Automation system comprising - a fieldbus, - at least two exchanging devices (G1, G2, G3) with an exchangeable tool (W1, W2, W3), - at least two automation devices (H1, H2, H3) which are securely connected to the fieldbus, - at least two coupling points (S1, S2, S3) which are connected to the field bus and designed for an automated connection and disconnection of an exchanging device (G1, G2, G3) to and from the fieldbus, wherein each exchanging device (G1, G2, G3) comprises a fieldbus subscriber (TN1, TN2, TN3) which is embodied to control actuators on the tool (W1, W2, W3), the exchanging devices (G1, G2, G3) comprise an exchangeable tool and a fieldbus subscriber and are further designed to establish a functionally safe connection with the automation devices (H1, H2, H3) by way of the fieldbus, wherein the functional safety thus achieved serves to avoid malfunctions as a result of errors, characterised by a virtual ring which connects the automation devices (H1, H2, H3), wherein the automation devices (H1, H2, H3) are designed to exchange a token (T1, T2, T3) assigned to each of the exchanging devices (G1, G2, G3) by way of the virtual ring, furthermore, the automation devices (H1, H2, H3) are designed to gain exclusive access to an exchanging device, to wait for the token (T1, T2, T3) assigned to the exchanging device (G1, G2, G3) and to retain it for the duration of the exclusive access and to forward the tokens (T1, T2, T3) which are not required, the automation devices (H1, H2, H3) are designed to gain exclusive access to one of the exchanging devices (G1, G2, G3) by means of a safety program (P1, P2, P3) and to initiate and control a connection of the corresponding exchanging device (G1, G2, G3) to the corresponding coupling point (S1, S2, S3) after obtaining the token (T1, T2, T3) assigned to the exchanging device (G1, G2, G3), are further designed to establish a functionally safe connection to the exchanging device (G1, G2, G3) after connection, and to send commands to the exchanging device (G1, G2, G3), are further designed to disconnect the functionally safe connection to the currently connected exchanging device (G1, G2, G3) and to initiate and control the disconnection of the exchanging device (G1, G2, G3) from the coupling point (S1, S2, S3), wherein the safety program (P1, P2, P3) is further designed to enable exclusive access to the exchanging device (G1, G2, G3) again. - a fieldbus, - at least two exchanging devices (G1, G2, G3) with an exchangeable tool (W1, W2, W3), - at least two automation devices (H1, H2, H3) which are securely connected to the fieldbus, - at least two coupling points (S1, S2, S3) which are connected to the field bus and designed for an automated connection and disconnection of an exchanging device (G1, G2, G3) to and from the fieldbus, wherein each exchanging device (G1, G2, G3) comprises a fieldbus subscriber (TN1, TN2, TN3) which is embodied to control actuators on the tool (W1, W2, W3), the exchanging devices (G1, G2, G3) comprise an exchangeable tool and a fieldbus subscriber and are further designed to establish a functionally safe connection with the automation devices (H1, H2, H3) by way of the fieldbus, wherein the functional safety thus achieved serves to avoid malfunctions as a result of errors, characterised by a virtual ring which connects the automation devices (H1, H2, H3), wherein the automation devices (H1, H2, H3) are designed to exchange a token (T1, T2, T3) assigned to each of the exchanging devices (G1, G2, G3) by way of the virtual ring, furthermore, the automation devices (H1, H2, H3) are designed to gain exclusive access to an exchanging device, to wait for the token (T1, T2, T3) assigned to the exchanging device (G1, G2, G3) and to retain it for the duration of the exclusive access and to forward the tokens (T1, T2, T3) which are not required, the automation devices (H1, H2, H3) are designed to gain exclusive access to one of the exchanging devices (G1, G2, G3) by means of a safety program (P1, P2, P3) and to initiate and control a connection of the corresponding exchanging device (G1, G2, G3) to the corresponding coupling point (S1, S2, S3) after obtaining the token (T1, T2, T3) assigned to the exchanging device (G1, G2, G3), are further designed to establish a functionally safe connection to the exchanging device (G1, G2, G3) after connection, and to send commands to the exchanging device (G1, G2, G3), are further designed to disconnect the functionally safe connection to the currently connected exchanging device (G1, G2, G3) and to initiate and control the disconnection of the exchanging device (G1, G2, G3) from the coupling point (S1, S2, S3), wherein the safety program (P1, P2, P3) is further designed to enable exclusive access to the exchanging device (G1, G2, G3) again.