METHOD AND DEVICE FOR AUTOMATIC VALIDATION OF SAFETY FUNCTIONS ON A MODULARLY DESIGNED SAFETY SYSTEM

Description

[0001] The invention relates to a method for the automatic validation of safety functions of a modular safety system comprising subsystem modules according to claim 1, as well as a checking device designed for this purpose according to claim 9, a device comprising a correspondingly designed subsystem module and a corresponding system according to claim 10.

[0002] To reduce risks to people or the environment in automated processes, machines, and systems, safety functions must be implemented, such as shutting down a machine after an emergency stop button is pressed or transferring the system to a safe state after a fault is detected. Fail-safe automation systems are increasingly being used within automated processes, machines, and systems. Generally, these fail-safe automation systems implement the actual safety function (such as emergency stop, two-hand control, operating mode selector switch, etc.) on the one hand, and fault-detecting and fault-controlling measures according to mechanisms defined, for example, in standards (IEC 61508, ISO13849, etc.) that correspond to the current state of the art.

[0003] The IEC 61508 series of standards, which particularly relates to safety, also includes the application of various methods for controlling errors, such as the avoidance of systematic errors during development, monitoring during operation to detect random errors and / or the safe control of detected errors and the transition to a previously defined safe state. All of these measures can be part of certain, pre-defined safety functions. In general, it can be said that two- or multi-channel systems, in which each channel can independently trigger a safety function, can achieve a higher SIL with less technical effort than those that only have one channel. The term "channel" refers to the flow of information through a safety chain (safety loop), starting, for example, with the request for a safety function (e.g.by a sensor, proximity detector, light barrier or button), ending with the actuator or control element that initiates the safe state of a machine.

[0004] Electrical safety is therefore not part of this safety within the scope of the invention.

[0005] If suitable measures ensure that an electrical, electronic and / or programmable system, or even an individual hardware and / or software component, effectively fulfills a specific safety function, this system or the respective component is considered safe or safety-related within the scope of the following description and the claims. A system that is intended to fulfill specific safety functions and is constructed from a plurality of subsystem modules, i.e., at least two or more than two subsystem modules, each of which is intended to fulfill safety functions, is considered a safety system within the scope of the invention.If no safety-relevant requirements apply to a system, or even to an individual hardware and / or software component, and thus the fulfillment of a specific safety function for the system or the individual hardware and / or software component cannot be guaranteed through appropriate measures, this system or the respective component is considered non-safe or a standard system or standard component within the scope of the following description and claims. A safety system and a standard system can, in turn, be part of a hierarchically higher-level system.

[0006] Depending on the size of the system and the level of automation, current machines and systems use communication systems such as Ethernet-based networks or fieldbuses to connect decentralized I / O devices (input / output devices such as sensors or actuators) and controllers. Secure communication protocols are generally used to transmit safety-relevant data.

[0007] Secure network protocols are now standardized, e.g., in IEC 61784-3. This standard describes different security profiles based on the principles of secure network communication. All of these network protocols must handle the various error models, such as corruption, loss, delay, transposition, etc. of data and / or telegrams. They define error-detecting and error-control measures with knowledge of the underlying standard network protocol, e.g., fieldbus- or Ethernet-based communication standards, and the error models possible in these networks. The so-called black channel principle is often used for this purpose. The standardized security protocols have in common that they describe security communication within a clearly defined and limited, closed network space. For example, there are restrictions on the number and distribution of standards and secure network participants.

[0008] The effectiveness of risk-minimizing technical measures in machines and / or systems must be demonstrated during commissioning of a machine or system through a comprehensive safety validation. This involves verifying the effectiveness of all safety functions before the machine or system enters the operational phase. This is still manageable for a complete and unmodified machine or system, but becomes increasingly complex in the increasingly common modular machines or systems.

[0009] If, in addition, a large number of machines and / or systems are used within a system which (also) have to implement safety functions together, these form subsystem modules of the system within the scope of the invention, which then together forms one or more safety systems from the large number of these subsystem modules. An example of such a safety system is a punching system which is made up of a feeding machine, a punching machine and an ejection machine, all three of which have to implement certain safety functions, whereby the punching system as a whole must also be regarded as a safety system, i.e. when the individual subsystem modules interact (i.e. according to the example the feeding machine, punching machine and ejection machine), certain safety functions must be implemented.Such a safety system within the scope of the invention therefore generally comprises several fail-safe automation systems arranged in different subsystem modules within a system, i.e., an overall system, but interacting within the system and forming a safety system across the participating subsystem modules. Accordingly, the effectiveness of the risk-minimizing technical measures must be demonstrated through an overall safety validation of the safety system across the participating subsystem modules.

[0010] The relevant safety standards and guidelines require machine manufacturers to specify safety-relevant parameters such as failure rates, diagnostic coverage, safe failure fraction, or response times for individual modules, i.e., in particular, for the aforementioned subsystem modules, i.e., individual machines and / or systems. If a machine or system within a system is composed of several individual modules, depending on the fine-grained breakdown considered, these modules, in turn, form subsystem modules within the scope of the invention, which then form a safety system only when the corresponding machine or system is assembled.However, the compilation and merging of these subsystem modules requires relevant safety-related knowledge, which is not always available to the machine operator, who merely assembles an (overall) system including an (overall) machine from individual modules, i.e. subsystem modules, which can be obtained from manufacturers.

[0011] Today's world is characterized by cyber-physical systems (CPS), distributed intelligence, and the Internet of Things (IoT). Industry 4.0 describes the influx of internet technologies into automation technology. The complete networking of intelligent devices, from sensors / actuators to controllers, is the prerequisite for modularization, reuse, and adaptability of machine modules. Production processes can then be further optimized, and production can be carried out in batch sizes of one, for example. The integration and use of cloud services enables predictive diagnostics, for example.

[0012] Current safety standards such as IEC 61508, EN 13849, IEC 62061, etc., only partially address the modularization of machine functions, dynamic configuration changes, or adaptive combinations of previously unknown safety modules. For example, a modular system or a modular machine with safety functions interacting across multiple modules must undergo a comprehensive safety validation before commissioning. If the system or machine configuration changes, e.g., when replacing an individual module or as a result of aging processes within individual modules, new error analyses, error calculations, and validation steps must be performed to demonstrate the required safety category (or safety level), e.g., SIL4, for the system or machine. This does not meet the flexibility requirements of operators of modular systems and machines.

[0013] The applicant's EP 2 053 476 describes, among other things, a safety server that, using a safety agent, can coordinate secure communication within a closed network and execute safety functions. The telegrams between the safety participants are actively routed by the non-safety safety agent. The task of the safety server is to execute safety functions using network-based access to safe inputs and outputs.

[0014] The applicant's Safety Bridge system, certified since 2009, uses non-safety network masters (or a non-safety standard controller) within the data path between safe logic modules and their assigned satellites (safety I / O devices) as non-safety routers for the safe telegrams. In one embodiment, special function blocks ultimately copy the telegrams from one safe node to another, creating a point-to-point relationship. For this routing process, the non-safety network master (or the non-safety standard controller) must know and manage the addresses of the connected safe nodes. This results in a certain amount of additional configuration and parameterization effort. Furthermore, routing within the standard controller also entails a certain amount of performance overhead.

[0015] DE 10 2004 020 994 B4 describes how a secure configuration tool supports a developer of a safety switching device during hardware design by applying and verifying specific computer-implemented rule sets. Accordingly, a plurality of circuit components are provided, selected, and linked. Furthermore, a plurality of rule sets are provided, each rule set in turn containing a plurality of safety-related design rules. At least one of the rule sets contains a design rule that requires multi-channel redundant output signals from the circuit components and / or a feedback loop for each output signal.The electrical circuit is further divided into sub-areas. For each of the sub-areas, a rule set is defined before the circuit components are selected and linked. The rule set defined thereby is selected and a check is carried out to determine whether the selected and linked circuit components fully comply with the design rules of this defined rule set. This allows or prevents any subsequent selection and / or linking of circuit components depending on the selected defined rule set, with the defined rule set being displayed. This is intended to make the design of safety-related circuits easier and faster without compromising the fault tolerance of the designed circuit. Designing refers to the design of a specific circuit as a complete system.First, individual rule sets, each containing a large number of safety-related design rules, are defined and selected for this circuit, and then the circuit components that correspond to the design rules of the respective rule sets are selected and linked.

[0016] EP 2 605 096 B1 describes a mechanism for additional verification of security rules within a cloud, in which secure outputs are not issued until two different computers within the inherently unsecure cloud have verifiably performed independent verification. In this case, the cloud effectively assumes an additional security function alongside the central security control system present in the automation system.

[0017] Another publication, "An Effective Verification and Validation Strategy for Safety Critical Embedded Systems" by Manju nanda and Jayanthi, discloses a validation and verification procedure for submodules of a safety-critical system.

[0018] A key objective of the invention is therefore to provide secure validation, particularly online validation, of modular safety systems (safety-relevant systems), particularly of dynamic and / or configuration-changing, particularly adaptively changing, modular safety systems. The goal is to further simplify and, preferably, completely automate the validation of safety functions, particularly after configuration changes and / or during the operating phase of a system or machine. Furthermore, it is advantageous if faulty (overall) configurations can be detected early or in advance, and particularly online, and prevented or rejected.

[0019] The solution according to the invention is provided by an object according to one of the appended claims, the object of the dependent claims being preferred and expedient embodiments of the solution according to the invention.

[0020] Accordingly, the invention proposes a method for the automatic validation of safety functions of a modular safety system comprising subsystem modules, wherein a checking device is or can be connected to the safety system, which method comprises the steps: a) Storing safety-relevant target values ​​of a system which forms a safety system which is to be modularly constructed or constructed from a plurality of subsystem modules, i.e. from at least two or more than two subsystem modules, in particular residual error probabilities, failure rates and / or total reaction times, in machine-readable form in the memory of a checking device, b) Storing local, module-specific safety-relevant actual values ​​of at least each individual subsystem module which is or is to be used for the modular construction of the safety system of the system, in machine-readable form in the respective subsystem module, c) Transferring the local, module-specific safety-relevant actual values ​​from the individual subsystem modules which are to modularly construct the safety system of the system or currently modularly construct the safety system of the system,to the checking device, in particular after it has been connected to the safety system, d) automatic processing of the transmitted, in particular read, local, module-specific safety-relevant actual characteristic values ​​to form overall safety-relevant actual characteristic values ​​resulting from the interaction of the individual subsystem modules, namely by the checking device, e) automatic comparison of the resulting overall safety-relevant actual characteristic values ​​with the target characteristic values ​​of the system stored in the memory of the checking device, namely by the checking device and f) automatic generation of a reaction signal depending on the result of the comparison, wherein a reaction signal is generated if a threshold value is not reached with regard to at least one difference value resulting from the comparison.

[0021] In a particularly preferred embodiment, it is provided that with the generated reaction signal, if a threshold value is not reached with regard to at least one difference value resulting from the comparison, the current safety functions of the safety system are automatically released by the checking device and / or if the threshold value is exceeded, release of the current safety functions of the safety system by the checking device is automatically refused, wherein in particular a predetermined safety-relevant reaction is triggered in each individual subsystem module that currently forms the safety system of the system in a modular manner.

[0022] According to the invention, the checking device, which is expediently connected to the safety system via a network, checks, in particular ONLINE, i.e. during ongoing operation, and continuously or repeatedly, the overall configuration of the modular safety system constructed with subsystem modules, which in practical implementation particularly comprise various machine modules and / or system modules, with regard to compliance with safety-relevant parameters, such as, in particular, residual error probability, failure rates and / or overall reaction times. By transmitting the safety-relevant actual parameters of the subsystem modules to the checking device, in particular by the checking device having read access to the safety-relevant actual parameters of the subsystem modules, the safety-relevant target parameters to be achieved can be monitored.If these target values ​​are not achieved, the checking device can, if necessary, also transfer individual subsystem modules, which in practical implementation particularly comprise various machine modules and / or system modules, or even the system as a whole, into a safe state. The reaction of the checking device upon reaching and / or not reaching the target values ​​or other rules can preferably be freely configured or parameterized. Furthermore, in an expedient embodiment, the checking device according to the invention can, for example, also check a planned reconfiguration or configuration change of the safety system in advance, i.e. OFFLINE and therefore before commissioning of the safety system, and approve or reject it.

[0023] It should therefore be noted that steps a) to f) do not necessarily have to be carried out online but can, depending on the design, at least partially be carried out offline.

[0024] The checking device can be part of a device already connected to the safety system. It can, for example, be part of a control device, one of the subsystem modules, or part of another device already connected. The phrase "part of a device already connected to the safety system" implies that such a device at least assumes or can assume the function of the checking device. However, the invention also includes, in particular, embodiments in which the checking device is or can be connected to the safety system as a further module designed as a checking device in addition to the subsystem modules.

[0025] According to one embodiment, the invention includes embodiments in which the safety-relevant actual characteristic values ​​stored in the individual subsystem modules and / or the safety-relevant target characteristic values ​​stored in the checking device change dynamically at runtime.

[0026] The invention further provides, in addition or as an alternative, to carry out at least the above-mentioned steps c) to f) with each configuration change of the safety system constructed modularly with subsystem modules and / or to carry out at least the above-mentioned steps c) to f) cyclically or at other predetermined times.

[0027] The invention thus makes it possible in a simple manner to automatically check the resulting overall safety function, especially whenever overall safety functions change, e.g. due to changes in the overall structure or changes in individual partial safety functions or their dependencies, e.g. due to removal, replacement or additional integration of subsystem modules or due to dynamically changing safety-relevant characteristic values ​​during runtime.

[0028] Additionally or alternatively, however, it is also provided that at least steps c) to f) are carried out upon request, in particular upon request from a central control device or at least one of the subsystem modules. Consequently, such a check can be initiated whenever it is assumed that a "new" check regarding compliance with the safety-relevant target values ​​to be achieved, i.e., the target parameters, is required. This can be done, for example, by a user, but in particular by the central control device or at least one of the subsystem modules if they "believe" a check is necessary, for example due to dynamically changing parameters.

[0029] According to a particularly preferred embodiment, step d) is carried out by means of a set of rules which can be accessed by the checking device.

[0030] This allows not only the individual values ​​of the respective subsystem modules to be added together when considering the safety functions of a composite modular system as a whole, but also allows data flow-dependent influences and other architecture-dependent rules that affect the overall value to be taken into account. These are not always easily understood and are therefore particularly error-prone according to the state of the art. The invention thus preferably also enables the consideration of structural information that provides information about the structural composition of the (safety) system. Using the invention, a machine operator of a modular safety system is, for the first time, able to automatically test and validate the effectiveness of all individual modules, even in their combined entirety.A particular advantage here is that the set of rules can be stored in advance in the verification device itself or in a central control device in such a way that the verification device can access it, or the set of rules can only be compiled using module-specific logical and / or physical position data, e.g., by reading out or otherwise informing the verification device of the logical and / or physical addresses of the connected subsystem modules. Such a set of rules used by the verification device can thus also be available or prepared in a suitable manner, application- and / or design-specific, e.g., in the form of machine-readable code, tables, parameters, etc.Such a set of rules is also appropriately updated, in particular in the event of changes to the overall safety functions, the overall structure or individual partial safety functions or their dependencies, in particular automatically updated, e.g. by reloading new or changed rules, which are then stored in the verification device or can be accessed or compiled again by the verification device.

[0031] According to further expedient embodiments of the invention, the checking device is connected to the security system via the Internet and / or is provided as a cloud service on the Internet and / or communication between the checking device and the subsystem modules is secured via secure communication protocols and / or the checking device itself is designed as a safety-related device.

[0032] This allows the subject matter of the invention to be adapted extremely flexibly to respective applications, so that, depending on the complexity of the underlying system, in addition to private networks, public networks, the Internet, and / or clouds can also be integrated, via which, in particular, the verification device can be connected to the security system to be validated. Securing communication via secure communication protocols is particularly expedient because the data, signals, and characteristic values ​​transmitted during communication between the verification device and the subsystem modules are generally themselves security-relevant. Therefore, in embodiments according to the invention, two different, independently but redundantly operating units do not have to be provided in the verification device, particularly for steps d) and e).In addition or alternatively, however, according to a preferred embodiment, it may also be provided that the checking device itself is also designed to be safety-relevant, in which case at least its hardware structure expediently corresponds to a required safety category (level), e.g. through multi-channel capability and / or suitable diversity.

[0033] According to the invention, a checking device is further provided which comprises a memory in which safety-relevant target characteristic values ​​of a system which forms a safety system which is to be constructed or constructed modularly from at least two or a larger number of subsystem modules, in particular residual error probabilities, failure rates and / or total reaction times, can be stored or are stored in machine-readable form, and which is designed to carry out the method according to the invention with corresponding units.In particular, with a communication unit for transmitting local, module-specific safety-relevant actual characteristic values, which are stored in machine-readable form in individual subsystem modules which are intended to modularly construct the system's safety system or currently modularly construct the system's safety system, to the testing device; as well as with a processing unit for automatically processing the read-out, local, module-specific safety-relevant actual characteristic values ​​to produce overarching safety-relevant actual characteristic values ​​resulting from the interaction of the individual subsystem modules; with a comparison unit for automatically comparing the resulting overarching safety-relevant actual characteristic values ​​with the target characteristic values ​​of the system stored in the memory; and with a signal generation unit for automatically generating a reaction signal depending on the comparison result.

[0034] The communication unit can be adapted to read out the local, module-specific safety-relevant actual values ​​stored in individual subsystem modules.

[0035] Furthermore, the generated, in particular freely configurable or parameterizable, reaction signal can be used in a practical manner not only to report the existence of a release and / or non-release.Particularly preferably, if a threshold value is not reached with respect to at least one difference value resulting from the comparison, the reaction signal is generated by the signal generation unit as an enable signal which can be used to automatically "release" the current safety functions of the safety system, and / or if the threshold value is exceeded, the reaction signal is generated as a non-release signal which can be used to automatically fail to release the current safety functions of the safety system by the checking device, wherein in particular a predetermined safety-relevant reaction is triggered in each individual subsystem module which currently makes up the modular safety system of the system.

[0036] Furthermore, the invention proposes a device comprising a subsystem module suitable for constructing a safety system that is modularly constructed or constructed from at least two or a larger number of subsystem modules. Local, module-specific, safety-relevant actual characteristic values ​​are stored in machine-readable form in the subsystem module, and the subsystem module is designed to carry out the method according to the invention with a unit for transmitting the local, module-specific, safety-relevant actual characteristic values ​​to a checking device according to the invention, and in particular with a unit for receiving a response signal from the checking device according to the invention.The unit for receiving a reaction signal is expediently designed in particular for receiving a non-release signal from the checking device, wherein in particular a predetermined safety-relevant reaction is triggered in the subsystem module and / or for receiving a release signal from the checking device.

[0037] The invention further proposes a corresponding system that forms a modular safety system composed of a plurality of subsystem modules outlined above, or is constructed from them, and in a preferred embodiment further comprises a testing device outlined above. However, such a testing device can additionally or alternatively be provided jointly at a "central location" for several such systems according to the invention, e.g., centrally at a TÜV (Technical Inspection Association) that is solely responsible for this worldwide.

[0038] Further features and advantages will become apparent from the following description of various embodiments based on the drawings. The drawing shows: Fig. 1 shows a partial section of a system for controlling an automated process (not shown in detail) comprising various machines and / or systems, with first exemplary embodiments of a safety system which is modularly constructed from a large number of subsystem modules, to which a checking device is additionally connected as a further module via a bus for the automatic validation of safety functions of the safety system, and Fig. 2 shows a partial section of a system for controlling an automated process (not shown in detail) comprising various machines and / or systems, with second exemplary embodiments of a safety system which is modularly constructed from a large number of subsystem modules, to which a checking device is additionally connected as a further module via the Internet for the automatic validation of safety functions of the safety system.

[0039] The following will be primarily based on the Fig. 1 preferred embodiments of the invention are discussed, wherein in the Figuren 1 and 2 identical or equivalent components are given the same reference symbols.

[0040] Fig. 1 shows a partial section of a system for controlling an automated process (not shown in detail) comprising various machines and / or systems, with a first exemplary embodiment of a safety system 10 which is modularly constructed from at least two subsystem modules, in the case shown a safety system 10 which is modularly constructed from three subsystem modules 1, 2, 3, to which a checking device 30 is additionally connected as a further module via a bus 50 as a communication system for the automatic validation of safety functions of the safety system 10, and a further first exemplary embodiment of a safety system 20 which is modularly constructed from a plurality of four subsystem modules 1, 2, 3, 4.

[0041] The subsystem modules 1, 2 and 3 have hardware and / or software units. In the present example, these subsystem modules 1, 2 and 3, which together form a safety system, are a machine module A, a machine module B and a machine module C. For example, the machine module A is a feeding machine, the machine module B a punching machine and the machine module C an ejection machine, so that the subsystem modules 1, 2 and 3 in the example shown form a punching system that is to be viewed as a whole as a safety system 10. For example, all three subsystem modules 1, 2 and 3 must each implement certain safety functions, whereby in each case the safety system 10 to be viewed as a whole, i.e. when the individual subsystem modules 1, 2, 3 interact, must implement certain safety functions.Such a safety system within the scope of the invention therefore generally has several fail-safe automation systems which are arranged in different subsystem modules within a system, i.e. an overall system, but which interact within the system and form a safety system across the participating subsystem modules.

[0042] Each of the subsystem modules 1, 2, and 3 is therefore suitable for constructing a safety system that is modularly constructed or constructed from at least two or a larger number of subsystem modules. Furthermore, in each of the subsystem modules 1, 2, and 3, local, module-specific safety-relevant actual characteristic values ​​SK of the individual subsystem module 1, 2, or 3 are stored in machine-readable form, e.g., in a corresponding memory not shown in detail for reasons of clarity. Such local, module-specific safety-relevant actual characteristic values ​​SK include, in particular, failure rates, diagnostic coverage, safe failure fraction, response times, and / or other safety-relevant key figures, parameters, and process data.

[0043] The checking device 30 comprises a memory 31, in which safety-relevant target values ​​of the system as a whole, which forms the safety system 10, which is modularly constructed from the plurality of subsystem modules 1, 2, 3, can be stored or are stored in machine-readable form. Such safety-relevant target values ​​can include, in particular, residual error probabilities, failure rates, total response times, and / or other safety-relevant key figures, parameters, and process data related to the system as a whole.

[0044] Furthermore, each of the subsystem modules 1, 2 and 3 is designed with a (communication) unit 1-1, 2-1, 3-1 for transmitting the local, module-specific safety-relevant actual characteristic values ​​SK to the verification device 30.

[0045] The verification device 30 is also equipped with a communication unit 32 for transmitting the local, module-specific safety-relevant characteristic values ​​SK stored in individual subsystem modules 1, 2, and 3. According to an expedient embodiment, the communication unit 32 is designed to read the local, module-specific safety-relevant characteristic values ​​SK stored in individual subsystem modules 1, 2, and 3.

[0046] In the present case, these units 1-1, 2-1, 3-1 and 32 are, for example, a suitably adapted communication interface via which the local, module-specific safety-relevant actual characteristic values ​​SK can be transmitted via the bus 50 by means of a correspondingly used network protocol, i.e. in particular can be read out from the corresponding memory of the subsystem module 1, 2 or 3.

[0047] The checking device 30 further comprises a processing unit 33 for automatically processing read-out, local, module-specific safety-relevant actual characteristic values ​​SK to form overall safety-relevant actual characteristic values ​​resulting from the interaction of the individual subsystem modules, as well as a comparison unit 34 for automatically comparing the resulting overall safety-relevant actual characteristic values ​​with safety-relevant target characteristic values ​​of the system as a whole stored in the memory 31.

[0048] In addition, the checking device 30 has a unit, in particular a signaling unit 35 and, in an expedient embodiment, in particular a signaling unit with appropriately designed logic, for automatically generating a reaction signal depending on the comparison result.

[0049] With such a reaction signal, compliance with safety-relevant parameters and / or non-compliance with safety-relevant parameters can be automatically reported by the checking device 30 in response to the comparison result, e.g., to a central control device not shown in the figures and / or to the subsystem modules and / or, in the simplest form, simply via an optical display for a user controlled by the reaction signal. The reaction to the comparison result and thus the reaction signal is preferably freely configurable or parameterizable.

[0050] In a preferred embodiment, the signal generation unit 35 is designed, in particular with appropriately designed logic, to generate a release signal as a reaction signal if a threshold value is not reached with regard to at least one difference value resulting from the comparison, which can be used to automatically "release" the current safety functions of the safety system, and the checking device 30 is then connected to the safety system, in particular also for automatically "release" the current safety functions of the safety system.

[0051] Additionally or alternatively, the signal generation unit 35 is configured, in particular with appropriately configured logic in a preferred embodiment, to generate a non-release signal as a reaction signal when the threshold value is exceeded. This non-release signal can be used to automatically fail the release of the current safety functions of the safety system by the checking device. In particular, a predetermined safety-relevant reaction is triggered in each of the subsystem modules that currently make up the modular safety system. The checking device 30 is then connected to the safety system in a manner particularly suitable for automatically failing the release of the current safety functions of the safety system.

[0052] In a preferred embodiment, the subsystem modules 1, 2, and 3 each have a (communication) unit 1-2, 2-2, and 3-2, i.e., in particular, a communication interface, for receiving such a reaction signal from the checking device. In a preferred embodiment, the units 1-2, 2-2, and 3-2 are designed as communication interfaces for receiving an enable signal from the checking device 30 and / or for receiving a non-enable signal from the checking device 30, wherein, in particular, a predetermined safety-relevant reaction is triggered in the subsystem module.

[0053] As is known, a safety-relevant system should generally be fully or partially transferred to a safe state upon detection of a fault. Therefore, within the scope of the invention, the subsystem modules 1, 2, and 3 will generally each have a unit 1-2, 2-2, and 3-2 for receiving a non-release signal from the checking device 30, and the checking device 30 will generally have a signaling unit 35 at least for automatically failing the release by the checking device 30 if the threshold value is exceeded. The signaling unit 35 is interconnected with the units 1-2, 2-2, and 3-2.Depending on the application, however, a safety-relevant system can also be designed such that it requires an enable signal at least for its commissioning and / or at least after a configuration change and / or detects an error during operation after a certain time interval has elapsed without there being a current confirmation of error-free functionality or error-free operation. Therefore, as an optional embodiment within the scope of the invention, the subsystem modules 1, 2, 3 can also each have just one unit 1-2, 2-2 and 3-2 for receiving an enable signal from the checking device 30, and the checking device 30 can have a signaling unit 35 for automatic release by the checking device 30 if the threshold value is not reached. Of course, a combination is also within the scope of the invention depending on the application.

[0054] In any case, however, in practical implementation, the reaction of the checking device 30 when the threshold value is reached and / or exceeded, i.e. in particular when target values ​​or other rules are reached and / or not reached, is preferably parameterizable.

[0055] In Fig. 1 The steps of a readout are shown by dashed arrows pointing towards unit 32, and the steps of a release or non-release are shown by dashed arrows pointing from unit 35.

[0056] With subsystem modules 1, 2 and 3 and the testing device 30 configured and designed in this way, an automatic validation of safety functions of a safety system 10 constructed modularly with the subsystem modules 1, 2 and 3 can be carried out, wherein according to Fig. 1 In addition to the subsystem modules, the further module designed as a checking device 30 is or can be connected to the safety system. On the one hand, the safety-relevant target characteristic values ​​of the system which forms the safety system 10 which is or is to be modularly constructed from a plurality of subsystem modules, in particular residual error probabilities, failure rates and / or total reaction times, are stored in machine-readable form in the memory 31 of the checking device 30. On the other hand, the local, module-specific safety-relevant actual characteristic values ​​SK of at least each individual subsystem module 1, 2 and 3 which is or is to be used for the modular construction of the safety system 10 of the system, are stored in machine-readable form in the respective subsystem module.Based on this, the local, module-specific safety-relevant actual characteristic values ​​SK from the individual subsystem modules 1, 2 and 3, which are intended to modularly construct the system's safety system or currently modularly construct the system's safety system 10, are then transferred to the checking device 30, in particular read out by the checking device 30. The transfer of the local, module-specific safety-relevant characteristic values ​​SK is expediently carried out ONLINE and permanently or repeatedly, and thus in particular when the checking device is connected to the safety system and during ongoing operation. Depending on the design, however, the transfer, in particular also a readout, can alternatively also be carried out offline, i.e.A planned reconfiguration or configuration change of the safety system can also be checked, particularly in advance and thus before commissioning the safety system, and approved or rejected. Furthermore, the checking device 30 can, for example, be used in a preferred embodiment to check in advance whether a planned reconfiguration or reconfiguration of an entire system or safety system would be feasible, possibly without having the entire safety system connected. In other words, in this case, the check would not be based on actual actual parameters or actual online parameters at runtime, but rather a "scenario" would be specified to the checking unit, which would then not immediately lead to a safety-relevant error reaction if it does not fit. The specification of such a "scenario" can, for example,by storing and transferring, in particular by reading out, local, module-specific safety-relevant actual characteristic values ​​in or from subsystem modules which are intended to build the safety system but have not yet built it.

[0057] In addition, depending on the design, the transmission, in particular also by reading, can also be carried out in an alternative embodiment if the checking device 30 is not connected to the safety system 30 as a whole, but the reading of the safety-relevant actual characteristic values ​​SK from the subsystem modules 1, 2 and 3 is also made possible in another way via appropriately adapted units 1-1, 2-1, 3-1 and 32, e.g. via units 1-1, 2-1, 3-1 and 32 designed as radio units.

[0058] After the safety-relevant actual characteristic values ​​SK from the subsystem modules 1, 2 and 3 have been transferred to the checking device 30, these are automatically processed by the checking device 30 to produce overall safety-relevant actual characteristic values ​​resulting from the interaction of the individual subsystem modules and the resulting overall safety-relevant characteristic values ​​are automatically compared with the target characteristic values ​​of the system stored in the memory of the checking device.

[0059] Based on the respective application-specific design, the checking device then automatically generates a signal in response to the comparison result either if a threshold value is not reached with regard to at least one difference value resulting from the comparison, which signalizes that the resulting, overall safety-relevant actual characteristic values ​​have been deemed permissible by the checking device and the current safety functions of the safety system can be or are to be released, and / or if the threshold value is exceeded, the checking device automatically generates a signal which signalizes that the release of the current safety functions of the safety system is refused by the checking device,In particular, a predetermined safety-relevant reaction can be triggered in each of the subsystem modules that currently form the modular safety system of the system. The signals preferably generated by the checking device for this purpose can be communicated, depending on the application, to a higher-level system device, such as a central control device not shown in the figures, or, as in , Fig. 1 shown to communicate with the individual subsystem modules 1, 2 and 3.

[0060] By transmitting the safety-relevant actual characteristic values ​​SK of the subsystem modules 1, 2 and 3 to the checking device 30, in particular by the checking device 30 having read access to the safety-relevant actual characteristic values ​​SK of c1, 2 and 3, safety-relevant target values ​​to be achieved can be monitored and, if these target values ​​are not achieved, the checking device can preferably transfer individual subsystem modules or the system as a whole into a safe state.

[0061] The system's safety-relevant target values ​​can be stored in the memory of the verification device 30 in a variety of ways, for example, manually by a manufacturer / user, e.g., based on a predefined safety category, or the system's safety-relevant target values ​​are stored in a higher-level system device, such as a central control device not shown in the figures, and communicated to the verification device. The local, module-specific actual safety-relevant values ​​are preferably stored in subsystem modules 1, 2, and 3 before they are integrated into the system and form the safety system 10.

[0062] Consequently, it is not absolutely necessary to carry out all of the above-mentioned steps of storing, transmitting, processing, comparing and / or generating a reaction signal, i.e. in particular also releasing and / or not releasing the safety functions, online, but depending on the design, some of these steps can also be carried out offline.

[0063] In any case, however, the invention provides, in a suitable embodiment, that in the event of configuration changes or readjustments, the safety-relevant target values ​​of the system stored in the memory of the checking device 30 are adjusted accordingly. Consequently, in a suitable embodiment, the checking device 30 according to the invention can, for example, also check a planned configuration change in advance and preferably approve or reject it.

[0064] Since, depending on the configuration, the invention also encompasses embodiments in which the safety-relevant actual characteristic values ​​stored in the individual subsystem modules and / or the safety-relevant target characteristic values ​​stored in the checking device change dynamically during runtime, the modules and device involved are preferably adapted such that at least the steps of transmitting, processing, comparing and / or generating a reaction signal, i.e. in particular releasing and / or non-releasing, are carried out at least upon each configuration change of the safety system modularly constructed with subsystem modules and / or such that at least the steps of transmitting, processing, comparing and / or generating a reaction signal, i.e. in particular releasing and / or non-releasing, are carried out cyclically or at other predetermined times,in particular temporarily or at intervals during specific operating states. To detect safety-relevant characteristic values ​​that change dynamically during runtime, the subsystem modules can, for example, contain self-diagnostic logic units. Additionally or alternatively, the invention further provides, in one embodiment, that at least steps c) to f) are carried out upon request, in particular upon request from a central control device or at least one of the subsystem modules. Thus, in an expedient embodiment, the subsystem modules and the checking device, including units 1-1, 2-1, 3-1, and 32, can, for example, also be adapted such that the subsystem modules themselves, i.e., of their own accord, transmit the respective safety-relevant actual characteristic values ​​SK to the checking device 30, e.g., upon change in the actual characteristic values ​​of the subsystem modules.

[0065] Thus, the invention can be used to automatically check the resulting overall safety function, in particular whenever overall safety functions change, e.g. due to changes in the overall structure or changes in the individual partial safety functions or their dependencies, e.g. due to removal, replacement or additional integration of subsystem modules or as a result of safety-relevant characteristic values ​​changing dynamically during runtime (e.g. due to aging).

[0066] For example, in Fig. 1 The safety system 10, which is constructed from the subsystem modules 1, 2 and 3, after a configuration change by adding a further subsystem module 4, which in particular ensures an additional partial safety function, then forms the safety system 20. The subsystem module 4 to be added has a unit 4-1 corresponding to the units 1-1, 2-1 and 3-1 as well as a unit 4-2 corresponding to the units 1-2, 2-2 and 3-2 and is in Fig. 1 referred to as machine module D and, for example, in the case of the aforementioned punching machine, represents a sorting machine downstream of the ejection machine referred to as machine module C. The entire safety system 20 of the modified punching machine is therefore composed of the machine modules A, B, C, and D.

[0067] According to one embodiment, each subsystem module 1, 2, 3 and 4 of the safety system 20 thus contains local, module-specific safety functions such as monitoring protective doors or loading / unloading areas and / or shutting down the respective machine module when safety requirements or errors are detected.

[0068] However, the interaction of subsystem modules 1, 2, 3 and 4 of the safety system 20 results in different or more extensive overall safety functions, such as a system-wide emergency stop or shutdown of sub-areas (of several machine modules) when errors are detected within a machine module or in the communication between machine modules, than in the interaction of only subsystem modules 1, 2 and 3 of the safety system 10.

[0069] Consequently, the overall safety function of the safety system 10 before the configuration change is different from that of the safety system 20 after the configuration change.

[0070] For example, safety-relevant reaction times in the data flow from machine module A to D can be longer than those from A to C. Furthermore, the residual error probability of the overall safety function of the safety system 20 could be greater than that of the overall safety function of the safety system 10. In the worst case, the new, overarching safety-relevant actual characteristic values ​​of the safety system 20 resulting from the configuration change and resulting from the interaction of the individual subsystem modules 1 to 4 no longer meet the requirements for the overall safety function of the safety system 20 or of the system as a whole or of the entire machine, ie in the present example the punching system, which are necessary for risk minimization.

[0071] For example, the Figur 1 The machine modules shown communicate with each other with a response time of 10 ms. This means that a maximum of 20 ms passes from the detection of a safety requirement in machine module A to the fail-safe response in machine module C (assuming a sequential linking of the machine modules, as in Fig. 1 outlined). After adding machine module D, the reaction time from the detection of a safety requirement in machine module A to the shutdown in machine module D results in a total reaction time of a maximum of 30 ms, which would possibly be outside the specified total reaction time (assumed 25 ms), i.e., the safety-relevant target values ​​of the system stored in the verification device 30. According to the state of the art, this discrepancy cannot be automatically detected by any of the individual subsystem modules 1 to 4 or even machine module AD alone.

[0072] The example of reaction times is an easy-to-understand example. However, there are far more complex relationships between partial safety functions, which are partly determined by dependencies between partial safety functions, the programming, and / or the structure of the overall system.

[0073] With current resources, the operator of the entire system would have to consider possible configuration changes in advance, compile the necessary metrics, check them, and validate them. In the worst case, they would have to retest the effectiveness of their error-detection measures after the configuration change during the operational phase.

[0074] According to a particularly preferred embodiment, it is therefore provided that the checking device 30 can access a set of rules when automatically processing the read-out local module-specific safety-relevant actual characteristic values ​​to form overarching safety-relevant actual characteristic values ​​resulting from the interaction of the individual subsystem modules.

[0075] This allows not only the individual values ​​of the respective subsystem modules to be added together when considering the safety functions of a composite modular system as a whole, but also allows data flow-dependent influences and other architecture-dependent rules that influence the overall value to be taken into account. These are not always easy to understand and are therefore particularly error-prone according to the state of the art. The invention thus preferably also enables the consideration of such structural information that provides information about the structural composition of the (safety) system. By means of the invention, a machine operator of a modular safety system is for the first time able to automatically test and validate the effectiveness of all individual modules, even in their combined entirety. A particular advantage here is that the set of rules can be stored in advance in the testing device itself, e.g.in the memory 31, or in a central control device not shown in the figures, such that the checking device can access it, or the set of rules can also be compiled using module-specific logical and / or physical position data, e.g., by reading out or otherwise informing the checking device of the logical and / or physical addresses of the connected subsystem modules. Such a set of rules used by the checking device can thus also be available or prepared in a suitable manner, application- and / or design-specific, e.g., in the form of machine-readable code, tables, parameters, etc. Such a set of rules is also suitably updated, in particular automatically, in particular in the event of changes to the overall safety functions, the overall structure, or individual partial safety functions or their dependencies.by loading new or modified rules, which are then stored in the verification device or can be accessed or compiled by the verification device. Such a set of rules can be broken down into finely granular rules for specific applications.

[0076] According to the invention, the checking device 30, which can also be referred to as a safety validator, now monitors, preferably online at runtime, compliance with the required safety requirements with regard to the subsystems involved in an overall safety function or the respective subsystem modules which implement the partial safety functions required for this purpose.

[0077] As already shown above, the safety-relevant parameters to be checked can also change during runtime, so that a suitable online check within the checking device 30 can be carried out even without changing the configuration of the entire system, ie according to Fig. 1 Without changing the safety system 10, the safety system 20 can change from the "OK" state (i.e., enabled) to the "Not OK" state (i.e., not enabled), and the failure of the enable signal is signaled, for example, by a corresponding not enabled signal. Changing safety-relevant parameters, especially actual parameters, can result, for example, from aging components, increasing operating life of machine modules, or an excessive number of switching cycles of safety relays.

[0078] In variation of Fig. 1 , in which both the subsystem modules 1, 2, 3 of a modularly constructed safety system 10 or the subsystem modules 1, 2, 3, 4 of a modularly constructed safety system 20 and the checking device 30 are connected to a local network, e.g. to the bus 50 as a communication system by means of corresponding bus coupling units 51, the checking device 30, as in Fig. 2 shown, for example, via Internet access points (IAPs) 5 and 5' and the Internet, e.g. including using cloud technologies 6, to the overall system. It should be noted that in Fig. 2 For reasons of clarity, the representation of units 31 to 35 according to Fig. 1 corresponding units were omitted. However, such a verification device 30 can also be provided additionally or alternatively jointly at a "central location" for several such complete systems according to the invention, e.g., centrally at a TÜV (Technical Inspection Association) that is solely responsible for this worldwide. In particular, in these cases, the verification device 30 thus accesses the system with the safety functions to be validated via a "remote connection." In a further modification to Fig. 2 A verification facility can also be provided as a cloud service on the Internet.

[0079] In a preferred embodiment, the communication between the checking device 30 and the subsystem modules 1, 2 and 3 or 1, 2, 3 and 4 is secured via secure communication protocols.

[0080] This allows the subject matter of the invention to be adapted extremely flexibly to respective applications, so that, depending on the complexity of the underlying system, in addition to private networks, public networks, the Internet, and / or clouds can also be integrated, via which, in particular, the verification device can be connected to the security system to be validated. Securing communication via secure communication protocols is particularly expedient because the data, signals, and characteristic values ​​transmitted during communication between the verification device and the subsystem modules are generally themselves security-relevant. Therefore, in embodiments according to the invention, two different, independently but redundantly operating units do not have to be provided in the verification device, particularly for steps d) and e).In addition or alternatively, however, according to a preferred embodiment, it may also be provided for the verification device itself to be security-relevant, whereby at least its hardware structure, e.g., through multi-channel capability and / or suitable diversity, corresponds to a required security category (level). In particular, if the verification device is provided as a cloud service and thus preferably software-based on the Internet, additional security measures within the knowledge and skills of a specialist are expediently provided in this case if the verification device does not run on security-relevant hardware.

[0081] The subject matter of the invention thus enables, in a particularly preferred embodiment, a validation, in particular online validation, of modular machines and systems based on implemented rule sets or sets of rules and secure communication interfaces for testing, in particular online testing, of specific machine and system configurations. IT mechanisms (server, cloud) can be taken into account here. Furthermore, network-capable products can be prepared to meet the future requirements of the "Industry 4.0" environment. Automated modular machines and systems can thus also change their configuration at runtime using a verification device according to the invention, which is connected via the intranet and / or internet, without the need for manual security validations when configuration changes occur.

[0082] Even though the above description has primarily focused on embodiments in which the checking device is or can be connected to the security system as a further module designed as a checking device in addition to the subsystem modules, the checking device can also, within the scope of the invention, be part of a device already connected to the security system. It can, for example, be part of a control device, e.g. the aforementioned central control device, or part of one of the subsystem modules, or part of another device already connected. The wording "part of a device already connected to the security system" implies that such a device takes over or can take over at least the function of the checking device.

[0083] The validation effort, especially for adaptive safe modular machines, is thus significantly simplified and the resulting flexibility of safe modular machines is significantly increased. List of reference symbols:

[0084] 1, 2, 3, 4, subsystem modules; 1-1, 2-1, 3-1, 4-1 (communication) units; 1-2, 2-2, 3-2, 4-2 (communication) units; 5, 5' internet access points; 6 cloud technologies; 10, 20 security system; 30 verification device; 31 memory; 32 communication unit; 33 processing unit; 34 comparison unit; 35 signal generation unit; 50 bus; 51 bus coupling units

Claims

1. Method for automatically validating safety functions of a safety system (10, 20) which is modularly constructed with subsystem modules (1, 2, 3, 4), is intended to fulfill specific safety functions and is to be constructed or is constructed from at least two subsystem modules (1, 2, 3, 4), which subsystem modules (1, 2, 3, 4) are each in turn intended to fulfill safety functions, and wherein a checking device (30) is connected or can be connected to the safety system (10, 20), comprising the steps: a) storing of safety-relevant nominal characteristic values, in particular of residual fault probabilities, failure rates and / or total reaction times, in machine-readable form in a memory (31) of a checking device (30), of a system which forms a safety system (10, 20) and is to be constructed or is constructed modularly from the at least two subsystem modules (1, 2, 3, 4), b) storing of local, module-specific safety-relevant actual characteristic values in each of the individual subsystem modules (1, 2, 3, 4), which is used or can be used for the modular construction of the safety system (10, 20) of the system, in machine-readable form in the respective subsystem module (1, 2, 3, 4), c) transmitting the local, module-specific safety-relevant actual characteristic values from the individual subsystem modules (1, 2, 3, 4), which are to construct the safety system (10, 20) or currently construct the safety system (10, 20) of the system in modular form, to the checking device (30), in particular by reading out the local, module-specific safety-relevant actual characteristic values by the checking device (30) , in particular after this has been connected to the safety system (10, 20); characterized by the following steps: d) processing, by the checking device (30), the transmitted, in particular read out by the checking device (30), local, module-specific safety-relevant actual characteristic values, to safety-relevant actual characteristic values of the safety system (10, 20), which result when the individual subsystem modules (1, 2, 3, 4) interact and when the safety system (10, 20) is constructed spanning the individual subsystem modules (1, 2, 3,4), e) comparing, by the checking device (30), the resulting safety-relevant actual characteristic values of the safety system (10, 20) with the nominal characteristic values of the system stored in the memory (31) of the checking device (30) and f) generating a reaction signal as a function of the comparison result, with the generated reaction signal being used to automatically release current safety functions of the safety system (10, 20) by the checking device (30) if a threshold value is not reached with regard to at least one difference value resulting from the comparison and / or to automatically refuse to release current safety functions of the safety system (10, 20) by the checking device (30) if the threshold value is exceeded with regard to at least one difference value resulting from the comparison.

2. Method according to claim 1, characterized in that, in the event that a release of the current safety functions of the safety system (10, 20) is refused by the checking device (30), a predetermined safety-relevant reaction is triggered in each of the subsystem modules (1, 2, 3, 4) currently modularly constructing the safety system (10, 20) of the system.

3. Method according to claim 1 or 2, characterized in that steps a) to f) are carried out online or at least partially offline.

4. Method according to one of claims 1, 2 or 3, wherein the safety-relevant actual characteristic values stored in the individual subsystem modules (1, 2, 3, 4) and / or the safety-relevant nominal characteristic values stored in the checking device (30) change dynamically at runtime.

5. Method according to any one of claims 1 to 4, wherein the checking device (30) is or can be connected to the safety system (10, 20) as a further module designed as a checking device (30) in addition to the subsystem modules (1, 2, 3, 4), or wherein the checking device (30) is part of a device already connected to the safety system (10, 20).

6. Method according to any one of claims 1 to 4, wherein the checking device (30) is connected to the safety system (10, 20) via the Internet and / or is provided as a cloud service in the Internet and / or wherein a communication between the checking device (30) and the subsystem modules (1, 2, 3, 4) is secured via safety communication protocols and / or wherein the checking device (30) is designed as a safety-oriented device.

7. Method according to one of claims 1 to 6, wherein at least steps c) to f) are carried out for each configuration change of the safety system (10, 20) which is modularly constructed with subsystem modules (1, 2, 3, 4) and / or wherein at least steps c) to f) are carried out cyclically and / or wherein at least steps c) to f) are carried out on request, in particular on request from a central control device or at least one of the subsystem modules (1, 2, 3, 4).

8. Method according to any one of claims 1 to 7, wherein step d) is performed by means of a set of rules, which can be accessed by the checking device (30).

9. Checking device (30)having a memory (31), in which safety-relevant nominal characteristic values, in particular of residual fault probabilities, failure rates and / or total reaction times, are stored in machine-readable form of a system which forms a safety system (10, 20) and is to be constructed or is constructed modularly from at least two subsystem modules (1, 2, 3, 4), wherein the checking device (30) is adapted to perform at least the steps d) - f) of the method according to claim 1 or according to any one of claims 2-8 based thereon, having - a communication unit (32) which is designed to read-out, local, module-specific safety-relevant actual characteristic values being stored in machine-readable form in individual subsystem modules (1, 2, 3, 4), - a processing unit (33) which is designed to process the read-out, local, module-specific safety-relevant actual characteristic values to safety-relevant actual characteristic values of the safety system (10, 20) which result when the individual subsystem modules (1, 2, 3, 4) interact and when the safety system (10, 20) is constructed spanning the individual subsystem modules (1, 2, 3, 4) ; - a comparison unit (34) which is designed to compare the resulting safety-relevant actual characteristic values of the safety system (10, 20) with the nominal characteristic values of the system stored in the memory (31); and - a signal generation unit (35) adapted to generate a response signal as a function of the comparison result, and further formed, to generate, if a threshold value is not reached with regard to at least one difference value resulting from the comparison, a release signal as a reaction signal, which is used to automatically "release" current safety functions of the safety system (10, 20), and / or to generate, if the threshold value is exceeded with regard to at least one difference value resulting from the comparison, a non-release signal as a reaction signal, which is used to automatically refuse to release current safety functions of the safety system (10, 20).

10. System forming a safety system (10, 20), which is to be constructed or is constructed modularly from the at least two subsystem modules (1, 2, 3, 4), wherein the safety system (10, 20) is designed to fulfill certain safety functions and the at least two subsystem modules (1, 2, 3, 4) are designed to each fulfill safety functions on their own, wherein local, module-specific safety-relevant actual characteristic values are stored in machine-readable form in each of the at least two subsystem modules (1, 2, 3, 4), and each of the at least two subsystem modules (1, 2, 3, 4) is designed to perform at least the steps d) - f) of the method according to claim 1 or according to any one of the claims 2 to 8 based thereon, with a unit (1-1, 2-1, 3-1, 4-1) which is designed to transmit the local, module-specific safety-relevant actual characteristic values to a checking device (30), which is to be connected or is connected to the safety system (10, 20) according to claim 9.

11. System according to claim 10, furthermore comprising the checking device (30) according to claim 9.

12. System according to claim 10 or 11, wherein each of the at least two subsystem modules (1, 2, 3, 4) comprises a unit (1-2, 2-2, 3-2, 4-2) for receiving a reaction signal by the checking device (30).

13. System according to claim 12, wherein the unit (1-2, 2-2, 3-2, 4-2) is adapted to receive a reaction signal for receiving a non-release signal by the checking device (30), wherein in particular in each of the at least two subsystem modules (1, 2, 3, 4) a predetermined safety-related reaction is triggered, and / or the unit (1-2, 2-2, 3-2, 4-2) is adapted to receive a reaction signal for receiving a release signal by the checking device (30).