System and method for transferring an operating software update to a security-oriented device

Description

[0001] The present invention relates to a system comprising a safety-related device, in particular a safety-related input / output module or a safety-related control device, and an electronic storage device separate therefrom, in which exactly one data content for the device is stored, as well as a method for transmitting exactly one data content from an electronic storage device to a safety-related device within this system.

[0002] To reduce risks to people or the environment in automated processes, machines and systems, safety functions must be implemented, such as shutting down a machine after an emergency stop button is pressed or transferring the system to a safe state after an error is detected. Fail-safe automation systems are increasingly being used within automated processes, machines and systems. In general, these fail-safe automation systems implement the actual safety function, such as emergency stop, two-hand control, operating mode selector switch, or similar, and also fault-detecting and fault-control measures in accordance with, for example, standards such as IEC 61508, ISO 13849 and other mechanisms that correspond to the current state of the art.If suitable measures are taken to ensure that an electrical, electronic and / or programmable electronic system, but also an individual subsystem module or an individual hardware and / or software component effectively fulfils a specific safety function, this system or the respective subsystem module is deemed to be safe or safety-related within the scope of the following description and the claims.

[0003] Safety-related devices, such as safety-related input / output modules and control devices of a machine or system that include one or more integrated processors and controllers, typically have an operating system. To keep this operating system up-to-date, and in particular to eliminate errors in the operating system or expand the functionality of the respective safety-related device, it is necessary for an operating software update to be loadable onto the safety-related devices, which can be initiated from the respective safety-related device.

[0004] For some safety-related devices, e.g. for at least some modules with protection class IP20, the device housing must be opened and a new operating system installed in the device using special programming adapters. This is usually only possible directly by the manufacturer of the device in question and cannot be done on-site at the user's site. However, this is particularly problematic for input / output modules with protection class IP67, as these input / output modules cannot be opened. If an operating system error is detected or the operating system needs to be updated, the only option is to replace these input / output modules with new ones with an updated operating system and to scrap the input / output modules without an updated operating system.

[0005] In the area of ​​functional safety technology, it must also be ensured that the appropriate version of the operating software update for the respective device is used when updating the operating system. It must be avoided at all costs that an incorrect version of an operating software update or an operating software update that is not suitable for the respective device is installed on the respective device.

[0006] To ensure this, EP 1 532 494 B1 discloses, among other things, a method for installing a new operating system on a safety controller and a corresponding operating program, in which a user, and not the manufacturer, independently installs a new operating program, i.e., new firmware, on an existing safety controller. The manufacturer's control over the safety device is maintained with the aid of special release information, because a new operating program is only installed if this installation is authorized by the manufacturer in the release information. Thus, with the aid of the method disclosed in EP 1 532 494 B1, it can be checked whether the new operating program is the version suitable for the respective safety controller.

[0007] US 2015 / 0050678 A1 discloses an analytical measuring device comprising a housing and an analysis module that can be electrically and mechanically connected to the housing. The analysis module has a memory in which firmware updates for various measuring devices can be stored. The analysis module can be detachably connected to the housing of various analytical measuring devices in order to transfer the corresponding firmware update to the respective housing.

[0008] An object of the present invention is to provide a system comprising a safety-related device and an electronic storage device separate therefrom, as well as a method in which a data content intended for the device, in particular an operating software update, can be transferred to the device in the version suitable for the device in an alternative, simplified and improved manner compared to the prior art.

[0009] As already mentioned at the beginning, within the scope of the present invention, a safety-oriented or safety-related device is preferably a safety-oriented input / output module or a safety-oriented control device that generates safety-related input signals and / or safety-related output signals or responds to safety-related input signals in order to execute safety-related control functions in the field of functional safety. Functional safety is described in detail, for example, in the textbook by Patrick Gehlen, "Functional Safety of Machinery and Plant: Implementation of the European Machinery Directive in Practice," 2nd revised edition, 2010, Publicis Publishing.

[0010] The object of the present invention is solved by the features of claim 1 and is developed and further developed by the features of the dependent claims.

[0011] Accordingly, a system is provided which comprises a safety-related device and a separate electronic storage device in which exactly one piece of data for the device is stored. The exactly one piece of data is either an operating software update or an address. The address is preferably a safety address. The electronic storage device has a first connection device for mechanically and electrically coupling to the safety-related device, wherein the first connection device comprises a first mechanical coding means. The safety-related device has a storage device in which an operating system is stored, a microcontroller and a second connection device for mechanically and electrically coupling to the electronic storage device, wherein the second connection device comprises a second mechanical coding means.The first mechanical coding means and the second mechanical coding means are configured to complement each other. The microcontroller of the device is configured to detect whether the electronic storage device is connected to the second connection device of the device via its first connection device. If this is the case, the microcontroller is further configured to download the exact data content stored in the electronic storage device from the electronic storage device to the storage device of the device.

[0012] A safety-related device, which can in particular be a safety-related input / output module or a safety-related control device, has, within the scope of the invention, in particular a firmware or an operating system that occasionally requires an update. Furthermore, the safety-related device can also be, for example, a laser scanner, a frequency converter, or a light grid.

[0013] In contrast to the state of the art, an electronic storage device is used to update an operating system. This storage device stores only one piece of data, either an operating software update or an address. If the one piece of data is an address, this address, which is used for communication between the safety-related device and other devices in a network infrastructure, for example, is downloaded once into the device's memory. In other words: Using the address, the safety-related device can be specifically addressed by other devices. If the one piece of data is an operating software update, this operating software update always corresponds to a specific version that is suitable and intended for the device.Since only one piece of data and thus only one operating software update is stored on the electronic storage device and mechanical coding means are used, in contrast to an electronic storage device with, for example, a large number of versions of an operating software update stored on it, it can be ruled out that an incorrect version of the operating software update is transferred from the electronic storage device to the device by mistake, for example due to confusion, or even intentionally.

[0014] Furthermore, the system provides that the first connection device of the electronic storage device comprises a first mechanical coding means, and the second connection device of the safety-related device comprises a second mechanical coding means, wherein the first and second mechanical coding means are configured to complement one another. This has the advantage that an electrical coupling of the electronic storage device to the device, and consequently a transfer of exactly one data content from the electronic storage device to the device, occurs in particular only when the first and second mechanical coding means are configured to complement one another accordingly, and consequently the electronic storage device is mechanically correctly coupled to the device via their respective mechanical coding means.Correct mechanical coupling means that the first mechanical coding means is mechanically coupled to the second mechanical coding means in the intended and planned manner, and in particular, that the first mechanical coding means is not forcibly coupled to the second mechanical coding means contrary to the intended and planned manner. In other words: The mechanical coding means ensure that only the electronic storage device belonging to or matching the respective device can be connected to this device.

[0015] Due to the fact that exactly one piece of data is stored on the electronic storage device in combination with the mechanical coding according to the invention, it is particularly easy to ensure that both the correct version of an operating software update and the version suitable for the device can be transferred from the electronic storage device to the device. For example, the mechanical coding can ensure the device's identifiability, so that only one operating software update suitable for the device's operating system is ever stored on the electronic storage device. Furthermore, because only a single piece of data, and thus in particular only a single operating software update, is stored on the device, it can be ensured that this operating software update is also available in the correct version for the device.

[0016] The device's microcontroller is configured and configured to control and monitor the device. With regard to the transfer of data content from the electronic storage device to the device, the microcontroller only needs to be configured and configured to detect whether the electronic storage device is connected to the device's second connection device. If this is the case, the microcontroller must be configured and configured to download the data content stored on the electronic storage device to the device's storage device. For example, an automatic check by the microcontroller to determine whether the data content, and in particular the operating software update, is the correct and suitable data content or the correct and suitable operating software update for the device is not required.Since the microcontroller does not have to be complex with regard to the transmission of data content, in particular an operating software update, this reduces the costs for the microcontroller and thus for the device.

[0017] The process of downloading an operating software update in the inventive system comprising an electronic storage device and a device is automatic, without, for example, the need to check release information as in EP 1 532 494 B1 or an activation code, or without a user having to specify which operating software update is to be downloaded. Compared to the aforementioned prior art, the system comprising an electronic storage device and a device is thus less complex and therefore more cost-effective and also less error-prone, which is an important consideration, particularly in the area of ​​functional safety.

[0018] Preferably, the device comprises a sensor configured to detect whether the electronic storage device is correctly mechanically coupled to the device.

[0019] In one embodiment of the invention, the sensor of the device is a touch sensor configured to send an electrical signal to the microcontroller indicating that the electronic storage device is correctly mechanically coupled to the device. Once the microcontroller receives the signal from the touch sensor indicating that a correct mechanical coupling between the electronic storage device and the device exists, the microcontroller downloads the exact data content stored in the electronic storage device to the device's memory.

[0020] The touch sensor can also display a visual signal or trigger an acoustic signal, for example, which indicates whether the electronic storage device is correctly mechanically coupled to the device. For example, an LED electrically coupled to the touch sensor can display a green light when there is correct mechanical coupling between the electronic storage device and the device, and a red light when there is no correct mechanical coupling between the electronic storage device and the device. This can give the user an early indication that a transfer of exactly one piece of data intended for the device from the electronic storage device to the device will not take place due to a lack of correct mechanical coupling between the electronic storage device and the device.

[0021] In one embodiment of the invention, the first mechanical coding means has a first defined mechanical configuration and the second mechanical coding means has a second defined mechanical configuration which is complementary to the first defined mechanical configuration. The first and second defined mechanical configurations can have any desired geometric configuration. For example, they can be a ribbing or a plurality of ribbings or a pronounced grid or pattern on at least part of a surface of the electronic storage device or device which faces the device or the electronic storage device when the electronic storage device is electrically and mechanically coupled to the device. The first and second defined mechanical configurations can also be in the form of one or more of said surfaces of the electronic storage device or device.of the device protruding element or elements such as pins, cuboids, prisms and much more, or correspondingly complementary shaped recesses or even a combination of protruding elements and recesses.

[0022] According to an advantageous further development of the present invention, the electronic storage device can store a data content identifier that indicates whether the exact one piece of data stored in the electronic storage device is an operating software update or an address for the safety-related device. For this purpose, the microcontroller can be configured, if the electronic storage device is connected to the device's second connection device via its first connection device, to first read and interpret the data content identifier from the electronic storage device and then, depending on the interpreted data content identifier, to download the operating software update or the address to the storage device and preferably start it there.

[0023] The address is used for communication between the safety-related device, for example with other input / output modules in a network infrastructure, and is downloaded once by the microcontroller into the device's memory.

[0024] Furthermore, the present invention also relates to a method for transmitting exactly one piece of data content from an electronic storage device to a safety-related device within the system according to the invention as described above. First, the device is disconnected from a power supply as part of the method according to the invention. When the device is de-energized or without current, the first connection device of the electronic storage device is electrically and mechanically coupled to the second connection device of the device, with electrical coupling only occurring when the first coding means is correctly mechanically coupled to the second coding means. After the device is connected to the power supply, the microcontroller of the device detects, preferably during device startup, whether the electronic storage device is connected to the second connection device of the device.If this is the case, the microcontroller downloads the exact data content stored in the electronic storage device from the electronic storage device to the device's memory. The electronic storage device is then electrically and mechanically decoupled from the device.

[0025] Preferably, in the method described above, the microcontroller can further detect whether the electronic storage device has been connected to the device for the first time. If this is the case, the microcontroller interprets the exact data content of the electronic storage device as an address. If this is not the case, however, the microcontroller interprets the exact data content of the electronic storage device as an operating software update.

[0026] For this purpose, the electronic storage device can store a data content identifier which indicates whether the precisely one piece of data stored in the electronic storage device is an operating software update or an address for the safety-related device, wherein before the precisely one piece of data stored in the electronic storage device is downloaded from the electronic storage device into the storage device of the device, the data content identifier is read out and interpreted by the microcontroller from the electronic storage device, wherein subsequently, in particular under the control of the microcontroller, the operating software update or the address is downloaded into the storage device and is preferably also started there depending on the interpreted data content identifier.

[0027] The invention is explained in more detail below using several exemplary embodiments in conjunction with the accompanying drawings. They show: Figure 1 shows an exemplary system comprising an electronic storage device and a safety-related device according to a first embodiment, Figure 2 shows an exemplary system comprising an electronic storage device and a safety-related device according to a second embodiment, Figure 3 shows an exemplary system comprising an electronic storage device and a safety-related device according to a third embodiment, and Figure 4 shows an exemplary system comprising an electronic storage device and a safety-related device according to a fourth embodiment.

[0028] Figure 1 shows a sketch and not to scale of a first embodiment of a system comprising a safety-related device 1, in the present case, by way of example, a safety-related input / output module (in Figure 1 below) and a separate electronic storage device 2 (in Figure 1above). According to an exemplary embodiment, a first, preferably exactly one, data content is stored in the electronic storage device 2, which is intended for the safety-related input / output module 1 (not in Figure 1 shown), where exactly one piece of data is either an operating software update or an address for the input / output module 1.

[0029] The electronic storage device 2 in Figure 1 has a first connecting device 3 for mechanical and electrical coupling with the input / output module 1 and the Figure 1 The input / output module 1 shown has a second connection device 5 for mechanically and electrically coupling it to the electronic storage device 2 at its first connection device 3. For electrical coupling, both the first connection device 3 of the electronic storage device 2 and the second connection device 5 of the input / output module are arranged in the Figure 1 In the embodiment shown, each is equipped with an electrical interface 9a, 9b, so that the electronic storage device 2 can be electrically coupled to the electrical interface 9b of the input / output module 1 via its electrical interface 9a. For mechanical coupling, however, the first connecting device 3 of the electronic storage device 2 comprises a first mechanical coding means 4, and the second connecting device 5 of the input / output module 1 comprises a second mechanical coding means 6, which is designed to be complementary to the first mechanical coding means 4.

[0030] The first mechanical coding means 4 of the electronic storage device 2 preferably has a first defined mechanical configuration 7. In Figure 1The first defined mechanical configuration 7 of the first mechanical coding means 4 consists of two elements, namely two cuboids, which protrude from the surface of the electronic storage device 2 facing the input / output module 1 when the electronic storage device 2 is electrically and mechanically coupled to the input / output module 1. However, a wide variety of other geometric shapes are also conceivable, and the number of protruding elements can be arbitrary, starting with one protruding element. Instead of protruding elements, complementary recesses or a combination of protruding elements and recesses can also be formed as the first defined mechanical configuration 7 on the electronic storage device 2.The second mechanical coding means 6 of the input / output module 1 preferably has a second defined mechanical configuration 8, which is complementary to the first defined mechanical configuration 7 of the first mechanical coding means 4. In the embodiment shown in . Figure 1 In the example shown, the second defined mechanical configuration 8 of the second mechanical coding means 6 consists of two cuboid-shaped recesses 7. These cuboid-shaped recesses 7 are formed on the surface of the input / output module 1 facing the electronic storage device 2 when the electronic storage device 2 is electrically and mechanically coupled to the input / output module 1 in such a way that they essentially completely accommodate the two protruding cuboids 7 of the first mechanical coding means 4 of the electronic storage device 2.

[0031] The Figure 1The safety-related input / output module 1 shown further comprises an interface 12 for connecting, for example, a field device (not shown), such as an actuator or sensor. In this case, the sensor is particularly designed to generate a safety-related input signal, while the actuator is particularly designed to generate a safety-related output signal. The safety-related input signal can, for example, signal that an emergency stop button has been actuated, while the safety-related output signal generated by the actuator can, for example, switch off a motor. In addition, the input / output module 1 comprises a microcontroller 10, which controls and monitors the input / output module 1, and a memory device 11, in which an operating system is stored and which is electrically coupled to the microcontroller 10. In the Figure 1In the exemplary embodiment shown, the input / output module 1 advantageously further comprises a sensor 13 which is electrically coupled to the second mechanical coding means 6 and preferably to the microcontroller 10 and is advantageously designed as a touch sensor 13. The touch sensor 13 is particularly designed to send an electrical signal to the microcontroller 10 when the electronic storage device 2 is electrically and mechanically coupled to the input / output module 1 (not shown), which electrical signal signals that the electronic storage device 2 is correctly mechanically coupled to the input / output module 1.A correct mechanical coupling means that the first mechanical coding means 4 is mechanically coupled to the second mechanical coding means 6 in the manner intended and planned for this purpose, and in particular that there is no forcible insertion of the first mechanical coding means 4 into the second mechanical coding means 6 contrary to the intended use, such as breaking off at least one of the protruding cuboids. The microcontroller 10, the memory device 11, and the touch sensor 13 are shown in the . Figure 1 shown in dashed lines, as they are located in Figure 1 are located inside the input / output module 1 and are not visible from the external view of the input / output module 1 shown.

[0032] According to an advantageous development, the safety-related device 1 can also be designed with multiple channels, for example, with two channels. In this case, the input / output module 1 comprises at least one further microcontroller 15, which controls and monitors the input / output module 1, and a further memory device 16, in which an operating system is stored and which is electrically coupled to the microcontroller 15. It should be noted that the microcontroller 10 and the microcontroller 15 can be different. For example, they come from different manufacturers. The touch sensor 13 is designed, in particular, to send an electrical signal to the microcontroller 15 when the electronic storage device 2 is electrically and mechanically coupled to the input / output module 1. This electrical signal signals that the electronic storage device 2 is correctly mechanically coupled to the input / output module 1.The microcontroller 15 and the memory device 16 are in the . Figure 1 shown in dashed lines, as they are located in Figure 1 are located inside the input / output module 1 and are not visible from the external view of the input / output module 1. According to this exemplary embodiment, a second data content is stored in the electronic storage device 2, which is intended for the two-channel safety-related input / output module 1 (not shown in Figure 1 shown), wherein the second data content is either an operating software update or an address for the input / output module 1, which may be identical to the address represented by the first data content. It should be noted that the two memory devices 11 and 16 each form a physical memory or may be implemented by a common memory in which they each form a memory area.

[0033] The functioning of the system comprising safety-related input / output module 1 and electronic storage device 2 according to the first exemplary embodiment is explained in more detail below. Precisely one data content for the safety-related input / output module 2 is stored in the electronic storage device 2, which is transferred from the electronic storage device 2 to the storage device 11 of the input / output module 2 as follows. First, the input / output module 2 is disconnected from a power supply (not shown in the figures). Subsequently, the electronic storage device 2 is electrically and mechanically coupled via its first connection device 3 to the second connection device 5 of the input / output module 1. An electrical coupling, which in the exemplary embodiment of the Figure 1by coupling the electrical interface 9a of the electronic storage device 2 to the electrical interface 9b of the input / output module 1, but is not shown in detail, only occurs when the first mechanical coding means 4 is correctly mechanically coupled to the second mechanical coding means 6, which is designed to complement the first. If the input / output module 1 preferably comprises a sensor 13, in particular a touch sensor 13, the latter detects whether a correct mechanical coupling is present. If this is the case, the touch sensor 13 sends a corresponding signal in this regard to the microcontroller 10 and, advantageously, also to an LED display 14 attached to the input / output module 1, which then displays a green light. However, if there is no correct mechanical coupling, the touch sensor 13 also signals this to the microcontroller 10 and the LED display 14.The LED display 14 then displays a red light and the microcontroller 10 takes no further steps with regard to the electronic storage device 2. If the touch sensor 13 reports an incorrect mechanical coupling, the microcontroller 10 therefore does not download the exact data content stored in the electronic storage device 2 into the memory device 11 of the input / output module 1.

[0034] After successful mechanical and electrical coupling, the input / output module 1 is connected to the power supply. The microcontroller 10 of the input / output module 1 preferably detects during the upload whether the electronic storage device 2 is connected via its first connection device 3 to the second connection device 5 of the input / output module 1. If this is the case, the microcontroller 10 downloads the exact data content stored in the electronic storage device 2 from the electronic storage device 2 to the storage device 11 of the input / output module 1. Preferably, the microcontroller 10 also detects whether the electronic storage device 2 has been connected to the input / output module 1 for the first time.If this is the case, the microcontroller 10 interprets the exact data content of the electronic storage device 2 as an address, which is used for communication between the input / output module 1, for example, and other input / output modules in a network infrastructure, and downloads this address into the memory device 11 of the input / output module 1. However, if the electronic storage device 2 has not been connected to the input / output module 1 for the first time, the microcontroller 10 interprets the exact data content of the electronic storage device 2 as an operating software update, downloads this operating software update into the memory device 11 of the input / output module 1, and in particular starts the operating software update in order to update the operating system stored in the memory device 11.Finally, the electronic storage device 2 is decoupled from the input / output module 1 both electrically and mechanically and thus removed from the input / output module 1.

[0035] According to an advantageous embodiment, a data content identifier can be stored in the electronic storage device 2, 2', 2", 2‴, which indicates whether the precisely one piece of data stored in the electronic storage device 2, 2', 2", 2‴ is an operating software update or an address for the safety-related device 1, 1', 1", 1‴. In this context, the microcontroller 10 can be designed to first read out and interpret the data content identifier from the electronic storage device 2, 2', 2", 2‴, if the electronic storage device 2, 2', 2", 2‴ is connected via its first connection device 3, 3', 3", 3‴ to the second connection device 5, 5', 5", 5‴ of the safety-related device 1, 1', 1", 1‴, and then, depending on the interpreted data content identifier to download the operating software update or the address into the storage device 11 and then start it if necessary.The location where the data content identifier is stored in the electronic storage device is known to the microcontroller 10. In practice, this will conveniently proceed as follows: when the safety-related device is used for the first time, an electronic storage device is first connected in which an address, in particular a safety address, is stored as data content for the safety-related device. Subsequently, i.e., during operation, an operating software update can usually be downloaded to the safety-related device using the electronic storage device and started there.

[0036] In order to download an operating software update efficiently and in an energy-saving manner, if the exact data content is an operating software update, the electronic storage device 2, 2', 2", 2‴ can additionally store an operating software update identifier. The operating software update identifier can, for example, be a checksum that has been formed over the operating software update and stored together with it in the electronic storage device 2. The microcontroller 10 can be designed to i) after reading and interpreting the data content identifier, read the operating software update identifier from the electronic storage device; ii) in response to the read operating software update identifier, check whether the corresponding operating software update is stored in the storage device, and only if the corresponding operating software update is not stored in the storage device 11, download the exact data content to the storage device. For this purpose, an identifier, for example the checksum of the operating software update stored in the electronic storage device, can also be stored in the microcontroller 10, which the microcontroller 10 then compares with the read operating software update identifier. In the event that no operating software update has yet been downloaded to the storage device 11, no update identifier is yet stored in the safety-related device.If the microcontroller 10 detects no match between the read operating software update identifier and the identifier stored in the memory device 11, it causes the operating software update to be downloaded from the electronic storage device and stored together with the operating software update identifier in the memory device 11. The microcontroller 10 detects a mismatch, for example, by the fact that no operating software update has yet been downloaded to the safety-related device. It should also be noted that the microcontroller 10 can use the operating software update identifier as the starting address under which exactly one piece of data can be found in the electronic storage device.If a file directory structure is used on the electronic storage device, a file name under which the microcontroller 10 can find exactly one data content can also be used as the operating software update identifier.

[0037] The functioning of the system comprising safety-related input / output module 1 and electronic storage device 2 is explained in more detail below according to the advantageous further development, according to which the safety-related device 1 is designed as a two-channel device.

[0038] A first data content and a second data content for the safety-related input / output module 2 are stored in the electronic storage device 2, which can each be an operating system update or an address. The first and second data content are transferred as follows from the electronic storage device 2 to the memory device 11 and the memory device 16 of the input / output module 1, respectively. First, the input / output module 1 is disconnected from a power supply (not shown in the figures). The electronic storage device 2 is then electrically and mechanically coupled via its first connection device 3 to the second connection device 5 of the input / output module 1. An electrical coupling, which in the exemplary embodiment of the Figure 1by coupling the electrical interface 9a of the electronic storage device 2 to the electrical interface 9b of the input / output module 1, but is not shown in detail, only occurs when the first mechanical coding means 4 is correctly mechanically coupled to the second mechanical coding means 6, which is designed to complement it. If the input / output module 1 preferably comprises a sensor 13, in particular a touch sensor, the sensor detects whether the mechanical coupling is correct. If this is the case, the touch sensor 13 sends a corresponding signal in this regard to the microcontroller 10 and the microcontroller 15, and advantageously also to an LED display 14 attached to the input / output module 1, which then displays a green light.However, if there is no correct mechanical coupling, the touch sensor 13 signals this to the microcontroller 10 and the microcontroller 15 and also to the LED display 14. The LED display 14 then displays a red light, and the microcontroller 10 takes no further action with respect to the electronic storage device 2. If the touch sensor 13 reports incorrect mechanical coupling, the microcontroller 10 therefore does not download the first data content stored in the electronic storage device 2 into the memory device 11 of the input / output module 1, and the microcontroller 15 therefore does not download the second data content stored in the electronic storage device 2 into the memory device 16 of the input / output module 1.

[0039] After successful mechanical and electrical coupling, the input / output module 1 is connected to the power supply. The microcontrollers 10 and 15 of the input / output module 1 preferably already detect during the upload whether the electronic storage device 2 is connected via its first connection device 3 to the second connection device 5 of the input / output module 1. If this is the case, the microcontroller 10 downloads the first data content stored in the electronic storage device 2 from the electronic storage device 2 to the storage device 11 of the input / output module 1, and the microcontroller 15 downloads the second data content stored in the electronic storage device 2 from the electronic storage device 2 to the storage device 16 of the input / output module 1.

[0040] Since the electronic storage device 2 can be used as an operating software update or address storage device, a data content identifier can be stored in the electronic storage device 2, which indicates whether the first and second data contents stored in the electronic storage device 2 are each an operating software update or an address for the safety-related device 1. The first microcontroller 10 can be configured, in the event that the electronic storage device 2 is connected to the second connection device 5 of the input / output module 1 via its first connection device 3, 3', 3", 3‴, first to read and interpret the data content identifier from the electronic storage device 2 and then, depending on the interpreted data content identifier, to download the respective operating software update or the respective address to the first storage device 11.wherein the second microcontroller 15 can be configured, in the event that the electronic storage device 2 is connected to the second connection device 5 of the input / output module 1 via its first connection device 3, to first read out and interpret the data content identifier from the electronic storage device 2 and then, depending on the interpreted data content identifier, to download the respective operating software update or the respective address to the second storage device 16.

[0041] In order to be able to carry out an operating software update efficiently and in an energy-saving manner, if the first data content and the second data content are each an operating software update, a first operating software update identifier assigned to the first data content and a second operating software update identifier assigned to the second data content can be stored in the electronic storage device 2. The first and second operating software update identifiers can, for example, each be a checksum formed over the first and second operating software updates, respectively. The first and second operating software update identifiers are stored together with the first and second data contents in the electronic storage device 2, wherein a logical or physical assignment exists between the first operating software update identifier and the first data content and between the second operating software update identifier and the second data content.In this case, the first microcontroller 10 can be designed to . i) after reading and interpreting the data content identifier, read the first operating software update identifier from the electronic storage device, ii) in response to the read first operating software update identifier, check whether the associated first operating software update is stored in the storage device 11, and only if the associated first operating software update is not stored in the storage device 11, download the first data content to the first storage device 11. Similarly, the second microcontroller 15 can be configured to i) after reading and interpreting the data content identifier, read the second operating software update identifier from the electronic storage device; ii) in response to the read second operating software update identifier, check whether the associated second operating software update is stored in the storage device 16, and only if the associated second operating software update is not stored in the storage device 16, download the second data content to the second storage device 16. It should also be noted that the microcontroller 10 can use the first operating software update identifier as the starting address under which the first data content can be found in the electronic storage device. If a file directory structure is used on the electronic storage device 2, a file name under which the microcontroller 10 can find the first data content can also be used as the first operating software update identifier.Similarly, depending on the implementation, the microcontroller 15 can use the second operating software update identifier as the starting address under which the second data content can be found in the electronic storage device. If a file directory structure is used on the electronic storage device 2, a file name under which the microcontroller 15 can find the second data content can also be used as the second operating software update identifier.

[0042] The Figures 2 , 3 and 4 differ from the Figure 1essentially only in that the first mechanical coding means 4', 4", 4‴ of the first connecting device 3', 3", 3‴ of the respective illustrated electronic storage device 2', 2", 2‴ and the second mechanical coding means 6', 6", 6‴ of the second connecting device 5', 5", 5‴ of the respective illustrated safety-related input / output module 1', 1", 1‴ have a first defined mechanical configuration 7', 7", 7‴ and a second defined mechanical configuration 8', 8", 8‴ which are different from those shown in Figures 1a, 1b.

[0043] In Figure 2 the first mechanical coding means 4' of the first connecting device 3' of the electronic storage device 2' (in Figure 2above) preferably has a first defined mechanical configuration 7', which consists of two specially structured areas, in particular provided with corrugations, on the surface of the electronic storage device 2'. The number and arrangement of the specially structured areas can vary. For example, the entire surface of the storage device 2' facing the input / output module 1' in the electrically and mechanically coupled state of the electronic storage device 2' with the input / output module 1' can also be provided with a special structuring, for example a corrugation, a wave structure, a comb-like structure, and much more. Various types of structuring can also be present as the first defined mechanical configuration 7'. The second mechanical coding means 6' of the second connecting device 5' of the input / output module 1' (in Figure 2below) accordingly has a second defined mechanical configuration 8' complementary to the first defined mechanical configuration 7'.

[0044] In Figure 3 the first mechanical coding means 4" of the first connecting device 3" of the electronic storage device 2" (in Figure 3above) preferably has a first defined mechanical configuration 7", which consists of two protruding elements, namely two cuboids, which are arranged at the electrical interface 9a. As an alternative to the cuboids, a wide variety of other geometric shapes are conceivable. The number of protruding elements can also be arbitrary, starting with one protruding element. Instead of protruding elements, recesses designed complementary thereto, or a combination of protruding elements and recesses in the electronic storage device 2" can also be designed as the first defined mechanical configuration 7". The second mechanical coding means 6" of the second connecting device 5" of the input / output module 1" (in Figure 3below) accordingly has a second defined mechanical configuration 8" complementary to the first defined mechanical configuration 7", specifically in Figure 3b in the form of two cuboid-shaped recesses at the electrical interface 9b.

[0045] In Figure 4 the first mechanical coding means 4‴ of the first connecting device 3‴ of the electronic storage device 2‴ (in Figure 4 above) preferably has a first defined mechanical configuration 7‴, which consists of a protruding element in the form of a prism. The second mechanical coding means 6‴ of the second connecting device 5‴ of the input / output module 1‴ (in Figure 4 below) accordingly has a second defined mechanical configuration 8‴ complementary to the first defined mechanical configuration 7‴, namely in the form of a prism-shaped recess.

[0046] Even if in the Figures 2 , 3 , 4 not explicitly shown, the safety-related input / output module 1', 1", 1‴ shown therein also has at least one microcontroller 10, a memory device 11 and an interface 12 for connecting a safety-related device, for example a sensor or actuator. Likewise, the respective safety-related input / output module 1', 1", 1‴ can be Figures 2 , 3 , 4 preferably have a sensor 13 coupled to the second mechanical coding means 6', 6", 6‴ and preferably also electrically coupled to the microcontroller 10, which in turn is advantageously coupled to an LED display 14 of the input / output module 1', 1", 1‴ and is designed as a touch sensor 13.

[0047] Instead of a Figures 1-4In the exemplary safety-related input / output module 1, 1', 1", 1‴, a safety-related control device or, for example, a laser scanner, frequency converter or a light grid can be used as a safety-related device.

[0048] Some of the exemplary aspects are summarized below.

[0049] A system is provided which comprises a safety-related device 1, 1', 1", 1‴ with at least a first microcontroller 10 and a second microcontroller 15, and an electronic storage device 2, 2', 2", 2‴, which is separate from the safety-related device and in which a first data content and a second data content for the safety-related device 1, 1', 1", 1‴ are stored. The first and second data contents can each be either an operating software update or an address. The electronic storage device 2, 2', 2", 2‴ can comprise a first connecting device 3, 3', 3", 3‴ for mechanically and electrically coupling to the device 1, 1', 1", 1‴, wherein the first connecting device 3, 3', 3", 3‴ comprises a first mechanical coding means 4, 4', 4", 4‴.

[0050] The safety-related device 1, 1', 1", 1‴ can comprise a first memory device 11, which is assigned to the first microcontroller 10 and in which a first operating system is stored, a second memory device 16, which is assigned to the second microcontroller 15 and in which a second operating system is stored, and a second connection device 5, 5', 5", 5‴ for mechanically and electrically coupling to the electronic storage device 2, 2', 2", 2‴, wherein the second connection device 5, 5', 5", 5‴ has a second mechanical coding means 6, 6', 6", 6‴, wherein the first mechanical coding means 4, 4', 4", 4‴ and the second mechanical coding means 6, 6', 6", 6‴ are designed to be complementary to one another.The first microcontroller 10 of the safety-related device 1, 1', 1", 1‴ can be configured to detect whether the electronic storage device 2, 2', 2", 2‴ is connected via its first connection device 3, 3', 3", 3‴ to the second connection device 5, 5', 5", 5‴ of the safety-related device 1, 1', 1", 1‴. In this case, the first microcontroller 10 can further be configured to download the first data content stored in the electronic storage device 2, 2', 2", 2‴ from the electronic storage device 2, 2', 2", 2‴ to the first storage device 11 of the device 1, 1', 1", 1‴, and wherein the second microcontroller 15 of the safety-related device 1, 1', 1", 1‴ can be designed to detect whether the electronic storage device 2, 2', 2", 2‴ is connected via its first connection device 3, 3', 3", 3‴ to the second connection device 5, 5', 5", 5‴ of the device 1, 1', 1", 1‴.In this case, the second microcontroller 15 may further be configured to download the second data content stored in the electronic storage device 2, 2', 2", 2‴ from the electronic storage device 2, 2', 2", 2‴ to the second storage device 16 of the device 1, 1', 1", 1‴.

[0051] The safety-related device 1, 1', 1", 1‴ is preferably designed with multiple channels.

[0052] Preferably, the electronic storage device 2, 2', 2", 2‴ can store a data content identifier which indicates whether the first and the second data content stored in the electronic storage device 2, 2', 2", 2‴ is each an operating software update or an address for the safety-related device 1, 1', 1", 1‴. The first microcontroller 10 can be designed to, in the event that the electronic storage device 2, 2', 2", 2‴ is connected via its first connection device 3, 3', 3", 3‴ to the second connection device 5, 5', 5", 5‴ of the safety-related device 1, 1', 1", 1‴, first read out and interpret the data content identifier from the electronic storage device 2, 2', 2", 2‴ and then, depending on the interpreted Data content identifier to download the respective operating software update or the respective address into the first storage device 11.Similarly, if the electronic storage device (2, 2', 2", 2‴) is connected via its first connection device 3, 3', 3", 3‴ to the second connection device 5, 5', 5", 5‴ of the device 1, 1', 1", 1‴, the second microcontroller 15 can be configured to first read out and interpret the data content identifier from the electronic storage device 2, 2', 2", 2‴ and then, depending on the interpreted data content identifier, to download the respective operating software update or the respective address to the second storage device 16.

[0053] If the first data content and the second data content are each an operating software update, the electronic storage device 2, 2', 2", 2‴ can preferably store a first operating software update identifier associated with the first data content and a second operating software update identifier associated with the second data content. The first microcontroller 10 can then be designed to i) after reading and interpreting the data content identifier, read the first operating software update identifier from the electronic storage device, ii) in response to the read first operating software update identifier, check whether the associated first operating software update is stored in the storage device 11, and only if the associated first operating software update is not stored in the storage device 11, download the first data content to the first storage device 11. The second microcontroller 15 can be configured to i) after reading and interpreting the data content identifier, read the second operating software update identifier from the electronic storage device, ii) in response to the read second operating software update identifier, check whether the associated second operating software update is stored in the storage device 16, and only if the associated second operating software update is not stored in the storage device 16, download the second data content to the second storage device 16. List of reference symbols

[0054] 1, 1', 1", 1‴safety-related input / output module as an example of a safety-related device 2, 2', 2", 2‴:electronic storage device 3, 3', 3", 3‴:first connection device 4, 4', 4", 4‴:first mechanical coding means 5, 5', 5", 5‴:second connection device 6, 6', 6", 6‴:second mechanical coding means 7, 7', 7", 7‴:first defined mechanical configuration 8, 8', 8", 8‴:second defined mechanical configuration 9a, 9b:electrical interface of the storage medium, input / output module 10:microcontroller 11:storage device 12:interface to a field device 13:sensor 14:LED display 15:Microcontroller 16:Storage device

Claims

1. A system comprising a safety-related device (1, 1', 1", 1‴) which is a safety-related input / output module of a machine or system or a safety-related control device of a machine or system and is designed to generate safety-related input signals and / or safety-related output signals or to react to safety-related input signals for carrying out safety-related control functions in the field of functional safety, and a separate electronic storage device (2, 2', 2", 2‴) in which only exactly one data content for the safety-related device (1, 1', 1", 1"') is stored, wherein the exactly one data content is either an operating software update or an address, wherein the electronic storage device (2, 2', 2", 2"') comprises a first connection device (3, 3', 3", 3‴) for mechanically and electrically coupling to the device (1, 1', 1", 1‴), said first connection device (3, 3', 3", 3‴) having a first mechanical encoding device (4, 4', 4", 4‴), and wherein the device (1, 1', 1", 1‴) comprises a memory device (11) in which an operating system is stored, a microcontroller (10) and a second connection device (5, 5', 5", 5‴) for mechanically and electrically coupling with the electronic memory device (2, 2', 2", 2"'), wherein the second connecting device (5, 5', 5", 5‴) comprises a second mechanical coding device (6, 6', 6", 6‴), wherein the first (4, 4', 4", 4‴) mechanical coding device and the second mechanical coding device (6, 6', 6", 6‴) are complementary to each other, wherein the microcontroller (10) of the device (1, 1', 1", 1‴) is designed to recognise whether the electronic storage device (2, 2', 2", 2‴) is connected via its first connecting device (3, 3', 3", 3‴) to the second connecting device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), and in this case is further designed to download the exact one data content stored in the electronic storage device (2, 2', 2", 2‴) from the electronic storage device (2, 2', 2", 2‴) into the storage device (11) of the device (1, 1', 1", 1‴), and wherein the electronic storage device (2, 2', 2", 2‴) stores a data content identifier which indicates whether the exact one data content stored in the electronic storage device (2, 2', 2", 2"') is an operating software update or an address for the safety-related device (1, 1', 1", 1‴), and the microcontroller (10) is designed to, in the event that the electronic storage device (2, 2', 2", 2‴) is connected via its first connection device (3, 3', 3", 3‴) to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), first read out and interprete the data content identifier from the electronic storage device (2, 2', 2", 2‴) and then to download the operating software update or the address into the storage device (11) of the safety-related device (1, 1', 1", 1‴) in dependence of the interpreted data content identifier.

2. The system according to claim 1, characterized in that, if the exact one data content is an operating software update, the electronic storage device (2, 2', 2", 2‴) stores an operating software update identifier, and in that the microcontroller is designed to, i) read out, after reading out and interpreting the data content identifier, the operating software update identifier from the electronic storage device, ii) to check in response to the operating software update identifier read out whether the associated operating software update is stored in the storage device (11) and, only if the associated operating software update is not stored in the storage device, to download the exact one data content into the storage device.

3. A system comprising a multi-channel safety-related device (1, 1', 1", 1‴), which is a safety-related input / output module of a machine or system or a safety-related control device of a machine or system and is designed to generate safety-related input signals and / or safety-related output signals or to react to safety-related input signals in order to perform safety-related control functions in the field of functional safety, having at least a first microcontroller (10) and a second microcontroller (15) and an electronic storage device (2, 2', 2", 2‴) which is separate from the safety-related device and in which a first data content and a second data content for the safety-related device (1, 1', 1", 1‴) are stored, the first and second data content each being either an operating software update or an address, wherein the electronic storage device (2, 2', 2", 2"') comprises a first connection device (3, 3', 3", 3‴) for mechanically and electrically coupling to the device (1, 1', 1", 1‴), said first connection device (3, 3', 3", 3‴) having a first mechanical encoding device (4, 4', 4", 4‴), and wherein the device (1, 1', 1", 1"') comprises a first storage device (11) associated with the first microcontroller (10) in which a first operating system is stored, a second storage device (16) associated with the second microcontroller (15) in which a second operating system is stored, and a second connection device (5, 5', 5", 5‴) for mechanically and electrically coupling to the electronic storage device (2, 2', 2", 2"'), wherein the second connecting device (5, 5', 5", 5‴) has a second mechanical coding device (6, 6', 6", 6‴), wherein the first (4, 4', 4", 4‴) mechanical coding device and the second mechanical coding device (6, 6', 6", 6‴) are designed complementarily to one another, wherein the first microcontroller (10) of the device (1, 1', 1", 1‴) is designed to recognize whether the electronic storage device (2, 2', 2", 2‴) is connected via its first connection device (3, 3', 3", 3‴) to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), and in this case is further designed to download the first data content stored in the electronic storage device (2, 2', 2", 2‴) from the electronic storage device (2, 2', 2", 2‴) into the first storage device (11) of the device (1, 1', 1", 1‴), and wherein the second microcontroller (15) of the device (1, 1', 1", 1‴) is designed to recognize whether the electronic storage device (2, 2', 2", 2‴) is connected via its first connection device (3, 3', 3", 3‴) to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), and in this case is also designed to download the second data content stored in the electronic storage device (2, 2', 2", 2‴) from the electronic storage device (2, 2', 2", 2‴) to the second storage device (16) of the device (1, 1', 1", 1‴), and furthermore the electronic storage device (2, 2', 2", 2‴) stores a data content identifier which indicates whether the first and second data contents stored in the electronic storage device (2, 2', 2", 2‴) are each an operating software update or each an address for the safety-related device (1, 1', 1", 1‴), wherein the first microcontroller (10) is designed to first read out and interpret the data content identifier from the electronic storage device (2, 2', 2", 2‴) and then to download the respective operating software update or the respective address to the first storage device (11) in dependence of the interpreted data content identifier, in the event that the electronic storage device (2, 2', 2", 2‴) is connected via its first connection device (3, 3', 3", 3"') to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), and the second microcontroller (15) is designed to, in the event that the electronic storage device (2, 2', 2", 2‴) is connected via its first connection device (3, 3', 3", 3‴) to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), first read out and interpret the data content identifier from the electronic storage device (2, 2', 2", 2‴) and then to download the respective operating software update or the respective address to the second storage device (16) in dependence of the interpreted data content identifier.

4. The system according to claim 3, characterized in that, if the first data content and the second data content are each an operating software update, the electronic storage device (2, 2', 2", 2‴) stores a first operating software update identifier assigned to the first data content and a second operating software update identifier assigned to the second data content, and in that the first microcontroller (10) is designed, i) to read out the first operating software update identifier from the electronic storage device after reading and interpreting the data content identifier, ii) to check in response to the first operating software update identifier read out whether the associated first operating software update is stored in the storage device (11) and, only if the associated first operating software update is not stored in the memory device (11), to download the first data content into the first storage device (11), and in that the second microcontroller (15) is designed, i) to read out the second operating software update identifier from the electronic storage device after reading and interpreting the data content identifier, ii) to check in response to the second operating software update identifier read out whether the associated second operating software update is stored in the storage device (16), and only then, if the associated second operating software update is not stored in the storage device (16), to download the second data content into the second storage device (16).

5. The system according to one of the preceding claims, characterized in that the safety-related device (1, 1', 1", 1"') has a sensor (13) which is designed to detect whether the electronic storage device (2, 2', 2", 2‴) is correctly mechanically coupled to the device (1, 1', 1", 1‴).

6. The system according to claim 5, characterized in that the sensor (13) is a touch sensor (13) and is designed to send an electrical signal to the microcontroller (10), which signals that the electronic storage device (2, 2', 2", 2‴) is correctly mechanically coupled to the device (1, 1', 1", 1‴).

7. The system according to claim 6 in conjunction with one of the preceding claims 3 to 5, characterized in that the touch sensor (13) is designed to send an electrical signal to the second microcontroller (15), which signals that the electronic storage device (2, 2', 2", 2‴) is correctly mechanically coupled to the device (1, 1', 1", 1"').

8. The system according to one of the preceding claims, characterized in that the first mechanical coding device (4, 4', 4", 4"') has a first defined mechanical configuration (7, 7', 7", 7‴) and the second mechanical coding device (6, 6', 6", 6"') has a second defined mechanical configuration (8, 8', 8", 8‴), which is complementary to the first defined mechanical configuration (7, 7', 7", 7‴, wherein the first and second defined mechanical configurations (7, 7', 7", 7‴ 8, 8', 8", 8‴) each have at least one of the features of a corrugation, a pronounced pattern, an outstanding geometric element or a corresponding recess.

9. A method for transferring only exactly one data content from an electronic storage device (2, 2', 2", 2‴) to a safety-related device (1, 1', 1", 1"') within a system, wherein the safety-related device (1, 1', 1", 1‴) is a safety-related input / output module of a machine or system or a safety-related control device of a machine or system and generates safety-related input signals and / or safety-related output signals or reacts to safety-related input signals for executing safety-related control functions in the field of functional safety, according to one of the preceding claims 1 or 2, the method comprising the following steps: - Disconnecting the device (1, 1', 1", 1‴) from a power supply, - electrical and mechanical coupling of the first connection device (3, 3', 3", 3‴) of the electronic storage device (2, 2', 2", 2‴) to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), wherein an electrical coupling only takes place when the first mechanical coding device (4, 4', 4", 4‴: is correctly mechanically coupled to the second mechanical coding device (6, 6', 6", 6‴), - connecting the device (1, 1', 1", 1"') to the power supply, - detecting by the microcontroller (10) of the device (1, 1', 1", 1‴) whether the electronic storage device (2, 2', 2", 2‴) is connected to the second connection device (5, 5', 5", 5"') of the device (1, 1', 1", 1‴), and in this case - downloading the exact one data content stored in the electronic storage device (2, 2', 2", 2‴) from the electronic storage device (2, 2', 2", 2‴) to the storage device (11) of the device (1, 1', 1", 1‴), wherein the electronic storage device (2, 2', 2", 2"') stores a data content identifier which indicates whether the exact one data content stored in the electronic storage device (2, 2', 2", 2‴) is an operating software-update or an address of the safety-related device (1, 1', 1", 1‴), wherein prior to downloading the exactly one data content from the electronic storage device (2, 2', 2", 2‴) into the storage device (11) of the device (1, 1', 1", 1‴), the data content identifier is read out and interpreted by the microcontroller (10) from the electronic storage device (2, 2', 2", 2"'), - electrically and mechanically decoupling the electronic storage device (2, 2', 2", 2‴) from the device (1, 1', 1", 1‴).

10. A method for transferring data content from an electronic storage device (2, 2', 2", 2"') to a multi-channel safety-related device (1, 1', 1", 1"') within a system, wherein the safety-related device (1, 1', 1", 1‴) is a safety-related input / output module of a machine or system or a safety-related control device of a machine or system and generates safety-related input signals and / or safety-related output signals or reacts to safety-related input signals for executing safety-related control functions in the field of functional safety, according to one of the preceding claims 3 to 5, the method comprising the following steps: - Disconnecting the device (1, 1', 1", 1‴) from a power supply, - electrical and mechanical coupling of the first connection device (3, 3', 3", 3‴) of the electronic storage device (2, 2', 2", 2‴) to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), wherein an electrical coupling only takes place when the first mechanical coding device (4, 4', 4", 4‴: is correctly mechanically coupled to the second mechanical coding device (6, 6', 6", 6‴), - connecting the device (1, 1', 1", 1"') to the power supply, - detecting by the first microcontroller (10) of the device (1, 1', 1", 1‴) whether the electronic storage device (2, 2', 2", 2‴) is connected to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), and in this case - downloading the first data content stored in the electronic storage device (2, 2', 2", 2"') from the electronic storage device (2, 2', 2", 2‴) to the first storage device (11) of the device (1, 1', 1", 1‴), wherein the electronic storage device (2, 2', 2", 2"') stores a data content identifier indicating whether the first data content stored in the electronic storage device (2, 2', 2", 2‴) is an operating software update or an address for the safety-related appliance (1, 1', 1", 1‴), wherein prior to downloading the first data content from the electronic storage device (2, 2', 2", 2‴) into the storage device (11) of the device (1, 1', 1", 1‴), the data content identifier is read out from the electronic storage device (2, 2', 2", 2‴) and interpreted by the first microcontroller (10), - recognizing by the second microcontroller (15) of the device (1, 1', 1", 1"') whether the electronic storage device (2, 2', 2", 2‴) is connected to the second connection device (5, 5', 5", 5‴) of the device (1, 1', 1", 1‴), and in this case - downloading the second data content stored in the electronic storage device (2, 2', 2", 2‴) from the electronic storage device (2, 2', 2", 2‴) to the second storage device (16) of the device (1, 1', 1", 1‴), wherein the electronic storage device (2, 2', 2", 2"') stores a data content identifier indicating whether the second data content stored in the electronic storage device (2, 2', 2", 2‴) is an operating software update or an address for the safety-related appliance (1, 1', 1", 1‴), wherein prior to downloading the second data content from the electronic storage device (2, 2', 2", 2‴) into the memory device (11) of the appliance (1, 1', 1", 1‴), the data content identifier is read out from the electronic memory device (2, 2', 2", 2‴) and interpreted by the second microcontroller (15), - electrically and mechanically decoupling the electronic storage device (2, 2', 2", 2‴) from the device (1, 1', 1", 1‴).