Secure networks start at the physical layer: network isolators from EMO Systems
Whether in hospitals, industrial plants or railway technology, the electrical safety of the infrastructure is crucial to the availability and personal safety of Ethernet connections linking safety-critical systems. With the NIS 2 Directive, the resilience of the physical network infrastructure is also becoming a key focus for operators. EMO Systems GmbH’s EMOSAFE network isolators, developed and manufactured in Germany, address precisely this need.
Why is galvanic isolation essential in Ethernet
Copper-based network cabling connects devices both logically and electrically. Potential differences, equalising currents and overvoltages caused by installation errors, ageing or lightning strikes can damage systems connected via the data line and, in the case of medical technology, endanger people.
A network isolator maintains data transmission with virtually no loss whilst breaking all electrically conductive connections between network peripherals and end devices. In patient environments, IEC 60601-1 requires an isolation device that complies with the standard (2 MOPP) for signal-transmitting interfaces, which is why network isolators are often referred to as ‘medical network isolators’.
NIS-2: The cross-threat approach includes the physical layer
Under the NIS-2 Directive, the EU requires essential and critical infrastructure, ranging from hospitals to energy suppliers and transport operators, to implement risk management based on the cross-hazard approach (Article 21(2)). This explicitly includes physical security and the security of the environment surrounding network and information systems.
It is important to note that a network isolator does not provide defence against cyber-attacks; it addresses the electrical and physical layer of the network infrastructure. This layer falls within the scope of protection, as overvoltage events, potential differences between system components, and electrically induced failures can impact the availability of critical systems. As senior management is responsible for implementing risk management measures (Art. 20(1)), it is worth systematically identifying vulnerabilities that are often overlooked, such as freely accessible RJ45 ports and unprotected device interfaces in OT environments.
Outside the European Union, national regulations on cyber security and resilience apply instead. Regardless of the regulatory framework, protecting the network infrastructure against electrically induced failures remains an essential component of resilient system design.
Supply Chain Security: Why the manufacturing location matters
NIS-2 also focuses on supply chain security. For operators of critical infrastructure, it is therefore important to know the origin of safety-critical components, the transparency of the manufacturing process, and the resilience of the supply chain in an emergency.
EMO Systems develops and manufactures its network isolators in Berlin, exercising end-to-end control over the entire development, production and testing process. These processes are certified to DIN EN ISO 9001 and DIN EN ISO 13485 standards. Each EMOSAFE network isolator undergoes individual testing prior to dispatch, during which the dielectric strength is measured and documented – providing evidence that carries equal weight with hospitals, specialist planners and auditors alike.
Short supply chains, documented test chains and a European manufacturing site ensure traceable quality and reliable supply, eliminating the need for long, opaque supply chains.
The technology: high-performance and maintenance-free
EMOSAFE network isolators operate on the principle of electromagnetic induction, requiring neither their own power supply nor the installation of drivers. Depending on the model, specially developed transformer modules achieve dielectric strengths of up to 6,000 V AC and 8,500 V DC with a three-layer insulation structure.
The standard maximum Ethernet cable length of 100 metres can be used in most installations without any loss of data throughput. Depending on the model, transmission rates of up to 10 Gbit/s are supported. The product range is considered the most comprehensive of its kind worldwide:
- Ultra-compact and enclosed models for the patient environment in accordance with IEC 60601-1 (2 MOPP), UL-listed
- Variants with touch protection and pull-out protection for use close to the patient
- Industrial-grade solutions, including DIN rail mounting, for operating theatre and automation environments
- Models compliant with DIN EN 50155 for railway and transport technology
Areas of application: from hospital wards to critical infrastructure facilities
Typical applications include:
- Medical electrical equipment with Ethernet interfaces in patient care environments
- Sensitive measurement and monitoring technology in test laboratories
- Geographically distributed computer systems with equipotential bonding issues
- OT networks in industry, the energy sector, and public transport
Network isolators enable standard-compliant networking without complex additional installations, allowing for plug-and-play without interfering with the network structure, which is particularly useful when renovating or refitting hospital wards.
Electrical safety as a building block of resilient network infrastructures
Ensuring the electrical safety of network infrastructure is not an optional extra, but an integral part of cross-hazard risk management, as required by NIS-2.
With over two decades of experience manufacturing in Germany, certified processes and documented individual testing, EMO Systems provides operators, specialist planners and equipment manufacturers with a reliable foundation, from individual treatment rooms to KRITIS projects.
FAQ
A network isolator provides galvanic isolation between two Ethernet segments. It maintains data transmission while interrupting electrically conductive connections. This prevents surges, equipotential bonding currents, and other electrical interference from affecting connected devices.
It uses specially designed transformers. These transmit Ethernet data contactlessly via electromagnetic induction. The isolator is largely transparent to the network, meaning that IP addresses, protocols and data rates remain unchanged. However, electrical currents cannot pass through the isolation point.
It protects against electrical interference that can be transmitted via copper Ethernet cables. This includes, among other things:
• Overvoltages caused by lightning or switching operations
• Equipotential bonding currents between different earth potentials
• Earth loops
• Conducted EMC interference
• Leakage currents in medical applications
These events can damage equipment or impair network availability.
No, as both components fulfil completely different functions.
A firewall monitors and filters data traffic. It protects against unauthorised access, malware, and network-level attacks.
A network isolator, on the other hand, operates at the physical level. While it protects hardware from electrically induced damage, it allows all Ethernet data to pass through, including malware and unauthorised network traffic.
A firewall exclusively processes data packets. However, electrical events such as lightning surges or equipotential bonding currents travel directly along the copper cable. By the time the software can react, the connected electronics may already be damaged. Only galvanic isolation can protect against such physical effects.
Network isolators are used wherever Ethernet connections link different buildings, plant components, or potential zones. Typical areas of application include:
• Hospitals and medical facilities
• Industrial and production plants
• Building automation
• Energy supply
• Railway technology
• Test facilities and laboratories
Particularly high standards of protection against electrical hazards apply in patient environments. The IEC 60601-1 standard requires appropriate measures (2 MOPP) for patient safety for signal-transmitting interfaces. Network isolators enable the galvanic isolation of Ethernet connections in accordance with this standard.
The NIS-2 Directive requires operators of critical and important facilities to implement a comprehensive risk management strategy based on the ‘all-hazards’ approach. This approach considers both cyber risks and physical threats.
Although a network isolator does not protect against cyber attacks, it can increase the availability of network infrastructure in the event of electrically induced disturbances, such as power surges or potential differences.
Modern network isolators operate transparently within the Ethernet network. Depending on the model, they support data rates of up to 10 Gbit/s. In most applications, the maximum Ethernet link length and data throughput remain unaffected.
No, galvanic network isolators operate passively and require neither a separate power supply nor any configuration or firmware. They are simply installed between two Ethernet connections.
A surge protector limits and diverts voltage spikes to earth. A network isolator goes one step further by completely interrupting the electrically conductive path. This prevents surges, equipotential bonding currents, earth loops and other line-borne interference.
Images and videos: EMO Systems
