised by control unit 10 are similarly configured to implement one or more safety functions in a manner known per se. Such safety functions may be based on, for example, standards IEC 61508 and / or IEC 61800. However, the implementation of safety functionality (i.e., one or more safety functions) according to the present disclosure is not limited to these standards. One example of such a safety function is the Safe Torque Off (STO) function defined in the IEC standard for functional safety of drives (IEC 61800-5-2). Implementing the STO function may involve transmitting an STO command from control unit 10 to the supervised device and transmitting diagnostic information (data) from the device to control unit 10. Transmitting such diagnostic information (data) from the device to the control unit may require using secure (e.g., safety-certified) transmission. Another exemplary safety function is the safe speed supervision safety function. It is used in several safety functions according to IEC 61800-5-2, such as, for example, the safely limited speed (SLS) function. As an example, an electric drive comprising one or more power units and a control unit can provide compliant safe speed information (data) to a safety logic unit, which monitors whether the motor speed is within the permitted range. It may be necessary to transmit this speed information from the power unit(s) to the control unit 10 using a safe transmission. Thus, for example, STO and such safe speed-related safety functions may require a method to safely transmit at least some data from the device (such as the power unit(s)) to the control unit. In addition, the control unit may also need to be able to securely identify the device(s). This is particularly important if, for example, the device(s) being controlled by one control unit belong to different functional groups, which may mean that they belong to different safety monitoring groups.

[0018] The control unit 10 may also generally control the normal operation of the devices 21, 22, 23, 24 and the system, which may include, for example, sending control information to one or more of the plurality of devices 21, 22, 23, 24 and / or receiving various operating data, such as measurement data, from one or more of the plurality of devices 21, 22, 23, 24. The control information may include, for example, a reference value for the current to be output from the inverter unit or the torque to be generated by the electric motor connected to the inverter. The control unit 10 may also process various control-related calculations, such as different calculations related to the control of the motor(s) in the system.

[0019] The communication connection 30 between the control unit 10 and the devices 21, 22, 23, 24 can be implemented as a wired and / or wireless connection, and any suitable communication protocol(s) can be used for normal communication between the control unit 10 and the devices 21, 22, 23, 24. Such communication protocol(s) may depend on the system in question. At least some or all functional safety-related data may be transmitted between the control unit 10 and the plurality of devices 21, 22, 23, 24 using black channel communication. Black channel communication generally refers to the use of a so-called black channel (black communication channel), as it is known, for securely transmitting at least, for example, safety-critical data (information) between two safety-related parties, regardless of the communication protocol that may be used in normal communication related to the normal operation of the system. Using a black channel involves encrypting (securely encoding) the transmitted data on the sending end and decrypting it in securely authenticated blocks on the receiving end, thereby enabling the data to be transmitted over a normal (e.g., non-securely authenticated) communication connection, which may include, for example, industrial data network(s), while maintaining the security integrity of the data. The black channel approach in communication can be implemented by using a higher-level safety protocol (e.g., an application protocol) on top of the protocol used for normal (non-safety-related) communication. The black channel safety protocol may depend on the protocol used for normal communication. An example of such a safety protocol is PROFIsafe, which can be used in PROFINET (or PROFIBUS) networks. Such a safety protocol can encapsulate data before transmission and unpack the data at the receiving end. Such a safety protocol can handle, for example, different types of communication errors, such as data corruption, transmission delays and losses, examples of which are described in standard IEC 61784-3. The black channel concept is also mentioned, for example, in standard IEC 61508-2. In addition, document EP 2930844B1 discloses an example of communication using a black channel.

[0020] According to one embodiment, a plurality of devices 21, 22, 23, 24 are configured into two or more functional safety supervision groups, and data is transmitted from one or more of the plurality of devices 21, 22, 23, 24 to a control unit 10 using black channel communication, such that the transmission includes providing an indicator in the transmitting device for the data to be transmitted, wherein the indicator indicates the functional safety supervision group to which the transmitting device in question is configured. In other words, each of the devices 21, 22, 23, 24 in the system connected to and controlled by the control unit 10 is assigned to a functional safety supervision group, which is then indicated in the data transmitted from the devices 21, 22, 23, 24 to the control unit 10 using a black channel between the devices and the control unit. According to one embodiment, the configuration of the plurality of devices 21, 22, 23, 24 into two or more functional safety supervision groups can be implemented with the aid of at least one safety-related switch (e.g., a safety-certified switch) in each such device to be configured. According to one embodiment, the data transmitted using the black channel communication can include at least functional safety-related data. According to one embodiment, the data transmitted using the black channel communication can include only functional safety-related data. As an example, such functional safety-related data may include data related to the Safe Torque Off (STO) safety function and / or the Safely Limited Speed ​​(SLS) safety function, or any such safety function. For example, the functional safety-related data may include diagnostic data and / or speed data transmitted to the control unit 10 from one or more of the plurality of devices 21, 22, 23, 24 using, for example, black channel communication. According to one embodiment, data transmitted from one or more of the plurality of devices 21, 22, 23, 24 is received in the control unit 10, and a functional safety supervision group indicated by an indicator provided with the received data is identified in the control unit 10. According to one embodiment, the received data may be processed in the control unit 10 based on the identified functional safety supervision group. As an example, the control unit 10 may use the received data to implement functional safety supervision for a specific functional safety supervision group indicated by the indicator provided with the received data. Using the functional safety supervision groups assigned to the devices 21, 22, 23, 24 connected to the control unit 10 allows the safety functions implemented in the control unit 10 to safely classify data from the connected devices. Since the supervisory group information is transmitted through the black channel, the supervisory group information can be trusted.

[0021] The safety supervision groups may be predetermined and represented, for example, by numbers, letters, any combination thereof or any other suitable indicator. As an example, a safety supervision group may comprise only one device or more than one device. According to one embodiment, two or more functional safety supervision groups may comprise at least one group in which functional safety supervision is disabled. In general, the safety supervision groups may be determined based on the system configuration, in particular, based on how the devices in the system under consideration need to be supervised from a functional safety perspective. Hence, the term "safety supervision group" may relate to one device or a group of devices that may be supervised as a single group by a control unit. In Figure 1 In the example shown, first inverter unit 21 is assigned to functional safety supervision group #1, while second inverter unit 23 is assigned to functional safety supervision group #2. Furthermore, supply unit 22 and measurement unit 24 are both assigned to functional safety supervision group #0, which may represent a group for which functional safety supervision is disabled. Thus, the present disclosure generally provides a solution for separating devices such as power units and measurement devices into different functional safety supervision groups, while also enabling one or more of such devices to be excluded from functional safety supervision.

[0022] According to one embodiment, the two or more functional safety supervision groups include one or more main groups and one or more subgroups of the one or more main groups. For example, such subgroups can be implemented at one or more levels. Figure 2 shows the use of such subgroups, Figure 2 Another example of an electric power system is shown. Figure 2 The system corresponds to Figure 1 The difference is that in Figure 2 In the system of FIG, the first inverter unit 21 includes two inverter stages 211 and 212, which are respectively assigned to safety supervision groups #1.1 and #1.2. Therefore, safety supervision groups #1.1 and #1.2 represent subgroups of the main group #1.

[0023] Figure 3 is an example of a system according to an embodiment. Figure 3 For simplicity, Figure 3 Only one device 20 is displayed. However, Figure 1 and Figure 2 Any one of the devices 21, 22, 23, 24 in the example of FIG. 1 may be implemented as Figure 3 According to one embodiment, the device 20 (such as a power unit) comprises a functional safety device (arrangement, unit, device) configured to implement one or more safety functions. Figure 3In the example of , such a functional safety device is implemented by a safety block 202 of a field programmable gate array (FPGA) 201. Safety certified tools and measures can be used to program the safety certified FPGA, including, for example, safety certified software for implementing safety-related functions and operations. For example, a safety device using such (multiple) FPGAs can obtain safety certification, and once the certification is obtained, the safety block 202 in the FPGA can be frozen so that the non-safety part of the FPGA 201 can be programmed without obtaining re-certification for safety aspects. Figure 3 In the example of , the safety block 202 of the FPGA 201 includes a transmitter / receiver (TX / RX) 203, which can be configured to perform communication with the control unit 10 using black channel communication. In a corresponding manner, the control unit 10 includes a functional safety device (arrangement, unit, device) configured to implement one or more safety functions. Figure 3 In the example of , this functional safety device is also implemented by the safety block 102 of the field programmable gate array (FPGA) 101. Figure 3 In the example shown, the security block 102 of the FPGA 101 includes a transmitter / receiver (TX / RX) 103 that can be configured to communicate with the device(s) 20 using black channel communication. Black channel communication of functional safety-related data between the device(s) 20 and the control unit 10 can then be implemented by encrypting such data in the transmitter / receiver 103, 203 of the security authentication block 102, 202 of the sending FPGA 101, 201, transmitting the encrypted data via the standard communication channel 30, and then decrypting the received data in the transmitter / receiver 103, 203 of the security authentication block 102, 202 of the receiving FPGA 101, 201. It should be noted that the FPGA circuit in the above example is presented merely as a possible example for implementing a security authentication block. However, any other suitable circuit or circuit structure may be used in place of or in addition to such an FPGA circuit to implement a functional safety device in the device(s) 20 or control unit 10.

[0024] According to one embodiment, providing the data to be transmitted with an indicator indicating the functional safety supervision group to which the considered transmitting device is configured comprises encoding the indicator in a data packet comprising the data to be transmitted. Figure 4An example of a data packet 400 according to an embodiment is disclosed. According to the example shown, an indicator indicating the functional safety supervision group of the transmitting device, the FS group ID, may be embedded in a header 402 of the data packet 400 containing functional safety related data 403 (FS data), e.g. after further header data 401. Furthermore, the data packet may be provided with a cyclic redundancy check (CRC) value 404, which is calculated over the entire data packet 400, for example. This may be used to ensure that the content of the data packet 400 has not been changed during its transmission. However, it should be noted that the indicator may also be attached to the data sent from the connected devices 20, 21, 22, 23, 24 to the control unit 10 in another way, which depends, for example, on the characteristics of the system under consideration and / or the communication protocol(s) used on the data link 30. According to an embodiment, for example in Figure 4 The exemplary data packet structure disclosed in , or any corresponding data packet structure generally including an indicator indicating a functional safety supervision group, can be used as an additional layer in communications such that the data packet 400 is encapsulated in one or more data packets of, for example, an underlying black channel security protocol. According to another embodiment, the black channel security protocol data packet structure used can be configured such that it is in a predetermined portion of the header of the security protocol data packet (e.g., substantially as shown in FIG. 1 ). Figure 4 as shown) or include an indicator indicating the functional safety supervision group in another suitable predetermined part of the safety protocol data packet.

[0025] According to one embodiment, devices 20, 21, 22, 23, 24 include a switching device 204 for configuring a functional safety supervision group of the device. According to one embodiment, the communication device 203 of the device 20, 21, 22, 23, 24 is configured to transmit data to the control unit 10 using black channel communication, and is then configured to provide the transmitted data with an indicator indicating the functional safety supervision group of the power unit configured by the switching device 204. The switching device 204 for configuring the functional safety supervision group of the device may include at least one safety-related switch (selector) for configuring the functional safety supervision group of the device. According to one embodiment, the at least one safety-related switch may be a safety-certified switch. According to one embodiment, the at least one safety-related switch may include a mechanical and / or electrical switch. The term "safety-related" herein generally refers to compliance with the requirements of one or more relevant safety standards or regulations, which may be system- and / or application-specific. For example, such standards may be IEC 61508 and / or IEC 62061 and / or another such standard or regulation. The term "safety certified" as used herein generally refers to a device that satisfies any relevant safety standards or regulations as required or applicable in a certified manner. Possible examples of such switches include, for example, one or more of the following: a set of lock-protected DIP switches located under a cover, a rotary switch operable with a key or protected by a lockable cover, or a digital, password-protected human-machine interface. However, it should be noted that such a switch arrangement 204, which allows, for example, a user or operator of the system to configure (assign) the functional safety supervision group of devices 20, 21, 22, 23, 24, can be implemented in various ways. The advantage of using such a device-specific switch arrangement 204 to configure the functional safety supervision group of devices 20, 21, 22, 23, 24 is that the configuration of devices 20, 21, 22, 23, 24 connected to a single control unit 10 can be changed in a simple manner, even under field conditions, for example during system commissioning and / or possible reconfiguration. Furthermore, this automatic identification of the safety topology in the system can improve the user experience. Furthermore, the use of such a safety-related or safety-certified switching device 204 can ensure that the functional safety supervision group instructions configured by the switching device 204 and provided from the devices 20, 21, 22, 23, 24 to the control unit 10 also comply with the required or applicable (multiple) relevant safety standards or (multiple) regulations in the system.

[0026] For example, if a control unit has software for both grid-side and motor-side control of an inverter device, then in order to handle the motor-side safety functions, the control unit should be able to safely detect which power stages (power units) belong to the motor side and which power stages (power units) belong to the grid side. Utilizing the embodiments disclosed herein, the control unit can safely detect that these power stages (power units) will be monitored as a single inverter based on the fact that the functional safety supervision groups are non-zero and have the same number. Thus, for example, existing safety logic can be used without requiring the user or operator to separately insert safety configurations into the control unit.

[0027] As another example, if a control unit is controlling an inverter device consisting of multiple power stages (power cells) that are categorized in a functional safety supervision group and in separate functional safety supervision subgroups, the number of such power stages to be monitored can be safely inferred, for example, without having to specifically enter the exact number of active power stages. This can be important for simplified operation functionality: if the electric drive initially has, for example, 6 power stages (in supervision group 1, and in subgroups 1 to 6), the drive can safely calculate the number of power stages based on the securely encoded functional safety supervision group data received from the power stages. In the case of simplified operation, one or more of the power stages are removed, and using the embodiments disclosed herein, the control unit can now safely detect that these remaining power stages will be monitored as a single inverter based on the fact that the functional safety supervision groups are, for example, non-zero and have the same number. Thus, in this example, even in this simplified operation, existing safety logic can be used without the user having to separately insert safety configurations into the controller.

[0028] Any means within a control unit and / or within a device connected to the control unit for implementing at least part of the functionality according to any embodiment or combination of embodiments herein may be implemented as a single physical unit or as two or more independent physical units configured to implement the functionality. The term "unit" herein generally refers to a physical or logical entity, such as a physical device or a portion thereof, or a software routine. The means for implementing at least part of the functionality according to any embodiment herein may be implemented, at least in part, by, for example, one or more computers or corresponding digital signal processing (DSP) devices equipped with appropriate software. Such computers or DSP devices preferably include at least one working memory (RAM) providing storage area for arithmetic operations and a central processing unit (CPU), such as a general-purpose digital signal processor. The CPU may include a set of registers, an arithmetic logic unit, and a control unit. The CPU control unit is controlled by a series of program instructions transferred from the RAM to the CPU. The CPU control unit may include multiple microinstructions for basic operations. The implementation of the microinstructions may vary depending on the CPU design. The program instructions may be encoded in a programming language, which may be a high-level programming language such as C, Java, etc., or a low-level programming language such as machine language or assembly language. The computer may also include an operating system that provides system services for computer programs written using program instructions. A computer or other device implementing various embodiments or portions thereof may also include suitable input devices for receiving, for example, measurement and / or control data, and output devices for outputting, for example, control or any other data (e.g., a determined heat load). Specific integrated circuits or circuits, such as application-specific integrated circuits (ASICs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), and / or discrete electronic components and devices, may also be used to implement at least part of the functionality according to any embodiment. Any such computer and / or other device and / or software implementing various embodiments or portions thereof is preferably implemented in accordance with any relevant requirements of safety standards and / or regulations required or applied by the system. Any such computer or other device and / or software implementing various embodiments or portions thereof may obtain safety certification in accordance with relevant requirements of safety standards and / or regulations required or applied by the system.

[0029] Many electrical devices, such as components of electric power systems, for example, electric drives and their components, may include processors and memory, which can be used to implement the functionality according to various embodiments described herein. Therefore, at least some modifications and configurations that may be required to implement an embodiment can be implemented as software routines, which can be implemented as added or updated software routines. If at least part of the functionality of any embodiment is implemented by software, such software can be provided as a computer program product, which includes computer program code that, when executed on a computer, causes the computer or a corresponding arrangement to perform the functionality according to the embodiments described herein. Such computer program code can be stored or generally embodied on a computer-readable medium, such as a suitable memory, such as flash memory or optical memory, from which it can be loaded into a unit that executes the program code. Furthermore, such computer program code that implements any embodiment can be loaded into a unit that executes the computer program code via a suitable data network, and can replace or update any existing program code. Embodiments may provide a computer program embodied on any client-readable distribution / data storage medium or storage unit or article of manufacture, including program instructions executable by one or more processors / computers, which, when loaded into a device, constitute a monitoring arrangement, or any corresponding unit or entity that provides the corresponding functionality, or at least part of the corresponding functionality. Programs, also called program products, include software routines, program fragments forming a "program library", applets and macros, which can be stored on any medium and downloaded to a device. In other words, e.g. Figures 1 to 4 Each or some or one of the possible units / sub-units and / or algorithms for one or more functions / operations described in any one of the foregoing and any combination thereof may be an element comprising one or more arithmetic logic units, a plurality of special purpose registers and control circuits.

[0030] It is obvious to a person skilled in the art that, as technology advances, the inventive concept can be implemented in various ways.The invention and its embodiments are not limited to the examples described above, but may vary within the scope of the claims.

Claims

1. A method for functional safety supervision of an electric power system, the electric power system comprising a control unit and a plurality of devices connected to the control unit, the method comprising: configuring the plurality of devices into two or more functional safety supervision groups; as well as Data is transmitted from one or more of the plurality of devices to the control unit using black channel communication, wherein the transmitting comprises providing an indicator in the transmitting device for the data to be transmitted, the indicator indicating the functional safety supervision group to which the transmitting device under consideration is configured.

2. The method according to claim 1, further comprising: receiving, in the control unit, the data transmitted from one or more devices among the plurality of devices; as well as The functional safety supervision group indicated by the indicator provided with the received data is identified in the control unit.

3. The method according to claim 2, further comprising: The received data are processed in the control unit according to the identified functional safety supervision group. 4 . The method of claim 1 , wherein providing the indicator for the data to be transmitted comprises encoding the indicator in a data packet comprising the data to be transmitted. 5 . The method according to claim 1 , wherein the two or more functional safety supervision groups include one or more main groups and one or more subgroups of the one or more main groups. 6 . The method according to claim 1 , wherein the two or more functional safety supervision groups include at least one group in which functional safety supervision is disabled. 7 . The method according to claim 1 , wherein the plurality of devices include at least one power unit and / or at least one auxiliary device controlled by the control unit.

8. The method of claim 7, wherein the at least one power unit comprises at least one power unit configured to be connected to an electric motor and / or at least one power unit configured to be connected to a power grid, wherein the power unit comprises an inverter or a power stage of an inverter device.

9. The method according to any one of claims 1 to 3, wherein the transmitted data are functional safety-related data. 10 . The method according to claim 9 , wherein the functional safety-related data is related to a safe torque off (STO) safety function and / or a safely limited speed (SLS) safety function.

11. An electric power unit, comprising: a functional safety device configured to implement one or more safety functions; a switch device for configuring a functional safety supervision group of the power unit; as well as A communication device is configured to transmit data to a control unit controlling the power unit via a communication channel using black channel communication, wherein the communication device is configured to provide an indicator for the data to be transmitted, the indicator indicating the functional safety supervision group of the power unit configured by the switching device.

12. The electrical power unit according to claim 11, wherein the switch arrangement comprises at least one safety-related or safety-certified switch for configuring a functional safety supervision group of the power unit. 13 . The electrical power unit according to claim 12 , wherein the at least one safety-related or safety-certified switch comprises a mechanical switch and / or an electrical switch.

14. The electric power unit according to any one of claims 11 to 13, wherein the communication device is configured to provide the data to be transmitted with the indicator by encoding the indicator in a data packet comprising the data to be transmitted to the control unit. 15 . The electric power unit according to claim 11 , wherein the transmitted data is functional safety-related data related to the one or more safety functions implemented by the functional safety device. 16 . The electric power unit according to claim 15 , wherein the one or more safety functions implemented by the functional safety device include at least a safe torque off (STO) safety function and / or a safely limited speed (SLS) safety function.

17. An electrical power unit according to any one of claims 11 to 13, wherein the power unit is configured to be connected to an electric motor and / or to be connected to an electrical grid, and wherein the power unit comprises an inverter or a power stage of an inverter device. 18 . An electric power system comprising at least two electric power units according to claim 11 and a control unit configured to control the at least two electric power units.

19. The electric power system according to claim 18, wherein the control unit comprises: a communication device configured to receive the data transmitted from the at least two electric power units via the communication channel using the black channel communication; as well as A processing device is configured to identify the functional safety supervision group indicated by the indicator provided with the received data.

20. The electric power system of claim 19, wherein the processing device is further configured to process the received data according to the identified functional safety supervision group.

Images