Safety module for an electrical device, and method for operating same

Abstract

The present invention relates to a safety module (2) for an electrical device (50), in particular for a field device, having a device power input ("Pin 2", "Pin 5") for electrical connection to an electrical distribution system (3); a device power output (7, 8) for the connection of the electrical device (50); a switching module (6) for switching an electrical connection between the device power input ("Pin 2", "Pin 5") and the device power output (7, 8); a device "safe logic" module (4) for controlling the switching module (6); and a device interface ("Pin 1", "Pin 3", "Pin 4") for establishing a data connection between the device "safe logic" module (4) and the distribution system (3); wherein the device "safe logic" module (4) is configured to monitor a switching state of the switching module (6) and, if the switching module (6) is in a fault state, to output a switch-off signal to the electrical distribution system (3) via the device interface ("Pin 1", "Pin 3", "Pin 4").

Description

[0001] SAFETY MODULE FOR AN ELECTRICAL DEVICE AND METHOD FOR OPERATING THE SAME

[0002] The present invention relates to a security module for an electrical device and a method for operating a security module. It further relates to an electrical device, an electrical distribution device, a system, and a method for operating the electrical device, the electrical distribution device, or the system.

[0003] To protect against injury or damage, a high level of safety is required in automation technology. For applications where the de-energized state is the "safe state," reliable voltage shutdown must be guaranteed. A so-called single fault, in which a shutdown path malfunctions, must not lead to the loss of the safety function. A single fault occurs, for example, when mechanical contacts weld together and can then no longer be opened, or when transistor switches fail and can then no longer be switched to high resistance. Redundant shutdown paths are therefore provided. Furthermore, it is specifically intended that a single fault be diagnosed.

[0004] For example, it is known to equip a fieldbus module with a communication port that can be safely shut down. Furthermore, according to the specifications of the "IO-Link Safety System Extensions with SMI, V1.1.3, March 2022" specification, an FS master can be connected to an FS device, where "FS" stands for functional safety. Both devices have safe logic, typically consisting of two microcontrollers that cross-check all safety-relevant data. A shutdown command can then be safely sent to the FS device, and safe shutdown can be achieved via two shutdown elements. Since an IO-Link Safety SDCI port B already has its own power supply with a high safety level, such a setup requires four shutdown elements in series. This involves considerable effort.

[0005] DE 10 2020 112 985 A1 describes an IO-Link adapter that is placed between a master and a device. DE 10 2021 114 855 A1 proposes an industrial plant with a safety switching device. DE 10 2020 007 808 A1 discloses a safety shutdown device for a mechatronic component to ensure a safe emergency stop function.

[0006] The known solutions have proven to be disadvantageous in that redundant shutdown elements involve higher effort, additional costs, greater space requirements and power loss.

[0007] It is therefore the object of the invention to provide a safety module for an electrical device, in particular a field device, such as an actuator, or a device for supplying another device with an operating voltage, a system and a method for operating a safety module, wherein the aforementioned disadvantages of the prior art are overcome and, in particular, reliable disconnectability is ensured in a simple and cost-effective manner.

[0008] This object is achieved according to the invention by the features of the independent claims. Advantageous embodiments are specified in the dependent claims.

[0009] According to this, the problem is solved by a safety module for an electrical device. The electrical device can in particular be a field device, for example a sensor or actuator for industrial automation. The safety module comprises a device power input for electrical connection to an electrical distribution device and a device power output for connecting the electrical device. It further comprises a switching module for switching an electrical connection between the device power input and the device power output and a device “safe logic” module for controlling the switching module. It also comprises a device interface for the data connection of the device “safe logic” module to the distribution device. The device “safe logic” module is designed to monitor a switching state of the switching module and to output a shutdown signal via the device interface in the event of a fault state of the switching module.

[0010] The safety module can be integrated into the electrical device or designed separately.

[0011] In one embodiment, the device interface is designed to establish an IO-Link connection, in particular to establish an IO-Link communication connection between the distribution device and the safety module and / or to connect an IO-Link power supply from the distribution device to the electrical device.

[0012] The electrical device can, for example, be designed as an IO-Link device that is connected to an IO-Link master and has a data connection with it. In this case, the electrical device's power supply can also be provided via the IO-Link master.

[0013] When, in accordance with IO-Link terminology, the electrical device and the safety module are referred to as "devices" and the distribution device is referred to as "masters," this is not intended to imply a restriction to devices according to the IO-Link specifications, unless explicitly stated. Rather, it means that the electrical device, as a "device," is dependent on the power supply from the distribution device as the "master"—the device is thus subordinate to the master. However, this can also be implemented in other architectures, which are also intended to be encompassed by the invention.

[0014] In particular, the distribution device can provide a "Class A" or "Class B" supply. In IO-Link terminology, "Class A" refers to a supply of the electrical device with a maximum current consumption of 200 mA at 24 V direct current (DC), while "Class B" refers to an electrical supply with a higher maximum current consumption, in particular up to 400 mA at 24 V.

[0015] According to the present description, the “distribution device” is to be understood broadly as a device by means of which an electrical voltage or electrical power can be provided for the electrical device.

[0016] The distribution device can in turn be connected to an external power supply and in this way “distribute” the provided electrical power to one or more connected electrical devices.

[0017] In particular, the distribution device is designed in such a way that it has a data connection to connected electrical devices and is also able to switch and, if necessary, disconnect the supply of the electrical device via the device power input of the security module.

[0018] The device interface is specifically understood as a device-side interface through which a data connection to the distribution device can be established. A "device interface" can be understood as all or individual pins of a connection for a wired connection, for example, "pin 1," "pin 3," and / or "pin 4" in the case of IO-Link. Furthermore, the device interface can also supply power to the safety module, particularly via "pin 1" and "pin 3."

[0019] In one embodiment of the invention, the power supply of the device "Safe Logic" module is galvanically isolated from the device power input. In particular, there is galvanic isolation between a logic supply voltage and a "Class B" supply, meaning there is no electrical connection between these two voltage potentials.

[0020] In particular, the power supply of the safety module is separate from the power supply of the electrical device, in particular a “Class B” supply, for which “Pin 2” and “Pin 5” are provided in IO-Link, which then correspond to the pin assignment at the device power input and device power output.

[0021] Furthermore, the device interface can be configured to supply power to the device "Safe Logic" module. The device "Safe Logic" module's power supply is provided in particular in addition to the data connection to the distribution device.

[0022] In a further development, the safety module comprises at least one optocoupler, one inductive coupler, and / or one capacitive coupler. In particular, this provides galvanic isolation between a potential applied to the device power input and a potential for supplying power to the device "Safe Logic" module.

[0023] The device "Safe Logic" module is specifically designed as a device-side device that can receive and output data signals. The device "Safe Logic" module monitors the switching state of the device-side switching module. The device "Safe Logic" module can also be configured to control the switching module itself.

[0024] The Device Safe Logic module can detect a fault condition in the switching module and, depending on the fault, output a control signal that is transmitted to the distribution device as an (emergency) shutdown signal, where it shuts off the power supply to the electrical device. This means that if the Device Safe Logic module detects that the switching module is not shutting off the power supply (on the device side) or is doing so inadequately, it can initiate the shutdown on the master side. The Device Safe Logic module thus implements redundancy in the shutdown process, thus improving safety.

[0025] To monitor the switching module, the Device Safe Logic module specifically records a target switching state or a switching request and an actual switching state. A comparison determines whether these correspond or whether an error condition exists in which a shutdown was not executed despite the request.

[0026] In one embodiment, the device-side switching module comprises a semiconductor switch and / or a relay switch and / or a contactor and / or a mechanical switch with a positively guided contact. This advantageously ensures reliable switching.

[0027] Potential-free contacts can also be optionally implemented using optocouplers and relays. Potential-free contacts are particularly included in the device power output.

[0028] In a further embodiment, the switching module has exactly one shutdown path. In this case, the safety module is not designed with redundant shutdown paths; instead, redundancy is achieved by the device "Safe Logic" module ensuring shutdown via a shutdown path of the distribution device upon detection of a fault.

[0029] Furthermore, a feedback path for the switching state of the switching module can be provided. This allows for easy detection of the actual switching state.

[0030] The invention further relates to a method for operating the safety module, in which an electrical connection can be switched between a device power input and a device power output of the safety module, wherein the switching state is further monitored and an (emergency) shutdown signal is output in the event of an error condition.

[0031] The invention further relates to an electrical device with a safety module according to the present description. In particular, the safety module is integrated into the electrical device in such a way that the electrical device's power supply is provided directly via the device power input of the safety module.

[0032] The distribution device, in particular as a higher-level device, for example an "IG-Link Master," has a master power output. A power supply is provided, in particular, indirectly via a safety module according to the present description, which can be integrated, for example, into the electrical device. The master power output is configured, for example, to connect the electrical device directly or indirectly to it, in particular via the safety module. The distribution device has at least one disconnecting element, by which the master power output can be de-energized or by which the electrical device can be disconnected from the power supply.The distribution device further comprises a master "safe logic" module for controlling the shutdown element, as well as a master interface for the data connection of the master "safe logic" module to a safety module assigned to the electrical device. Upon receiving a shutdown signal, in particular upon receiving a shutdown signal via the master interface, the master "safe logic" module being output, for example, by a device "safe logic" module, the master "safe logic" module is configured to control the shutdown element in such a way that the master power output is de-energized or that the electrical device is disconnected from the power supply.

[0033] The distribution device is designed in particular to interact with a safety module described here or with an electrical device having such a safety module and to provide redundantly complementary shutdown paths.

[0034] The distribution device may further have its own connection for an external power supply.

[0035] In particular, the master interface is further designed so that the safety module or the device "safety logic" module can be supplied with electrical power via this interface. Such a power supply for the device logic module can, for example, be provided via "Pin 1" and "Pin 3" in the IO-Link specification.

[0036] For example, if the distribution device is designed according to the IO-Link specifications, a "Class B" supply is implemented for the connected electrical device. Independent of this and galvanically isolated from it, the "Safety Logic" module of the safety module can also be supplied.

[0037] This means that the Class B power supply for the electrical device can be interrupted without simultaneously terminating the data communication connection to the safety module. The data connection can therefore remain intact, and, for example, a signal to resume power supply and switch the power supply back on can be transmitted via the data connection on the supply device side.

[0038] The invention also relates to a method for operating the distribution device, in which a voltage supply is provided for at least one electrical device and a master power output can be de-energized. Upon receiving a shutdown signal, the shutdown element is controlled such that the master power output is de-energized.

[0039] The invention also relates to a system comprising a supply device and a safety module coupled to the supply device for an electrical device, wherein the supply device and the safety module are designed according to the present description.

[0040] The system accordingly has the same advantages and effects as described herein. It can also be further developed in the ways described herein.

[0041] In particular, the invention advantageously implements redundant shutdown of the electrical device with as few shutdown elements as possible. In particular, a high level of safety is achieved compared to the known solutions despite a reduced number of consecutive shutdown elements.

[0042] This proposes, in particular, a safety application for safe voltage shutdown, for example, in the context of an "IO-Link Safety" application. In particular, only a simple first shutdown path is provided on the device side. If this first shutdown path fails in the event of a serious error, i.e., if no shutdown option is available in the device, and if this is detected by a diagnostic option, then the second shutdown option on the master device side can be used. A high level of functional safety is therefore achieved.

[0043] In particular, a master device suitable for IO-Link can be configured to shut down the power supply for connected devices via terminals "Pin 2" and "Pin 5." By implementing this in a single-channel, safety-oriented manner in the master device, a second shutdown path can be used for a device. Since a communication connection to the master device remains even if the device-side shutdown fails, this safe communication can ensure the safe shutdown of the device's power supply.

[0044] In particular, this allows the electrical device to be switched off without having to disconnect all the lines of a port. This does not necessarily disable other functions implemented via other pins. For example, a communication connection can still be provided via other pins of a port.

[0045] In the method for operating a system with an electrical device that is coupled to a distribution device for power supply via a safety device, a power supply can be switched via the safety device. In this case, a switching state of the safety device is monitored, wherein this monitoring is carried out in particular by a safety module of the electrical device. In the method, in the event of an error state, which occurs in particular when a desired shutdown could not be carried out, a shutdown signal is output to the distribution device, by which the power supply is switched on by the distribution device. The method is designed in particular to operate the system described above. It therefore has the corresponding advantages and effects and can be further developed in a corresponding manner.

[0046] Further details and advantages of the invention will now be explained in more detail with reference to the embodiments shown in the drawings.

[0047] They show:

[0048] Fig. 1 is a circuit diagram of a first embodiment of the system with a distribution device and a security module;

[0049] Fig. 1 A and 1 B are diagrams of the method of operating the system;

[0050] Fig. 2 is a circuit diagram of a second embodiment of the system with a distribution device and a security module; and

[0051] Fig. 3 is a circuit diagram of a third embodiment of the system with a distribution device and a security module.

[0052] With reference to Fig. 1, a circuit diagram of a first embodiment of the system with a distribution device and a security module is explained.

[0053] In the first embodiment, the system 1 comprises a security module 2 and a distribution device 3.

[0054] In the example, an IO-Link connection exists between the safety module 2 and the distribution device 3, in which the distribution device 3 acts as the FS master. In the exemplary embodiment, the safety module 2 is comprised of an electrical device 50, which in the example is operated as an FS device 50.

[0055] The IO-Link connection is established via five wired connectors, designated "Pin 1," "Pin 2," "Pin 3," "Pin 4," and "Pin 5" on both sides according to the IO-Link specification. The distribution device 3 has a connection to an external voltage source 9.

[0056] In the IO-Link connection between the supply device 3 and the safety module 2, the terminals “Pin 2” and “Pin 5” are assigned to a “Class B” power supply for the device connected as FS-Device 50.

[0057] The supply device 3 further comprises a switch-off element 5, with which in particular the terminal “Pin 2” for the voltage supply can be switched off.

[0058] The shutoff element 5 is coupled to a master "Safe Logic" module 16 and can be controlled via it. In particular, a signal can be transmitted to the shutoff element 5 via the master "Safe Logic" module 16, which opens an electrical connection of the shutoff element 5 and thus shuts off the power supply via the terminals "Pin 2" and "Pin 5."

[0059] In further embodiments, the shutoff element 5 of the supply device can be duplicated, i.e., redundantly present, such as in the examples shown in Fig. 2 and Fig. 3. The shutoff elements 5 shown there can also be controlled via the master "Safe Logic" module 16. However, this duplicate design is not necessary, since the required redundancy—as explained below—can be achieved through the interaction with the switching module 6 of the safety module 2.

[0060] In this example, the safety module 2 is considered to be included in the electrical device 50. The safety module 2 has a positive output pin 7 and a negative output pin 8, via which a "Class B" voltage supply is provided to the electrical device 50.

[0061] In the example, the negative output pin 8 is connected via a line 13 to terminal "Pin 5," which is at a potential of 0 V. Line 13 is therefore specifically connected to the negative pole of the Class B power supply. The positive output pin 7 is connected via a line 12 to terminal "Pin 2," which is at a potential of 24 V. Line 12 is therefore specifically connected to the positive pole of the Class B power supply.

[0062] A first optocoupler 15 is also arranged in line 12 to the positive output pin 7. This serves as a switching element and is connected to a device "Safe Logic" module 4 of the safety module 2 via an output control line 11.

[0063] If a switch-off signal is received via the output control line 11, the current flow through the line 12 is interrupted via the first optocoupler 15.

[0064] A line branching from the line to the positive output pin 7 forms a feedback path, which is connected to line 13 of the negative output pin 8 via a second optocoupler 14. As long as the potential of the positive output pin 7 is not equal to 0 V, as is the case with the negative output pin 8, a signal can be detected as feedback via a line 10 via the second optocoupler 14.

[0065] This means that the second optocoupler provides feedback on the actual switching state of switching module 6. The elements for switching the "Class B" supply via terminals 7 and 8 of safety module 2 are combined in a switching module 6 in the example.

[0066] Furthermore, terminals "Pin 1" and "Pin 3" are assigned to a power supply for the device "Safe Logic" module 4. This means that the distribution device supplies the device "Safe Logic" module 4 with electrical power via terminals "Pin 1" and "Pin 3." This power supply is not affected if the "Class B" supply is switched off via terminals "Pin 2" and "Pin 5," meaning that a data connection can continue to operate even after the electrical device 50 is switched off.

[0067] In other words, the electrical device 50 with the safety module 2, which is embodied, for example, as an "10-Link Safety" FS device 2, is provided with only a single device-side shutdown path. The safety module 2 reliably detects a fault condition during shutdown.

[0068] Furthermore, the FS master 3 is provided with a master "Safe Logic" module 16 and at least one shut-off element 5, possibly several shut-off elements 5. It is now monitored that the "Class B" supply at "Pin 2" (P24) and "Pin 5" (N24) can be safely shut off. For this purpose, a shut-off element 5 can also enable the 0 V path (N24).

[0069] In addition, additional feedback and monitoring electronics may be provided, which is not shown.

[0070] The FS Master 3 is supplied with power by the external power supply 9.

[0071] An interface from the FS master to the FS device includes two terminals (“Pin 1”, “Pin 3”), via which in particular a device “Safe Logic” module 4 is supplied with voltage, as well as a terminal for serial communication (“Pin 4”) and two further terminals (“Pin 2”, “Pin 5”) for a voltage supply of a connected electrical device, in particular a “Class B” supply.

[0072] The FS-Device 2 also has a “Safe Logic” module 4.

[0073] The master “safe logic” module 16 and the device “safe logic” module 4 each have a redundant structure, at least with a redundant ALU (arithmetical logical unit), typically with a redundant MCU (micro processing unit) and a redundant memory (random access memory, RAM; read-only memory, ROM).

[0074] All safety-relevant data is processed redundantly on the one hand and checked by cross-comparison on the other.

[0075] The FS Device 2 is supplied with a logic voltage by the FS Master 3, namely via the terminals “Pin 1” and “Pin 3”.

[0076] Furthermore, the FS device 2 has at least one control path 11 with which a digital output is controlled, as well as at least one feedback path 10 with which the control of the output is monitored.

[0077] A key feature of the FS-Device 2 is that it provides galvanic isolation between the logic supply voltage and the Class B supply. This means there is no electrical connection between these two voltage potentials.

[0078] Any fault on the logic side may prevent the output from being switched on when the Class B supply is turned off. During operation of System 1, the output can now be switched on using the following procedure, shown schematically in Fig. 1A.

[0079] In a first step 110, the “Class B” supply is switched on.

[0080] In a further step 120, a feedback signal from the feedback channel 10 of the safety module 2 detects that no voltage is present at the output terminal 7.

[0081] In a further step 130, a control command is transmitted from the FS master 3 to the FS device 2 that the output should be switched on.

[0082] In a further step 140, the output is switched on the device side via the control line 11.

[0083] In a further step 150, the feedback channel 10 is used to detect that the output is switched on.

[0084] During operation of system 1, it is also possible to cyclically test whether an output can be switched off. For example, a control command via control line 11 can be used to briefly switch off the output cyclically, and / or the "Class B" supply can be briefly switched off cyclically. The successful switching off of the output is monitored via feedback channel 10 in both the switched-on and switched-off states.

[0085] An example of a method used for shutdown in the event of a fault is shown schematically in Fig. 1 B.

[0086] In a first step 210, it is determined that the actual state detected via the feedback line 10 does not correspond to the desired state of the switching module 6. This means that the output terminals 7, 8 are not disconnected from the power supply, although a corresponding state has been triggered.

[0087] In a further step 220, an emergency shutdown command is transmitted from the “Safe Logic” module 4 of the FS Device 2 to the “Safe Logic” module 4 of the FS Master 3.

[0088] In a further step 230, the FS master 3 de-energizes the “Class B” supply via the redundant shutdown elements 5, so that the electrical device 50 connected via the safety module 2 is no longer connected to the “Class B” supply.

[0089] In the example shown in Fig. 1, only one path for shutdown is provided in Master 3 and Device 2. The diagnostic option now makes it possible to implement the shutdown safely and redundantly, even at higher power levels.

[0090] This allows the costs for individual electrical devices 2, 3, 50 to be reduced while maintaining a high level of safety.

[0091] The electrical device 50 may in particular comprise an actuator or another standard module, wherein the safe shutdown can be implemented in many standard modules in order to maintain the required safety levels through the interaction between master and device.

[0092] Of particular importance for the safety module is that galvanically isolated lines are provided for the power supply of the device "Safe Logic" module 4 and for the "Class B" supply. In the example shown in Fig. 1, this is achieved via a digital output with an optocoupler.

[0093] The safety module 2 has a first optocoupler 15 and a second optocoupler 14. Galvanic isolation of two shutdown paths is achieved via the optocouplers 14, 15. In further embodiments, the galvanic isolation can be implemented alternatively or additionally by inductive couplers or capacitive couplers.

[0094] The first optocoupler 15 is controlled by a control signal via line 11 and it switches a “Class B” potential via line 12 to the output terminal 7 of the safety module 2.

[0095] The second optocoupler 14 reports the actual state of the output terminal 7 back to the device “Safe Logic” module 4 of the safety module 2.

[0096] The Device Safe Logic module 4 monitors the switching state by comparing the actual state with the desired state.

[0097] If it is registered that the "Class B" supply could not be switched off successfully, the "Safe Logic" module 4 of the safety module 2 transmits a signal to the FS master 3, which causes it to switch off the "Class B" supply via the "Pin 2" terminal.

[0098] Several interconnections of the switching module 6 can be provided in an FS device 2, each of which has a control line 11 and a feedback path 10 as well as an output terminal 7, but in which the “Class B” supply 12, 13 is supplied in parallel.

[0099] The connections of supply device 3 are assigned as follows:

[0100] - “Pin 1” as “L+” with a voltage of 24 V”,

[0101] - “Pin 3” as “L-” with a voltage of 0 V” and

[0102] - “Pin 4” as “Q / C and SDCI-FS”.

[0103] The “Class B” supply is provided via the terminals:

[0104] - “Pin 2” as “P24” with a voltage of 24 V” and

[0105] - "Pin 5" as "N24" with a voltage of 0 V. On the device side, the pin assignment is configured accordingly:

[0106] - “Pin 1” as “L+” with a voltage of 24 V” and

[0107] - “Pin 3” as “L-” with a voltage of 0 V” and

[0108] - “Pin 4” connected to the line for “Q / C and SDCI-FS”

[0109] The connection to the “Class B” power supply is made via terminals “Pin 2” and “Pin 5”.

[0110] With reference to Fig. 2, a circuit diagram of a second embodiment of the system with a distribution device and a security module is explained. The above description of the first embodiment is used as a starting point, and elements that are similar or equivalent, or structurally and / or functionally comparable, are provided with the same reference numerals. The following primarily focuses on the differences between the embodiments.

[0111] In the second embodiment of a system 20, a mechanical contact and feedback via a positively driven opener are provided.

[0112] An IO-Link connection is made with a relay contact.

[0113] In this embodiment, the galvanic isolation is achieved via an optocoupler 21 and potential-free contacts of a relay 24. It is provided that the optocoupler 21 is controlled by a control signal 11 and energizes the relay 24.

[0114] A potential-free contact 23 of relay 24 switches the “Class B” potential 12 to the output terminal 7.

[0115] The state of relay 24 is reported back to the "Safe Logic" module 4 via the feedback channel 10 via another potential-free contact 22, in particular a positively driven normally closed contact. "Forced guidance" of contacts is understood in particular to mean that the contacts are mechanically designed in such a way that the normally closed contact and the normally open contact cannot be closed simultaneously, even in the event of a fault.

[0116] With reference to Fig. 3, a circuit diagram of a third embodiment of the system with a distribution device and a security module is explained. The above description of the first and second embodiments is used as a starting point, and elements that are similar or equivalent, or structurally and / or functionally comparable, are provided with the same reference numerals. The following primarily focuses on the differences between the embodiments.

[0117] In the third embodiment of a system 30, redundant potential-free contacts are provided. An IO-Link connection is established using potential-free contacts.

[0118] In this embodiment, galvanic isolation is achieved via two optocouplers 39, 49 and several potential-free contacts of several relays 31, 41. The optocouplers 39, 49 are each connected to the device "Safe Logic" module 4 via an output control line 11, 34.

[0119] Instead of a double version, a further multiple version is also conceivable for further increased redundancy.

[0120] The control and feedback are analogous to the second embodiment of the safety module 20 described above with reference to Figure 2.

[0121] In this embodiment, however, potential-free contacts 32, 42 are connected to terminals 35, 36, 37, 38, which can be externally supplied with voltage. In particular, contacts 32, 42 are designed as normally open contacts, while contacts 33, 43 are designed as normally closed contacts.

[0122] The safe shutdown of the two relays takes place as described above.

[0123] To achieve safe shutdown on the contact side, multiple contacts can be functionally used together to create a redundant shutdown. In brief, the invention is based, among other things, on the idea of ​​ensuring safe shutdown of the electrical device by dividing redundant shutdown paths between a safety module and a distribution device. This means, in particular, that an electrical device with a safety module can be designed such that it has only one reliably diagnosable shutdown path and, in the event of a fault, initiates shutdown via the distribution device.

[0124] List of reference symbols

[0125] 1 system

[0126] 2 Security module (on the side of an FS device)

[0127] 3 Distribution device; FS master

[0128] 4 Device, Safe Logic” module

[0129] 5 shutdown element (of the FS master)

[0130] 6 switching module; “Safety Output” module

[0131] 7 Plus output pin

[0132] 8 Minus output pin

[0133] 9 External power supply

[0134] 10 Line (feedback)

[0135] 11 Output control line

[0136] 12 lines (Class B Plus)

[0137] 13 Line (Class B Minus)

[0138] 14 Second optocoupler (for feedback)

[0139] 15 First optocoupler (for output)

[0140] 16 Master, Safe Logic” module

[0141] 20 systems

[0142] 21 optocouplers (for relay control)

[0143] 22 Feedback contact (forced)

[0144] 23 Output contact

[0145] 24 relays

[0146] 30 systems

[0147] 31 relays

[0148] 32 Contact (normally open)

[0149] 33 Contact (opener)

[0150] 34 Output control line

[0151] 35 terminal

[0152] 36 terminal

[0153] 37 Terminal 38 Terminal

[0154] 39 optocouplers (for relay control)

[0155] 41 relays

[0156] 42 Contact (normally open) 43 Contact (normally closed)

[0157] 49 optocouplers (for relay control)

[0158] 50 Electrical device; FS device

[0159] 51 Electrical device

[0160] 52 Electrical device

Claims

Patent claims 1. A safety module (2) for an electrical device (50), in particular for a field device, comprising a device power input (“pin 2”, “pin 5”) for electrically connecting to an electrical distribution device (3); a device power output (7, 8) for connecting the electrical device (50); a switching module (6) for switching an electrical connection between the device power input (“pin 2”, “pin 5”) and the device power output (7, 8); a device “safe logic” module (4) for controlling the switching module (6); and a device interface (“pin 1”, “pin 3”, “pin 4”) for data-technically connecting the device “safe logic” module (4) to the distribution device (3); wherein the device “safe logic” module (4) is configured to monitor a switching state of the switching module (6) and, in the event of a fault state of the switching module (6), to output a shutdown signal to the electrical distribution device (3) via the device interface (“pin 1”, “pin 3”, “pin 4”).

2. Safety module (2) according to claim 1, characterized in that the device interface is designed to establish an IO-Link connection, in particular to establish an IO-Link communication connection between the distribution device (3) and the safety module (2) and / or to connect an IO-Link Power supply from the distribution device (3) to the electrical device (50).

3. Security module (2) according to one of the preceding claims, characterized in that a voltage supply of the device "safe logic" module (4) is galvanically isolated from the device power input ("pin 2", "pin 5"); wherein optionally the device interface ("pin 1", "pin 3", "pin 4") is designed to supply the voltage to the device "safe logic" module (4) via it.

4. Safety module (2) according to one of the preceding claims, characterized in that the safety module (2) has at least one optocoupler, one inductive coupler, and / or one capacitive coupler; optionally to realize galvanic isolation between a potential applied to the device power input ("pin 2", pin 5") and a potential for the voltage supply of the device "safe logic" module (3).

5. Safety module (2) according to one of the preceding claims, characterized in that the switching module (6) comprises a semiconductor switch and / or a relay switch and / or a contactor and / or a mechanical switch with a positively guided contact; optionally, potential-free contacts are realized by means of optocouplers (39, 49) and relays (31, 41).

6. Safety module (2) according to one of the preceding claims, characterized in that the switching module (6) has exactly one shutdown path; wherein optionally a feedback path (12) is further provided for the switching state of the switching module.

7. Electrical device (50) with a security module (2) according to the preceding claims.

8. Distribution device (3) for providing a voltage supply for at least one electrical device (50), having a master power output ("Pin 2", "Pin 5"); at least one disconnecting element (5) by which the master power output ("Pin 2", "Pin 5") can be de-energized; a master "safe logic" module (16) for controlling the disconnecting element (5); and a master interface ("Pin 4") for the data connection of the master "safe logic" module (16) to a safety module (2) assigned to the electrical device (50); wherein the master "safe logic" module (16) is configured, upon receiving a disconnection signal, to control the disconnecting element (5) such that the master power output ("Pin 2", "Pin 5") is de-energized.

9. A system (1) comprising a supply device (3) and a security module (2) coupled to the supply device (3) for an electrical device (50), wherein the supply device (3) is designed according to claim 8; and the security module (2) is designed according to one of claims 1 to 7.

10. A method for operating a system with an electrical device (50) which is coupled to a distribution device (3) for the purpose of supplying voltage via a safety device (3); wherein a voltage supply can be switched via the safety device (2); wherein a switching state of the safety device (2) is monitored and in the event of an error state a shutdown signal is output to the distribution device (3), by means of which the voltage supply from the distribution device (3) is switched.

Images