Method, system, monitoring unit and display device for graphical user interface

Abstract

The present invention relates to safety-related input on a graphical user interface. A computer generates image data, which are transmitted to a display via an image data line. The user interface has at least one graphic operating element, which can be selected via an input device. In addition, a monitoring unit is connected to the image data line and reads out the image data for a safety function. According to the present invention, input information is fed from the input device to the monitoring unit, and the monitoring unit is connected to a confirmation device via a secure channel for user confirmation. In addition, according to the present invention, it is provided that the monitoring unit ensures and / or verifies whether the recognized selection of the operating element is correctly expressed, and in the case of user confirmation of the expressed selection of the operating element, the configured safety-related operating instructions are started or triggered, in particular via a secure channel. This also enables safe input through input devices that cannot be safely authenticated. In addition, a preferred structure for the monitoring unit is proposed, which is particularly suitable for the proposed input method.

Description

Technical Field

[0001] The invention generally relates to graphical user interfaces (GUIs), in the use of which safety in the sense of risk or operational safety is crucial. Background Art

[0002] The invention relates in particular to user interfaces, for example in control systems for railway technology or at control desks or plant control systems for operating industrial plants, reactors or the like, in which certain operations or inputs are safety-critical or critical. In such applications it must be ensured that the information or inputs detected as inputs correspond exactly to the selections or choices made by the operator.

[0003] Information as a pure representation of computer graphics is already prone to errors. Thus, for example, errors can occur in any individual component of the computer that generates the graphics, for example due to a defective microprocessor, in the graphics processor, in individual memory modules, in the power supply, but also in particular due to software errors in the operating system, in the libraries and in particular the application software used in the software creation, or in other software components that generate the GUI.

[0004] For displaying safety-related information according to the principle from WO 2011 / 003872 A1 or the applicant's patent EP 2 353 089 B1, available under the trade name The technology obtained below provides a significant improvement solution. The technology can make the expression safer and suitable for safety level SIL-2 or higher, for example. A significant advantage is that hardware and software of any type and complexity that are evaluated as non-safe (hereinafter referred to as unsafe) in the sense of safety technology can be used provably safely due to the provision of a separate, safety-certified monitoring module.

[0005] If, in addition to the purely expressive presentation of safety-related information, safety-related inputs are also made on the user interface (GUI), then further sources of error are obviously introduced. Potential sources of error are in principle all hardware and software components for detecting and processing the inputs. This applies in particular to the case where a system which is not itself safe and consists of commercially available hardware is to be equipped with a safety module according to the above-described approach in order to avoid safety certification or safety certification of the entire system. However, the latter safety-related inputs on the user interface (GUI) are particularly desirable when various graphical operating elements or switching interfaces in the GUI should be freely usable in order to enable intuitive operation in the usual way, for example via a computer mouse or touch screen, or also to allow subsequent changes to the GUI without re-authentication.

[0006] In the desired modular or timely user interface or GUI, it is difficult to incorporate that not only the functions and expressions should be freely programmable, but also the GUI should be dynamically or context-dependently changeable during use. The resulting safety-critical error modes with regard to data entry or GUI operation are various and include the following purely by way of example: a) the unsafely expressed computer incorrectly configures the operation of a graphical operating element to an information content that differs from the correct information content (e.g. from another context); b) an operated operating element is incorrectly displayed or is not detected as being operated (e.g. in the case of an emergency stop), or c) the operation of an operating element is triggered randomly or accidentally, without actually having made an input controlled by the user or operated by the user.

[0007] In particular, for the first mentioned cases, the invention of the applicant's European patent EP 2 551 787 B1 proposes a decisive improvement, especially in the case of touch screens. The latter two cases can also be avoided at a certain additional cost by the following solution principle. The principle is now known under the brand name The following is successful in the market and is primarily designed for touch screens. A variant solution, in particular for an HMI device with programmable keys (so-called softkeys), is described in utility model DE 20 2015 104 887 U1.

[0008] Both solutions allow for safety-related inputs to be made on a GUI, which are generated by a computer that is evaluated as unsafe or not safety-certified. In this case, a user interface with at least one graphical operating element is displayed on a display, which can be selected by a user by means of a corresponding input device. A separate monitoring unit or security module is connected to the image data line and reads out at least part of the image data for the desired safety function.

[0009] According to EP 2 551 787 B1 and according to the solution of DE 20 2015 104 887 U1, a safe input is realized in the following sense, that is, the user operates the configured graphic operating element for discontinuous input by touch operation or by a Softkey button configured to the display, that is, an absolute and direct input device, and the monitoring unit accurately determines the coordinates corresponding to the operation, and the coordinates are configured to the predefined area in the unit or module. The monitoring unit converts the image data about the predefined area directly into safety-related instructions, especially by encoding, starting from the accurately determined coordinates. That is to say, the computer of unsafe expression is not taken into account here. Based on the configuration relationship in the unit or module, the touch input component or Softkey input component connected to the unit or module and the image data conversion or encoding itself, it is ensured that the activation of the instruction accurately corresponds to the acceptance and selection actually made by the user on the display. The display itself can be evaluated as a safe device at present.

[0010] The solutions according to EP 2 551 787 B1 and DE 20 2015 104 887 U1 are each adapted to a specific input device and require safety-reliable determination of the coordinates of the image region about which the encoding or conversion into safety-relevant commands is performed. Both are associated with a certain level of expense and limit the usable hardware. Summary of the invention

[0011] The first object of the present invention is to provide an improvement which enables secure input in a graphical user interface by means of different conventional or unsecured input devices, in particular relative pointer devices, such as a computer mouse, and at a conventional desktop workstation of a commercially available personal computer as a computer. In this context, input is understood to mean, in particular, the user-controlled selection or operation of operating elements of the user interface, that the input is at least also to be carried out by using unsecured input devices, in particular pointer devices, such as a computer mouse, trackball, joystick, touchpad, touchpoint, drawing tablet or digitizer or the like.

[0012] This object is achieved by a method according to claim 1 and by a safety module according to claim 10. The solution should be suitable for at least a safety requirement level or safety integrity level SIL-2 (Safety Integrity Level according to IEC 61508 / IEC 61511) or a higher safety requirement level or safety integrity level, in particular SIL-3.

[0013] A method or system of the type described allows safety-related or security-relevant inputs to be made on a graphical user interface (hereinafter referred to as GUI). In this case, a computer generates pixel-formatted image data for a display, which are transmitted from the computer to the display via an image data line. An input device enables the operation of the GUI.

[0014] When the user interface is displayed on the display, at least in an operating state or context, at least one graphical operating element is displayed to which a safety-related function is assigned. The operating element can be selected by the user via an input device, for example via a pointer or cursor.

[0015] Furthermore, according to this approach, a monitoring unit or a safety module separate from the display computer is connected to the image data line and reads out at least part of the image data for safety-related functions. The monitoring unit is in particular independent of or separate from the display computer in terms of signal technology.

[0016] According to a first aspect of the present invention, the method provides:

[0017] - supplying input information, in particular pixel-related relative or absolute coordinates, from the input device to the monitoring unit via a logical or physical channel or first channel, based on which the selection of the operating element can be detected;

[0018] - the monitoring unit is connected to a confirmation device via a secure channel, in particular a dedicated, separate physical second channel, for receiving a user-controlled confirmation regarding the selection, said confirmation device being in particular designed as a secure device and preferably being independent of the computer and / or input device being expressed in terms of signal technology;

[0019] the monitoring unit ensures (in particular ensures itself or causes and / or verifies) that the or each user-controlled selection of an operating element having a safety function is represented as desired or actually correctly in the image data supplied to the display; and

[0020] The monitoring unit starts or triggers a safety-related function assigned to the operating element in the event of a confirmation received by the user via the second channel, within a time period that exists during which the selection of the operating element is represented reliably, in particular in a guaranteed or verified manner.

[0021] The triggering can be achieved in particular by outputting corresponding commands, preferably via a third channel provided specifically for secure communication.

[0022] According to the invention, the selection by means of the input device does not yet involve the manipulation or operation of a safety-related function, but rather the manipulation or operation initially merely visually or visually represents the selection of a safety-related operating element to the user. The manipulation or operation of the operating element is actually triggered only after the module verifies or determines that the desired preconditions of the module are met or ensured by itself, with the user-controlled confirmation at an additional confirmation device, which is preferably directly connected to the monitoring module and / or is implemented safely. The preconditions include in particular that the selection is reproduced in accordance with the expectations or accurately in the image data supplied to the display.

[0023] The display and operating concept of a classic computer workstation can be retained here and any commercially available input devices can be used. According to the invention, in particular COTS (commercial off-the-shelf) pointer devices can be used. Preferably, the conventional indirect and relative pointer devices for 2D input are used as input devices, in particular a computer mouse, but also, for example, a trackball, a joystick, a touchpad, a digitizer or the like can be used, for example.

[0024] The safety of the operation or input is also achieved by a single operation on an additional confirmation device, for example a safety button connected to the monitoring unit, in combination with the selection which is reliably displayed according to the invention. The user thus considers, as an example, the confirmation of the actually desired input by means of the confirmation device.

[0025] The solution proposed according to the present invention can therefore eliminate, unlike EP 2 551 787 B1 or DE 20 2015 104 887 U1, the secure input via a touch screen and the determination of input information, in particular absolute coordinates, or eliminate direct input (via softkeys), in that the input process is essentially divided into three sub-steps, namely:

[0026] i) generating or determining input information, such as selection coordinates, separately from the actual operation;

[0027] ii) displaying a selection or choice of the operating element based on the input information so that the input is approved or confirmed by the user in response to the displayed selection; and

[0028] iii) Then or immediately afterward, upon confirmation by the user using an additional confirmation device, a safety-related function assigned to the operating element is activated.

[0029] In sub-step i), the coordinate determination can be realized, for example, by using a commercially available computer mouse, which as a relative pointer device transmits the displacement as a coordinate change (DELTA-coordinate) to the controller. Thus, for example, the absolute coordinates of the displayed graphics can be formed from the pre-set position and the change or displacement. In order to realize sub-step ii), for example, the absolute coordinates can be pre-stored in the monitoring unit, that is, in a safer module, and preferably visualized by the module, for example in the form of a mouse pointer, at the absolute coordinates known in the module. Alternatively or additionally, in particular for positions or coordinates outside the pre-defined image area with the safety-related operating elements, the visualization can also be realized by an unsafe representation computer. Within the pre-defined image area with the safety-related operating elements, the visualization should be realized accurately or reliably at the position corresponding to the absolute coordinates pre-stored in the module. In sub-step iii), the user or observer can recognize the visualization as a selection position suitable for the safety-related operating element and approve or confirm it to trigger the desired operation. This can be realized in sub-step iii) by operating a separate safety confirmation device, such as a button. The monitoring unit or module can generate or output corresponding instructions based on this.

[0030] In short, the selection that is securely displayed here is separated from the operation of the operating element by confirmation by means of a confirmation device. As a result, the invention does not require a possibly expensive accurate determination of input information, such as absolute coordinates, which can be achieved with difficulty by any commercially available input device. Furthermore, it is not important via which channel, such as also an unsafe channel, the input information is transmitted to the monitoring unit. The unsafe input device can, for example, also be connected to an unsafe computer. The input information can, for example, be transmitted to the monitoring unit via an image data line, if necessary, together with the image data, for example, in a pixel data container according to EP 2 353 089 B1.

[0031] The proposed solution is basically independent of the type and generation of the input information, so that any input devices, in particular indirect and / or relative COTS pointer devices, can be used.

[0032] Preferably, in contrast to the teachings of EP 2 551 787 B1 and DE 20 2015 104 887 U1, a pointer device is used, which is suitable for relative and continuous input, in particular an indirect pointer device for 2D input. Commercial general-purpose or COTS peripheral devices, in particular a computer mouse, can be used here. The device allows intuitive pointer guidance or cursor guidance in a GUI. Accordingly, the relative movements acquired by the pointer device are converted and, in particular, converted into pointer movements or image coordinates relative to the resolution of the display.

[0033] Input information associated with an input device, in particular a pointer device, can be supplied to the monitoring unit via any desired interface. The transmission to the monitoring unit can be effected in particular directly by the input device (when the input device is connected to the monitoring unit, in particular a controller element of the monitoring unit) or indirectly by a computer, for example a personal computer desktop with a connected computer mouse.

[0034] The selection or visualization can be realized by means of the monitoring unit or module, for example by means of a mouse pointer that is gradually displayed by means of the monitoring unit or by means of a different visual recognition method, for example by means of a colored frame or a color change of the selected operating element.

[0035] The monitoring unit can detect a subsequent approval or confirmation by a user input regarding a safety-critical operating element, which is highlighted visually by the monitoring unit, for example, in order to output an operating instruction corresponding to the safety-critical operating element or its proper function in the GUI.

[0036] In a preferred embodiment, it is ensured by the monitoring unit itself that the recognized selection of the operating element correctly expresses the image data fed into the display. This can be achieved in that the monitoring unit modifies at least a portion of the image data that is intended for display in a predetermined image area that is assigned to the operating element, and the monitoring unit transmits the correspondingly modified image data to the display. The change can here, for example, include a pointer expression implemented by the monitoring unit, or the image data modified by the monitoring unit expresses a pointer in relation to the position of input information that is currently fed to the monitoring unit. The change can additionally or alternatively realize a visual highlighting or visually recognizable manner of the user's selection on the display, in particular in a predetermined image area assigned to the corresponding operating element.

[0037] The image data may in particular be digital image data represented in pixel format.

[0038] In particular, it can be provided that the image data modified by the monitoring unit only partially overlap the image data generated by the computer, in particular in a relatively small image area with respect to the entire graphical user interface, ie the GUI representation is at least predominantly generated by the representing computer.

[0039] Instead of ensuring the exact selection display by means of image changes by means of the monitoring unit itself, it can be provided that the selection of the operating element is represented by computer-generated image data that are represented. In this case, it is particularly provided that the monitoring unit checks that the recognized selection of the operating element represents the image data fed into the display accordingly correctly. This can be achieved in that the monitoring unit calculates a check code for the image data that are intended for display in a predetermined image area that is assigned to the operating element and compares the check code with at least one prestored reference code. For this purpose, for example, a technology based on the principle of the applicant's patent EP 2 353 089 B1 is suitable.

[0040] For easy operability of the user interface in the represented computer and / or easy identification of the selection in the monitoring unit, it should be provided that, depending on whether the conventional input device is connected directly to the monitoring unit or to the represented computer, the input information is transmitted from the input device via the monitoring unit to the computer or via the computer to the monitoring unit. In a preferred embodiment, the conventional input device, in particular a computer mouse, is directly connected to the monitoring unit.

[0041] In order to ensure a correct display of the selection, in particular by image modification in combination with image data modification by means of the monitoring unit, it is preferably provided that the monitoring unit comprises a first computing unit to which computer-generated image data are supplied on the input side, in particular from a display computer via an image data line, and the first computing unit modifies the image data as a function of the selection of a safety-critical operating element in order to visually highlight the selection and outputs output-side image data, including image data modified accordingly, to a display. The monitoring unit may also comprise a second computing unit for checking the output-side image data of the first computing unit, in particular the modified image data, for example for image data coding for comparison with a code generated by computer technology.

[0042] In particular, in a further embodiment, it can be provided that a first computing component calculates a first-level check code for computer-generated or input-side image data, which image data are intended to be displayed in a predetermined image area, and a monitoring unit compares the first-level check code with at least one prestored reference code for the predetermined image area, wherein the first computing component preferably calculates the first-level check code for the computer-generated image data on the input side in a first step and subsequently modifies the image data in a second step.

[0043] In an embodiment that is efficient in terms of the hardware expenditure and computing expenditure involved, which can also be used modularly for other applications, such as expression verification, it can be provided that:

[0044] - a first calculation unit of the monitoring unit calculates a first check code of the second level for the image data modified by the first calculation unit, the image data being intended for display in a predetermined image area;

[0045] a second calculation unit calculates a second check code of a second level for the image data at the output of the first calculation unit, the image data being intended for display in a predetermined image area; and

[0046] In particular, the monitoring unit compares the check codes of the second stage generated in this way with one another in order to check whether the selected projection is in compliance with the specification by the first computing component.

[0047] In this case, preferably two computing components can each calculate a third check code for image data without selection of a predetermined image region, and the monitoring unit compares the third check codes with each other in order to check that the display of the operating element is in compliance with regulations before highlighting for displaying the selection or without highlighting for displaying the selection.

[0048] In order to reduce the required computing power, it can be provided that the computing component calculates one or more of the above-mentioned check codes only upon selection of the operating element detected by the monitoring unit.

[0049] The corresponding check code can be determined in particular for pixel-formatted image data for a predetermined image area assigned to the operating element, which image area, for example, only partially or completely corresponds to the display area of ​​the operating element. Any suitable encoding method, such as calculation, can be used here. In this regard, the teachings from WO 2011 / 003872 A1 or EP 2 353 089 B1 come into consideration.

[0050] The first computing unit can modify the image data in order to visually highlight the selection, so that the selected operating element is displayed in a second selected state that is visually distinguishable from a first, unselected representation state, for example by fading in a frame, by a color change or the like. This improves the ergonomics or simplifies the visual recognition of the selection for the user. However, the pure display of a pointer on the operating element is also understood as a selection of the representation of the operating element. However, if the current coordinates coincide with a safety-related operating element, the pointer can be faded out and replaced by fading in a selected state that enables visual recognition.

[0051] In principle, in one embodiment, the first computing component can output the modified image data in an image data stream together with the computer-generated image data to a display, which can be achieved, for example, in a simple manner by only partially overwriting or overwriting the computer-generated image data with regard to the graphics and otherwise keeping the computer-generated image data unchanged.

[0052] The monitoring unit is preferably designed as a circuit module having at least one integrated circuit. The monitoring unit can be connected in series with the first computing component in an image data line, preferably in the vicinity of the display, in particular directly at the image data input of the display.

[0053] In an embodiment particularly suitable for conventional operating concepts, a pointer or cursor, in particular a mouse pointer controlled by a computer mouse, is displayed on the display for operating the user interface. It can be provided that the pointer is generated only by the monitoring unit, in particular by modifying the image data in the monitoring unit, for example by means of a first computing component, based on input information supplied to the monitoring unit. In this case, the input device, preferably a pointer device, in particular a computer mouse, can in turn be preferably connected directly to the monitoring unit. Accordingly, the module forwards the input information to the computer of the display.

[0054] The method and the device may be implemented in such a way that a pointer or a cursor is displayed or faded in in a GUI in a way that is visible to the user, in particular, is continuously visible, in order to enable customary, continuous operation.

[0055] A relative and / or indirect pointer device is preferably used as an input device, which is preferably suitable for continuous pointer guidance. For example, a COTS pointer device with a USB interface can be used here. However, the COTS pointer device is not within the framework of the present invention, but a specific manufactured product is provided as the pointer device, which is compatible with a conventional relative pointer device (such as a computer mouse) and additionally has an unrelated confirmation device with SIL capability, such as a signal technology safety button, as an integrated component. The confirmation device is preferably connected to the monitoring unit through its own separate channel independently of the signal connection device of the pointer device, and the channel is designed logically and / or physically securely.

[0056] In another embodiment with pointer operation, it can be provided that the pointer is generated by the expressing computer at least outside all predetermined image regions for safety-critical operating elements. Here, it can also be provided that when the selection of a safety-critical operating element is recognized by the monitoring unit, the pointer generated by the computer is preferably not displayed in the correspondingly configured image region by modifying the image data in the monitoring unit. In particular, in this embodiment, the input device, especially a computer mouse, can be directly connected to the expressing computer in a conventional manner, for example, through a USB port. Correspondingly, the last input information is continuously transmitted to the monitoring unit.

[0057] In particular, in order to simplify the verification of image data, for example, by calculating a checksum, it can be advantageous that the pointer, especially the mouse pointer, preferably fades in and out cyclically at the following frequency, which is not perceived as disturbing by the user. Thus, for example, for N consecutive image cycles of the image data, the mouse pointer can be expressed by the computer or the monitoring unit only for m < N number of image cycles. This enables the possibility of calculating a checksum for the image data with a pointer that fades out, especially with respect to the operating element. This significantly simplifies the verification of accurate expression because the pointer should typically be highly position-variable or move within a very fine grid in the GUI. Alternatively, as long as the determined coordinates or input information do not exceed the corresponding region, the pointer expression can also be fixed or held stationary at a unique pre-given position within the operating element by suitable software.

[0058] The input information can in particular be absolute coordinate information according to the input device, for example, typically for a touch device, or relative coordinate information, for example, typically for a computer mouse. The relative coordinate information can be easily converted into absolute coordinate information computationally.

[0059] Furthermore, in terms of the device, according to the present invention, a monitoring unit for monitoring a graphical user interface (GUI) is proposed, which at least includes:

[0060] a digital image data interface for connection to an image data line for transmitting image data generated by the computer from the computer to the display, the image data interface being in particular an LVDS interface, an HDMI interface or the like;

[0061] at least one computing unit which implements security functions and reads out at least parts of the image data via the image data interface; and

[0062] - a device interface for inputting information, in particular from an input device, for user-controlled selection of graphical operating elements.

[0063] In addition, according to the first aspect of the invention, the monitoring unit has a physical confirmation input, to which a secure confirmation device for inputting confirmation or user approval can be connected; and at least one computing component is configured to ensure and / or verify, in particular according to one of the aforementioned method methods, that the identified selection of the operating element correctly expresses the image data input to the display.

[0064] Furthermore, according to the first aspect of the invention, the monitoring unit is configured to output configured safety-related operating instructions, in particular via a safety interface, upon receiving a confirmation input via a confirmation interface, in particular during an expressed selection of an operating element or in a temporally predetermined relationship to the expressed selection of an operating element.

[0065] The proposed monitoring unit preferably has at least one computing component which is provided for modifying the image data and / or for calculating a check code from the image data. The monitoring unit can have at least one memory for predefining the predetermined image region and / or the reference code, in particular for check purposes.

[0066] Preferably, the monitoring unit has a controller component for the input device, which is connected to the device interface for direct connection with the input device. For example, in particular a computer mouse can thus be directly connected to the monitoring unit. In particular in this case, the monitoring unit preferably has a data interface, in particular a bidirectional data interface, for transmitting the input information to an external or separate computer of the representation.

[0067] According to a further independent aspect of the invention, it is proposed that the monitoring unit has a two-stage or, if appropriate, a two-channel computer structure, which has:

[0068] a first computing unit, which is configured to receive computer-generated image data on the input side and to modify at least a portion of the image data in accordance with a security function, the image data being intended for display in a predetermined image area, and to output the image data to a display on the output side,

[0069] A second computing unit is provided for checking the image data output by the first computing unit by calculating a check code for the image data intended for display in the predetermined image region, in particular for modified image data.

[0070] This is regarded as an independent inventive concept which (in particular, however, not only for secure input) enables the generation of safety-related fade-ins or highlighting in a graphical user interface in a secure manner by means of the monitoring unit.

[0071] According to the second aspect, the monitoring unit can be particularly arranged or configured to compare the calculated verification code with at least one prestored reference code, in particular to verify that the projection by the first computing component complies with regulations and / or to trigger a safety-related reaction.

[0072] The monitoring unit with a two-stage structure is, however, not only suitable for the method according to the first aspect described at the outset. The monitoring unit can also be advantageously used in other applications: for example, to accurately fade in a status display as to whether an area is monitored; to accurately display a predefined monitoring area for pure display (without input function); to ensure that an incorrectly expressed area is reliably faded out or overlapped or can be identified as incorrect, etc.

[0073] In particular, according to the second aspect, the first computing unit can be configured to calculate a check code for computer-generated image data, which are intended for display in a monitoring area, for safety-related comparison with at least one prestored reference value, in particular a reference code, for the monitoring area. In this case, the first computing unit can first calculate the check code for the computer-generated image data on the input side and then modify the image data in a second phase, for example, to highlight safety-related information or a safety-related reaction in the event of an error. In particular, in a further development according to the second aspect, it can be provided that the first computing unit and the second computing unit implement different encoding methods and / or are implemented by two separate integrated circuits, in particular in different structures, such as FPGAs, ASICs or the like, i.e. in a diverse manner, in order to minimize the probability of systematic errors by diversity.

[0074] In one specific embodiment, in particular with respect to the second aspect, at least one computing component having a security function, in particular the first computing component and the second computing component, can respectively generate a check code for selected image regions in a computationally technical manner.

[0075] The computing component can be connected to a voting component, for example one or more processors, which is configured to compare the generated check code with pre-stored reference data. The voting component can preferably be implemented as a two-channel processor circuit, preferably as a 2oo2 voter in the case of two computing components, wherein other X-out-of-Y voting concepts are also possible depending on the requirements for security and / or availability.

[0076] When a second computing unit is used, the second computing unit can also be implemented in a dual-channel manner with respect to the modification of the image data, i.e. redundantly with respect to the first channel, but this is not mandatory. In the case of a dual-channel nature of the computing unit, the second channel can modify at least a portion of the image data redundantly in the same way as the first computing unit. When the two computing units calculate a corresponding first check code or a second check code for the modified or redundantly modified image data, the check codes can be compared with each other by a monitoring unit, in particular a voting device component, for functional safety. This ensures that the first computing unit modifies the image data in the desired manner or correctly, for example, to highlight or fade out safety-critical areas.

[0077] Regardless of the first or second aspect, the monitoring unit preferably has a module for safety-related communication via a bus interface, for example for communication according to IEC 61784-3-3 or PROFIsafe Protokoll or the like, which can thus be used as a safety interface for outputting safety-related operating instructions.

[0078] Regardless of the first or second aspect, the monitoring unit can be configured, in particular, by a configurable or programmable computing component, logic unit or computer component, such as an FPGA and / or a microcontroller, so that the monitoring unit is configured to carry out at least one method step according to one of the above-described method-technical embodiments in a computer-executable manner. The term computing component is not limited to a programmable computer, such as a von Neumann computer, but includes units that are capable of processing image data in a computer-technical manner, such as also pre-configured FPGAs, ASICs and the like.

[0079] The monitoring unit according to the first or second aspect is particularly suitable for being equipped with a display device for displaying pixel graphics, in particular with a TFT panel. Here, the modular monitoring unit can be integrated into the device, for example directly on the image data input. The display can have at least one port for inputting a device connected to the device interface of the monitoring unit and a port for a safety confirmation device connected to the confirmation input of the monitoring unit.

[0080] The invention also relates to a system for safety-related input on a GUI, comprising a computer and a display for pixel graphics connected to the computer via an image data line. According to the invention, in particular according to a first aspect, a monitoring unit physically separated from the computer is provided as described above.

[0081] According to the first aspect, the system can further include an input device for operating the user interface, in particular a computer mouse, which is preferably directly connected to the device interface of the monitoring unit. In addition, at least according to the first aspect, a separate safety confirmation device, in particular a safety key, for example with a switch contact, is connected to the physical confirmation input of the monitoring unit.

[0082] The above-mentioned method features and device features can be combined with one another and can also be regarded as significantly inventive each independently or on their own.

[0083] The proposed solution can be advantageously used, for example, for parameterization in safety-related processes or systems, such as process technology or automation technology, in order to enable safe and at the same time user-friendly operation via a GUI.

[0084] The application areas of the invention are not limited to displays or computer desktop systems, but also include so-called mobile devices or portable small devices, for example for remote control of machines or devices. Such small devices, such as tablet computers and similar devices, are used, for example, for controlling container cranes in ports or programming industrial robots. In addition, the invention can also be used in systems with important access or authorization security, in particular systems requiring authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] Further features and advantages of the present invention are apparent from the accompanying drawings without limiting the scope of protection of the following detailed description of preferred embodiments. Here, the following are shown:

[0086] Figure 1 : Schematic diagram of a system for security-related user input on a graphical user interface (GUI) generated by an unsecured computer;

[0087] Figures 2A-2C: Three embodiments for monitoring GUI, wherein the input device is connected to the expressed computer and the confirmation device is connected to the monitoring unit according to the invention ( Figure 2A ); the input device and the confirmation device are connected to the monitoring unit according to the present invention ( Figure 2B );and( Figure 2C ) Figure 2B A variant of the confirmation device;

[0088] Figures 3A-3C : To illustrate the method according to the invention, different states of a purely exemplary GUI are shown on a display, the GUI having operating elements and a mouse pointer for selecting operating elements in different states: with a non-safety-related operating element selected ( Figure 3A ), when not selected ( Figure 3B ), and with selected safety-related operating elements ( Figure 3C );

[0089] Figures 4A-4B : Two exemplary embodiments of a monitoring unit with schematic signal flow diagrams for illustrating how the monitoring unit ensures that a recognized selection of an operating element is correctly represented in the image data;

[0090] Figure 5A-5B In a safety-critical application according to an independent further inventive aspect, the monitoring unit is configured for a safety input ( Figure 5A ) and / or display ( Figure 5B );and

[0091] Figure 6 : Schematic diagram of a display device with an integrated monitoring unit according to one of the invention aspects. DETAILED DESCRIPTION

[0092] FIG. 1 schematically shows a component or system 10 for safety-related input on a graphical user interface (GUI), which has a computer 1 that generates pixel-formatted, digital image data. For display, the image data is transmitted to a COTS display 2, such as a TFT computer screen, via a suitable image data line 3. Any COTS computer, such as a personal computer desktop, is considered here as a representation of a computer 1, hereinafter referred to as PC 1. PC 1 is considered to be unsafe in the sense of safety requirements or unsafe in signal technology or unsafe in the sense of safety technology. PC 1 can also be programmed or programmed by different modes or display masks related to the context in order to express any desired GUI related to use on the display 2 (see FIG3A-3C). Part of the system 10 in FIG. 1 is an input device for operating the GUI, that is, in FIG. 1, a relative, continuous and indirect pointer device, here a commercially available computer mouse 4. A COTS computer mouse, referred to as mouse 4 in common technology, is connected to PC 1 in FIG. 1, for example. Mouse 4 is also considered unsafe in terms of safety technology.

[0093] The user can operate the graphical operating elements in the customary manner with the aid of a mouse 4 or another relative, indirect and continuous pointing device by moving a position pointer or mouse pointer 5 in the GUI display generated by the PC 1 .

[0094] In order to achieve the desired safety level, for example SIL-3, despite the use of unsafe components, for example an unsafe PC 1 and a COTS input device, here a mouse 4, an additional modular monitoring unit 11 is provided, as schematically shown in FIG. 1. The monitoring unit 11 is provided as a separate hardware or independent module and is safety certified. The modular monitoring unit 11, hereinafter referred to as SMU (English for safety monitoring unit), is connected to the image data line 3 and can be connected, for example, to the image data input of the display 2. The SMU 11 is provided for reading out at least a part of the image data from the image data line 3 for the purpose of implementing the safety function and, in particular, for monitoring a predetermined image area for error disclosure and / or, if necessary, also for displaying on the display 2 to modify the image data. The image data line 3 can be transmitted in any suitable signal format, for example LVDS or the like, wherein the image data is preferably digital and pixel formatted.

[0095] Furthermore, input information is supplied to the SMU 11 via a first channel or path 11A, which does not have to be implemented securely. The input information includes, in particular, the coordinates determined by the operation of the mouse 4, i.e., the relative coordinates ( Figure 2A) or the pointer coordinates of the mouse pointer 5 (=cursor) generated from the relative coordinates and associated with the graphic ( Figure 2B 1, for example, by the PC 1 from the relative coordinates of the mouse 4 and transmitted from the PC 1 via the first channel 11A to the SMU 11. Depending on the input device, for example in the case of a digitizer, absolute coordinates can also be generated by the digitizer and transmitted to the SMU 11 via the channel 11A.

[0096] Based on the input information, in particular the pointer coordinates, the SMU 11 can recognize the selection or user-controlled selection of a safety-critical operating element 6 (shown here only schematically). Here, any operating element of the GUI is considered as a safety-critical operating element 6, the operation of which is configured or is intended to trigger (for example, PIN input) an application-related, safety-related function in the sense of risk or operational safety (for example, switching a switch in a railway control mechanism) or is also configured or is intended to trigger access security or authorization security (for example, security). The safety-critical operating element is hereinafter referred to as SEE (for safety / security relevant entry element).

[0097] FIG. 1 further shows a separate confirmation device 14, hereby referred to as CD (confirmation device in English), which is connected to the SMU 11 via a second channel or channel 11B. The CD 14 is preferably implemented separately from the mouse 4 in terms of hardware. The CD 14 is preferably SIL-capable and is connected to the SMU 11 via its own safety channel 11B. The CD 14 is used in the system 10 for user-controlled confirmation of the desired manipulation or operation of a safety-critical operating element, schematically shown as a SEE 6, which is selected in advance by means of a cursor 5 controlled by the mouse 4. The operation of the buttons of the mouse 4 is ignored in this respect in the case of the SEEs 6 by corresponding programming or can not be used to trigger the critical function assigned to the SEE 6 in question. Rather, the corresponding triggering must be carried out by the user by means of the CD 14, for example, safety buttons or push buttons. The user thus approves or confirms the selection or selection of the SEE 6 for one or each set SEE 6 separately and individually by inputting or operating the additional CD 14.

[0098] The selection of the operating element, including one of the possible multiple SEEs 6, is carried out in accordance with the user's control of the cursor 5. The SMU 11 is also configured, for example programmed, in a computer-technical manner so that it itself ensures, but at least verifies, that one of the possible multiple SEEs 6 (see below) is selected. Figures 3A-3C ) is correctly represented in the image data which are supplied to the display 2 via the image data line 3. This ensures that the selection which is considered to be currently being made in the SMU 11 in a programming manner, for example based on the pointer coordinates of the cursor 5, coincides with the cursor in an accurate manner, which is displayed on the display 3 in a suitable recognizable manner for the observer or user. The latter can be implemented in the SMU 11 in a software manner.

[0099] How the user is able to recognize this, in particular whether it is generated by the PC 1 or by the SMU 11, is of secondary importance, as long as the user visually recognizes the selection, which is considered by the SMU 11 as currently valid or pre-stored. The recognizable manner can in particular already be specified, that is, the cursor 5 points to the SEE 6 in a conventional manner, because this is visible to the user and corresponds to the customary operation. The display concept and operating concept of the classic desktop working position with the PC 1, the display 2 and the cursor 5 guided by the mouse is thus retained in the GUI.

[0100] The system 10 further achieves the desired safety level, for example SIL-3, in that not the (unsafe) expressed PC 1, but only the safe or SIL-compliant SMU 11 triggers safety-related operating instructions or starts safety-related functions in accordance with the selected SEE 6 upon receiving a confirmation by a CD 14 provided for this purpose via user control. The single configuration of the selection of any operating element of the GUI is inherent in a pointer-based GUI with a cursor 5 (because only one cursor 5 is always present). The confirmation (if given) is assigned exactly to the only selection currently displayed as safe by the SMU 11, that is, exactly to the SEE 6, or is otherwise rejected. For this purpose, in particular, the activation of the CD 14 during the expressed selection of the relevant SEE 6 is monitored or queried by the SMU 11 and used to trigger the operating instructions assigned to the SEE 6 by the SMU 11. If the SMU 11 does not recognize the valid selection of one of the possibly multiple SEEs 6 or only performs a fail-safe behavior in the recognized selection, the monitoring or query of the CD 14 can be stopped. The display 2 is considered to be safe here, since typical error situations are recognizable to the user (error disclosure). However, additional hardware measures for verifying the correct display on the display 2 are also possible.

[0101] Figures 2A-2C Three specific embodiments of a system 20A, 20B, 20C according to the invention for secure input by means of opposing pointer devices are shown, which have an SMU 11 or 21 in the image data stream 3 .

[0102] Figure 2A A system 20A is shown which corresponds largely to the principle from FIG. 1 , that is to say it has a mouse 4 and a secure button as a CD 14, which is directly connected to the PC 1, for example to a USB port. The CD 14 is directly connected to a separate SMU 11 via a secure channel 11B. The relative coordinates of the mouse 4 are converted in the PC 1 into image-related or absolute pointer coordinates for controlling the cursor 5 and are continuously transmitted to the SMU 11 via a channel 11A which does not have to be designed to be secure. Alternatively, the absolute pointer coordinates can also be determined in the SMU 11 and transmitted back to the PC 1 via the channel 11A. The channel 11A is designed bidirectionally in the case of the system 20A, so that the SMU 11 can transmit control commands back to the PC 1, in particular with regard to representations on the display 2, for example with regard to fading out the cursor 5 when the cursor is pointing to the SEE 6, when the cursor 5 is currently pointing to the SEE (selection) in order to additionally visually highlight the SEE 6, etc. When a mouse is connected to the PC 1 , the computer is preferably programmed such that the SEE 6 cannot be operated directly via the PC 1 or via the buttons of the mouse 4 .

[0103] Furthermore, the SMU 11 is connected to an external, higher-level safety computer 7, such as a plant control device or the like, via a safety channel or channel 11D. During the selection of the SEE 6, such as a GUI approval button for plant parameterization (the cursor 5 is pointing to the SEE), upon receiving a user-controlled confirmation at the button 14, the SMU 11 outputs the safety-related operating instructions configured for the SEE 6, such as via the channel 11D, to the safety computer 7. The safety channel or channel 11D to the safety computer 7 can be connected via a suitable bus or a suitable network, such as PROFINET (see Figure 6 ) or preferably a ProfiSafe implementation with a safety method (OSI model) which is suitable for secure transmission of signals.

[0104] The CD 14 can be designed to be functionally safe, for example, by suitable controller technology in the SMU 11, and can be implemented, for example, as a single-channel button 14. The reliable function of the CD 14 can be ensured purely by software by a suitable controller. For higher safety requirements, the CD 14 can also be dual-channel, for example with an opening device and a closing device, and / or implemented in a physically safe manner. It must be ensured primarily that the CD 14 correctly transmits to the SMU 11 operations that are not actually being performed. The termination of an operation performed on the CD 14 is recognized by the user as an error.

[0105] By following Figure 2AThe system 20A can be realized, for example, by means of a PC 1 for expression, to continuously fade in a pointer 5, which is controlled by a mouse 4 and whose expression on the display 2 is monitored by the SMU 11 for accuracy, for example according to the solution from WO 2011 / 003872 A1, i.e. by using a check code, which the SMU 11 calculates for a pixel-formatted monitoring area and uses for comparison with a reference code or to infer a value, which is then compared with a reference value. The teaching from WO 2011 / 003872 A1 or patent EP 2 353 089 B1 about the use of a check code is incorporated herein by reference for the sake of simplicity as a preferred solution.

[0106] Figure 2B A preferred system 20B is shown, which is Figure 2A The difference is that the mouse 4 is connected directly to the SMU 21 via the channel 11A. For this purpose, the SMU 21 can include, for example, an input device controller suitable for this purpose, for example in an existing microcontroller or processor, or have a separate hardware component with suitable integration. The input device controller can also be implemented separately externally and communicate with the SMU 21 via an interface, for example I2C ( Figure 6 ). Figure 2B In a preferred embodiment, the conversion of the relative coordinates into image-related pointer coordinates is performed in the SMU 21, and the mouse 4 as an input device generates or transmits the relative coordinates. The generated image-related pointer coordinates or also the relative input coordinates of the mouse and, if necessary, the mouse button interrupts are continuously transmitted from the SMU 21 to the PC 1 via the data channel 11C for controlling the GUI, so that the PC 1 can process the position of the pointer for the display of the GUI and possibly operate the buttons of the mouse 4 for safety-independent inputs. Figure 2B In a configuration of , the SMU 21 constantly has current and possibly also secure input data of the input device, here the mouse 4 .

[0107] In particular, according to Figure 2B The system 20B implements the pointer 5 controlled by the mouse 4 to be gradually displayed, preferably within the SMU 21 or by itself. To this end, the SMU 21 implements, for example, partially overlapping the graphics generated by the PC 1 (see below). Figures 4A-4B ) to modify the image data, which are forwarded to the display 2. In this case, the SMU 21 inherently and continuously knows the pointer coordinates and also each selection of the SEE 6, so that when subsequently confirmed by the user with the aid of the CD 14, the configured critical functions are triggered, for example, the configured safety-related operating instructions are forwarded to the safety computer 7 via the channel 11D.

[0108] Figure 2C A further variant of a system 20C is shown, which differs mainly in the type of confirmation device (CD). In the system 20C, a Softkey button 25 is connected to an SMU 21 as a safety confirmation device via a safety signal line 11B, and the Softkey button is arranged on an HMI including a display 2. The Softkey button 25 corresponds to the construction method according to DE 202015 104 887 Ul, which is incorporated by reference in this respect for the sake of simplicity. The functional safety of the physical button 24 is ensured by a Softkey controller 26. The SMU 21 can alternatively read the button 24 directly and safely. The button 24 is typically arranged on the edge 2 of the display. Graphic icons 23, symbols, etc. can be displayed by the PC 1 here, and the graphic icons assign the individual buttons 24 to the Softkey buttons 25. In order to confirm the input of the SEE 6, corresponding additional or always the same button 24 can be used in a context-dependent manner, wherein, for example, the safety relevance or the required confirmation process can be visually displayed to the user in the GUI with the help of suitable icons 23 for intuitive use. The accuracy of the representation of the supplementary icon 23 with respect to the validation process can in turn also be monitored by the SMU 21, for example according to the concept from WO 2011 / 003872 A1 by encoding the configured image data and comparing them with an expected reference code.

[0109] In the system 20C, it is also possible to separate the selection or selection of a critical SEE 6 based on a pointer from the actual operation / operation of the critical SEE by actuating one of the softkey buttons 24 individually. The corresponding softkey button 24 is assigned to the selected SEE 6 in a predetermined manner in the SMU 21 for confirming the input. Accordingly, the SMU 21 can output the assigned operating instructions to the secure computer 7 via the channel 11D when the user actually confirms, i.e. by pressing the predetermined button 24. In addition, the system 20C can also implement other functionalities in accordance with DE 20 2015 104 887 U1 or also according to EP 2 551 787 B1, if necessary, if the cursor 5 is faded in only by the SMU 21. In the case of fading in a positionally variable cursor by the PC 1, this solution is possible without a great deal of software effort, since a single check code from the image data is required. However, safe operation of the GUI by means of a relative, continuous and indirect input device, such as a mouse 4 via a cursor 5 is important here, ie other functions of the softkey buttons 24 are optional in addition to confirming the input.

[0110] Below Figures 3A-3C The operating method or process is briefly explained in FIG. 2 with the aid of a schematic GUI 2A.

[0111] The user moves cursor 5 on the image displayed by display 2 or within GUI 2A. In this case, a number of non-safety-related operating elements 9 are also provided, which are implemented in a completely conventional manner via PC 1, possibly without the cooperation of SMU 11; 21.

[0112] The SMU 11; 21 recognizes a safety-related selection when the position of the cursor 5 can be identified by means of the pointer coordinates and is directed to a predefined image region (monitoring region) corresponding to the SEE 6. The pointer coordinates (absolute coordinates) are based on the indirect transmission from the input device 4 ( Figure 2A ) or direct transmission ( Figure 2B 2C) and is pre-stored in the SMU 11; 21 and continuously updated. A selection is identified by means of graphic coordinates associated with the graphics, which are predetermined in the SMU 11; 21 as a display area of ​​the SEE 6 or a corresponding monitoring area. The entry of the cursor 5 into the graphic area of ​​the GUI 2A is then recognized, for example, in the input stage of the SMU 11; 21. Optionally, an additional visual highlighting of this area is performed by the SMU 11; 21 or preferably by the SMU 11; 21 itself, as schematically shown, for example. Figure 3C This is achieved, as shown in FIG, by a clearly recognizable frame 8 or the like.

[0113] Based on the current pointer coordinates 5 of the pointer, the SMU 11; 21 knows the selection of the existence of the SEE 6. In the case of the selection, the SMU 11; 21 expresses the exact pointer and verifies or ensures the optional suitable visual highlighting. Based on this, the SMU 11; 21 can recognize the confirmation input on the safety button 14 or 24, in particular the confirmation input made during the activated highlighting of the selected SEE 6, as approval by the user and configure the corresponding safety-critical function of the SEE 6. When the corresponding confirmation input is made on the CD 14 or 24, the SMU 11; 21 can start the safety-critical function, for example, output the corresponding instruction to the safety computer 7. The instruction can have any predetermined form and, for example, also correspond to image data encoded for the SEE 6. The conventional operation of the mouse button of the mouse 4 is ignored here because it is considered unsafe and the instruction start or output cannot be realized by the SMU 11; 21. When the mouse 4 is directly connected to the SMU 11; 21 ( Figure 2B ), the latter situation can be implemented more easily.

[0114] The above-mentioned verification (especially when implemented by an unsecured PC 1) can also be implemented here, for example according to WO 2011 / 003872 A1, by encoding the image data of the configured monitoring area in the SMU 11; 21 and comparing it with a specified code or reference code.

[0115] The visual highlighting of the selection of the SEE 6 can be limited to the representation of the cursor 5 alone. For the sake of computer technology simplification, when the cursor is guided by the mouse 4 in the image area of ​​the SEE 6, the cursor 5 can be selected, placed and kept at a predefined position by means of clipping or snapping, in particular when the cursor 5 is generated graphically by the PC 1. The cursor 5 can be displayed or faded in here, for example, by pointer coordinates corresponding to the geometric center of the SEE 6, wherein the current pointer coordinates (absolute coordinates) can be overwritten or ignored. The cursor 5 thus continuously receives a predefined graphical representation in the selected SEE 6 in the case of selection or selection, so that safety-related graphical verification, for example by code comparison, is significantly simplified in the SMU 11; 21 if necessary. In addition, the operating safety is increased or the user can recognize the behavior as safety-related. In this variant, the switch back to the normal display mode is not made until the cursor 5 has been guided away from the monitored image area of ​​the SEE 6 to a sufficient extent by means of the mouse 4. In other words, the system is advantageously configured such that when the cursor is guided onto a monitored image region of the SEE 6 , the cursor 5 has a behavior that is different for the user than in the rest of the GUI 2A, for example being held at a predetermined image position or being faded out.

[0116] Preferably, however, the selection is highlighted by the SMU 11; 21 itself, in particular by changing the image data that are transmitted to the display, which the SMU 11; 21 connected to the image data line 3 accesses in accordance with regulations. The SMU 11; 21 itself can for this purpose in particular fade in the cursor 5 into the image data, whereby the safety-related coding of the image data is also simplified (see below). Figures 4A-4B ).

[0117] In both cases, the SMU 11; 21 can ensure that the pointer coordinates of the displayed cursor 5 (visible to the user) coincide with the SEE 6 or lie within the correspondingly monitored image region when the SEE 6 is selected. The selection or approval of the selection (preselection) of the SEE 6 takes place separately from the selection and is subsequently carried out by the user, i.e., by operating the CD 14; 24. This is monitored by the SMU 11; 21 as a required operation in order to initiate a configured safety-related action, for example, via a separate channel 11D.

[0118] Figures 4A-4B For example, according to Figure 2B Schematic preferred embodiments and structures of a SIL-suitable or SIL-capable SMU 21, 21' based on the principle of. Figures 4A-4B The diagram in the figure is partially implemented as a signal flow diagram for describing the preferred working method. The SMU 21, 21' is implemented as a separate, modular hardware on its own circuit board or circuit card, which has an interface for connecting the image data line on the input side of the PC 1 and at least an interface for connecting to a relative input device, such as a mouse 4 and for connecting to a confirmation device (CD) 14, such as a security button. The SMU 21, 21' has an interface on the output side for further transmitting the image data to the display 2 via the image data line 3 and at least one data output terminal or another interface for the data channel 11C, such as for communicating with the PC 1. If necessary, a common interface can be used, for example for the mouse 4 and the data channel 11C. In addition, it can be set to the security computer 7( Figure 2B ) or a similar device. The image data is preferably transmitted via its own channel 3.

[0119] Figure 4A-4B The SMU 21 in the embodiment has a two-stage, cascaded structure with two at least logically separated units or computing components 41, 42, which can be implemented in the form of common hardware, such as integrated circuits, if necessary. However, an embodiment with two physically separated computing components 41, 42, in particular a first FPGA 41 and a separate second FPGA 42 is preferred. The computing components or FPGAs 41, 42 are used in particular for processing image data by computing technology and calculating check codes. The first FPGA 41 has an input for image data from the PC 1 and an output for image data to a display (LVDS transmitter). The second FPGA 42 has only an input for image data, that is, the display cannot be changed.

[0120] The operation of the FPGAs 41, 42 is controlled and supplemented by a processor module 50 which is connected to them in a signal-technical manner and is suitably designed and connected to the two FPGAs 41, 42 in a signal-technical manner. The processor module 50 is a component of the SMU 21 and can be implemented in a single-channel or multi-channel manner, for example in a dual-channel manner, as described below. Figure 5A-5B The processor assembly 50 can thereby implement a suitable X-out-of-Y mode according to IEC 61508 in interaction with the image processing computing components 41 , 42 , in particular the calibration functions of the computing components 41 , 42 . Figure 5BFor example, a 2oo2 mode is shown, which, due to redundant processing, does not ensure the GUI functionality until two systems fail, i.e., achieves increased safety and high availability. Processor assembly 50 can also be configured for other voting modes, such as pure single-channel (1oo1), for redundant processing with cross-diagnosis (1oo2), as a 1 / 3 voter (1oo3) or as a 2 / 3 voter (2oo3), etc., depending on the requirements for safety and / or availability. Depending on the design, this can achieve, for example, a Fail-Safe operation, in which, when a display error is detected, GUI 2A is first switched to a safe operating mode with reduced functionality, and when a double error is detected, GUI 2A is only shut down, such as, for example Figure 5B Accordingly, a two-stage structure with two at least logically separate units or computing components 41, 42 is not mandatory, however. In particular, when the cursor 5 is faded in by the display computer 1, a single-stage or single-channel embodiment with only one image processing stage 41 for safety-related checking of the image data can alternatively be realized.

[0121] A preferred software-implemented or computer-technical method of operation of the SMU 21 is described herein with reference to Figure 4A Explain.

[0122] The processor assembly 50 receives the relative coordinates of the mouse 4, from which the pointer coordinates are generated and by means of the pointer coordinates it is monitored or detected whether the selection of the SEE 6 is present in the GUI 2A. If this is not present, the processor assembly 50 transmits the pointer coordinates or the relative coordinates and, if necessary, the interrupt of the mouse button to the PC 1 via the data channel 11C. Starting from this, the PC 1 controls the GUI or its representation in the image data for the display 2 in a conventional manner. Alternatively, the relative input signals of the mouse 4 can also be transmitted in parallel to the PC 1 and the SMU 21, 21'.

[0123] Furthermore, the processor assembly 50 controls the first FPGA 41 so that it generates the cursor 5 in the image data to the display, for example by fading in or rewriting the image data in accordance with the pointer coordinates, which are continuously determined by the processor assembly 50. It can be provided that the PC 1 does not fade in the cursor 5 in the GUI, or that the PC 1 fades in the cursor only for uncritical areas, while only the first FPGA 41 fades in the cursor 5 in critical areas of the graphic 2A.

[0124] Alternatively or in addition, for the safety of the pure display of safety-critical information, a verification method according to WO 2011 / 003872A1 can be implemented for the monitoring area of ​​the display of the GUI graphics by one or two FPGAs 41, 42, for which purpose the SMU 21 is supplied with parameters regarding the image area to be monitored, for example from the safety computer 7, said image area having a pure display function (without operating elements).

[0125] When the processor assembly 50 detects the presence of a selection of a SEE 6 by comparing the continuously determined pointer coordinates of the cursor 5 with the predetermined or pre-stored image coordinates of the SEE 6 of the corresponding monitoring area, the FPGA 41, 42 can then be switched to the selection-monitoring mode. Alternatively, the FPGA 41, 42 can respectively carry out the monitoring continuously or continuously, in particular limited to the corresponding monitoring area of ​​the critical SEE 6 in the image.

[0126] For the image data received from the unsecured PC 1 at the input side of the SMU 21, 21', the FPGA 41 generates a check code in a first function block CRC1 by means of a suitable coding algorithm, for example a CRC method, for the image data corresponding to the SEE 6 or corresponding to the SEE. The code continuously generated by the function block CRC1 is compared by the processor component 50 with a reference code pre-stored for the corresponding SEE of the plurality of SEEs 6, if necessary, or with a specified code from the memory 55. This ensures on the input side that the desired SEE 6 is correctly represented by the PC 1 and is not influenced by the position-variable representation of the cursor 5. First, in the signal flow, the FPGA 41 then fades in the cursor 5 into the image data in a function block 43 at a position corresponding to the current pointer coordinates, for example by overwriting or overwriting. In the function block CRC2, the FPGA 41 generates a further check code for the cursor for the region of the image data that corresponds to the current fade-in representation of the cursor 5. In a further functional block CRC4, the FPGA 41 also generates a "pointer-independent" checksum for the surrounding area of ​​the image data where the cursor 5 is not expressed, such as the difference between the cursor area of ​​CRC2 and the image area of ​​SEE, or the difference with the area of ​​CRC2, i.e., the area beyond this area up to the entire display of the GUI. In order to generate the "pointer-independent" checksum, CRC4 calculates the checksum CRC4 for the following pixels, which constitute the difference or remainder (i.e., quantity A without quantity B) between the pixels (quantity A) of the monitored image area, such as the entire GUI 2A, and the pixel quantity (quantity B) expressing the cursor 5, that is, the pixels of the cursor 5 are not included in the difference. Not only the CRC checksum but also other suitable methods are considered as algorithms for the checksum.

[0127] The image data correspondingly modified by the FPGA 41 by fading in the cursor 5 are output from the output of the FPGA 41 via the image data line 3 to the display 2. In addition, the modified image data are supplied here in parallel to the second logical or physical level to the second FPGA 42, which, unlike the FPGA 41, is connected to the image data line 3 only via the input. The second FPGA 42 again overlays the representation of the cursor 5 with the same cursor image data in the same way as the first FPGA 41, corresponding to the current cursor coordinates of the processor component 50, but the image data is not output. In the function block CRC3, in a manner similar to CRC2 in the FPGA 41, the FPGA 42 generates a further cursor-related check code for the following area of ​​the image data, which corresponds to the current representation of the cursor 5 faded in by the FPGA 42. In the function block CRC5, the FPGA 42 generates a further cursor-independent check code for the surrounding area of ​​the image data where the cursor 5 is not represented, i.e. the pixel difference (see above), in a manner similar to CRC4 in the FPGA 41.

[0128] The checksums calculated at the program level or in the program blocks CRC2, CRC3, CRC4, CRC5 are evaluated and in particular compared in a safety-related manner by the processor component 50. For this purpose, the processor component 50 continuously compares the checksums of CRC2 and CRC3 with one another in a comparator or function block 53 in relation to the pointer, in order to detect errors, i.e. to check and ensure that the cursor 5 is correctly faded in by the FPGA 41. In addition, the processor component 50 continuously compares the checksums of CRC4 and CRC5 with one another in a comparator or function block 53 in relation to the pointer, in order to detect errors, i.e. to check and ensure that the fading in of the cursor 5 or the change of the image data in the FPGA 41 does not cause an undesired or unintentional change in another image area of ​​the GUI. If one of the comparison levels from CRC1, CRC2 or CRC4 shows a deviation, the activation or start of the safety-critical function of the SEE 6 is blocked or not permitted and, if necessary, the error situation is displayed to the user by modifying further image data (e.g. by fading out 6 or the like). Only in the case of a positive result of all safety-related checks or comparison results, the processor assembly 50 uses the input controlled by the user on the secure CD 14, in particular detected within the displayed selected time period, as approval for a safety-related action, which is assigned to the corresponding SME 6. Only in the case of a correct displayed check of the selected function, the SMU 21 triggers the function or action, which is output by the processor assembly 50 via a suitable interface to the safety system, for example the safety computer 7 or, for example, the plant control device. The processor assembly 50 forms a voter as described above, preferably a 2oo2 voter, but this is not mandatory.

[0129] The two-level or dual-channel structure with the second FPGA 42 which is controlled and read out independently of the processor assembly 50 allows a safe display of all safety-related functions of the GUI, in particular also fading in the cursor 5 via the first FPGA 41. In contrast to the PC 1, the monitoring module or SMU 21 is SIL-capable or SIL-suitable and can be safety-certified in particular.

[0130] Figure 4B The SMU 21' in FIG. Figure 4A As described, the structure and the functions are largely identical and differ in particular in that the image data transmitted from the PC 1 to the SMU 21' are directly fed to the two FPGAs 41, 42 on the input side, that is, the FPGA 42 cannot be influenced by the output of the FPGA 41. However, the safety-related check functions can be implemented in the same or the same way. In particular, by comparing the check codes from CRC2 and CRC3, it is also ensured or checked here that the cursor 5 is displayed as expected by the FPGA 41. In both cases, the fading and the encoding can be implemented in particular continuously and synchronously with the image data, for example for each screen refresh. The encoding according to the levels CRC2...CRC5 can be implemented only as needed in these two embodiments, when a selection is identified by the processor component 50 with the help of the position of the cursor 5, and when necessary, the accurate display of the SEE 6 is determined with the help of CRC1, because both are prerequisites for the subsequent approval.

[0131] As a variant of the above-described operating mode, however, it can also be provided that the cursor 5 is faded in by the representing PC 1, in particular as soon as the pointer position is outside a preconfigured graphic or pixel-related input area (EB) of a predetermined critical SEE 6. The SMU 21; 21' informs the PC 1, for example, simultaneously with the transmission of the pointer coordinates via the channel 11C, whether the cursor 5 is inside or outside the EB with respect to the image coordinates. With this feedback, the PC 1 may request that the cursor 5 be faded out if a selection exists (the pointer coordinates are inside the EB). If the coordinates are inside the EB, the SMU 21; 21' itself can supplementally highlight the corresponding EB visually by means of measures, for example, by means of a colored frame, if necessary, by fading out the cursor 5. The operating mode can also be checked in terms of safety by means of a check code as described above. Advantageously, the fading in of the cursor 5 or the highlighting of the selection is carried out directly by the safe SMU 21; 21', whereby the image data generated by the PC 1 without the cursor 5 or without highlighting can be checked more easily with respect to accuracy, in particular with respect to the accurate representation of all SEEs or EBs.

[0132] Figure 5AFor example, according to Figure 4A Another preferred configuration of the monitoring module or SMU 21 implements the voting device assembly or processor assembly 50 in a dual channel manner by means of two separate controllers or processors 51, 52. The processors 51, 52 each implement the same dual and independent functions as described above for Figure 4A All the relevant control and verification functions described above are used to reveal error situations under different behaviors for higher safety requirements and to form a 2-out-of-2 voting device with an FPGA 41, 42 as a detector to be verified. For this purpose, the two processors 51, 52 are respectively connected to the two FPGAs 41, 42 in terms of signal technology and are respectively checked mutually and independently with respect to the compliance or correct function (dual channel principle). The interface 61 to the opposite pointer device, such as the mouse 4 and in particular to the external safety button 4 can be implemented by separate components or integrated into the processors 51, 52.

[0133] Figure 5B A further, preferably continuous, two-channel structure of the monitoring module 80 is shown. The monitoring module 80 can be used, for example, for safe input independently of the aforementioned functions and is also regarded as an improvement of the teaching of WO 2011 / 003872A1 for monitoring the safe representation of input parameters (if necessary without input function) and is regarded as having a significant inventive step.

[0134] The input parameters to be monitored can be supplied to the monitoring module 80 via the interface 70 , for example from the safety computer 7 .

[0135] The FPGA 41 generates a check code for one or more graphically relevant, predefined monitoring areas for safety-critical displays. The check codes CRC1.1 and CRC1.2 determined by one of the two FPGAs 41 or 42 are each independently compared in a dual-channel processor 51, 52 with predetermined reference values ​​corresponding to the input parameters, which are pre-saved as reference values ​​for the corresponding input parameters, for example, in a configuration. The reference value for comparison can be determined as a reference code from the input parameters, for example, with the aid of a Lookup Tabelle, or a comparison is performed of the current input parameters with reference parameters retrieved from a determined code, for example, via a Lookup Tabelle. In other operating modes, in particular with respect to the generation of check codes for monitoring areas, for Figure 5B The teachings from WO 2011 / 003872 Al are hereby incorporated by reference in their entirety.

[0136] The two-stage, preferably also two-channel hardware embodiment of the FPGA 41, 42 corresponds to Figure 4AThe second FPGA 42 is also connected to the image data line 3 only via the input (read-only connection), i.e. the image data cannot be modified, while the first FPGA 41 connected upstream can read out the image data (e.g. as an LVDS receiver) and output it further in a modified manner if necessary (e.g. as an LVDS transmitter).

[0137] By following Figure 5B The monitoring module 80 can implement in particular two functions which are advantageous in terms of safety technology and which allow a higher safety level, for example SIL-3 or higher.

[0138] On the one hand, a safety-related visual error indication that is realized by the FPGA 41 by modifying the image data, in particular by fading out or fading in (e.g., switching to white) or other display in the image data at the output of the FPGA 41 that is visible to the user, can be reliably checked when a representation error is detected by the second FPGA 42 by means of a check code method. The FPGA 42 hereby checks the expected graphical error indication in the error case by means of a correspondingly expected representation, for example, by means of a check code method by generating a check code for a graphical error indication, which the FPGA 41 should produce in the image data at its output in accordance with the expectation. The graphical error indication or error indication can be checked by the FPGA 42 in that the FPGA 42 performs the same operating method as the first FPGA 41 with respect to modifying the image data for the image data that is detected as erroneous, that is, in this case the FPGAs 41, 42 also realize a two-channel arrangement for checking and modifying the image data. However, the FPGA 42 can also generate a pre-stored code that corresponds to the expected or prescribed behavior of the image change performed by the first FPGA 41, without redundantly repeating the image modification in the FPGA 42 itself.

[0139] By means of the check code from FPGA41,42 and the corresponding prescribed value or prescribed code, the comparison is performed in two processors 51,52 in dual-channel and independently to improve safety. It is thus ensured that the error disclosure is performed correctly or visibly to the user. The error disclosure and cross-check are preferably limited to and performed for each predefined monitoring area respectively, so that the remaining display remains unaffected. By means of FPGA42, the cross-check of the error disclosure provides a negative result, then safety-related measures such as closing the display or switching the display to an unsafe mode can be performed. Thus, the system provides higher safety because two different methods are set to avoid the erroneous expression of safety-critical information. For example, by means of the first FPGA41, the priority error disclosure of a single monitoring area covered or marked as an error by fading or overlapping is first improved. Usability is not involved because other safety-critical image areas that may be verified as correctly expressed are not involved. The second method for ensuring Fail-Safe operation is implemented by means of a second level with another FPGA 42, and the FPGA 42 interacts with the processor component 50 at this time. If the first method does not reveal an error in the monitored image area as desired, this is revealed by means of the second FPGA 42, so that the entire display can be switched off, for example, by means of a voter or processor component 50. For this purpose, a 2oo2 voter is also advantageous as a processor component. In particular, due to the two independent error-revealing methods, the monitoring module 80 can ensure a safety level SIL-3, since critical double errors can be inferred. In addition, at least the second method in the monitoring module 80 can also be implemented in a dual-channel and / or multiple manner.

[0140] In addition or alternatively, in order to increase the operational safety, the second FPGA 42 can also check the safety-related visual highlighting of the correctly expressed monitored display area, which the FPGA 41 performs in accordance with the regulations by modifying the image data. The visual highlighting or recognizable manner can be realized in different ways here, for example, by fading in a graphic frame or a graphic symbol, an icon or a small tool, by means of which the user can recognize which area in the current display on the display 2 is actually monitored by the monitoring module 80 or checked as safety-critical by the monitoring module 80. The second FPGA 42 can also generate a check code for the image data at the output of the FPGA 41, for example, for the monitoring area including the desired graphic highlighting, which check code is again compared with the corresponding specified value or specified code in the two processors 51, 52 separately and, if necessary, in a dual-channel manner. In this case, the FPGA 41, 42 can generate two different check codes for each monitoring area, i.e., a first check code for the image data of the monitoring area that is monitored without a recognizable manner and a second check code with a recognizable manner. In a suitable coding algorithm, for example, a dual-channel coding with a large Hamming distance is thus simultaneously achieved with respect to the original image data generated by the PC 1. In the voting unit or processor component 50, corresponding predetermined comparison data are stored for the first check code and the second check code (see CRC1.1 and CRC1.2), which correspond to the good case, that is, the accurate representation of the input parameters with the help of the first check code and the accurate representation of the prominence of the monitoring area with the help of the second check code. The monitoring of the corresponding image area that is reliably recognized as active by the second FPGA 42 and the processor 51, 53 in this way can also be output to the security computer 7, for example.

[0141] Furthermore, the monitoring module 80 itself can generate a visual display in a safe manner, in whose operating mode the monitoring module 80 operates, for example, with activated monitoring (safe) or inactivated monitoring (unsafe). This can also be achieved by modifying the image data by the first FPGA 41 and can be cross-checked safely with the proposed structure having the second FPGA 42 and preferably two processors 51, 52. The status display by the monitoring module 80 is particularly advantageous when the GUI is to display different modes or different display masks depending on the situation.

[0142] In principle, any desired changes to the image data generated in an unsafe manner by the PC 1 can be implemented in a safe manner by means of the monitoring module 80. This is achieved on the basis of the ability to modify the image data in a first stage, for example in the FPGA 41, and a second stage for checking the image data changes made by the first stage, for example by means of the second FPGA 42. The two computing components used for this purpose, for example the FPGAs 41, 42, can also implement the critical image data monitoring functions, in particular in a dual-channel manner, as described above, but this is optional.

[0143] The two-stage implementation can also be realized with a single integrated circuit, such as a single FPGA, or also with a single processor or the like, which is logically or virtually divided into two-stage computing components or modules. However, a hardware, true dual-channel implementation with two computing components, such as FPGAs 41, 42, is advantageous. A variety of different component types, such as FPGAs 41, 42 of different structures, can be used here to minimize the risk of system errors, such as common core errors. The same applies to processors 51, 52 accordingly.

[0144] For greater safety, the equally dual-channel voting implementation of processors 51 , 52 preferably electrically isolates FPGAs 41 , 42 by means of an isolation component, so that physically separate processor areas 50 are provided on a common circuit card of monitoring module 80 .

[0145] The monitoring module 80 has two computing components 41, 42 for image data encoding and two processors 51, 52 for function control, wherein the computing components implement the same functions as described above for modifying image data for verification purposes, and the complete dual-channel structure of the monitoring module is in principle particularly advantageous in terms of error control and error disclosure. Preferably, at least two processors 51, 52 each have independent or at least non-reactive resources, such as power supply, clock, channel, etc.

[0146] Figure 6 A secure display device 60 for displaying pixel graphics is schematically shown, which in particular has a TFT panel, a display integrated into the device, for example according to Figure 4A The image data generated by the computer are transmitted to the SMU 21 after conversion from a signal format common for PC monitors, such as HDMI, to LVDS by an existing monitor controller, if necessary, and output from the SMU to the TFT controller of the display device 60.

[0147] The display device 60 also has an integrated, special interface module or Gateway 61 , which is connected to the SMU 21 via a bidirectional data connection, so that only one port is required on the SMU 21 for this purpose and the Gateway 61 can be configured depending on the use.

[0148] exist Figure 6 In the example, Gateway 61 has a port for a COTS input device 4, such as a USB port, and a port for communicating with an express, unsecured PC 1 (in Figure 6 The Gateway 61 is connected to a corresponding output terminal (not shown in the figure), via which the relative coordinates are further transmitted to the PC 1 to control the GUI or operate the PC 1. The Gateway 61 provides the relative coordinates to the SMU 21 in parallel, in particular for fading in the cursor 5 as described above. The Gateway 61 has an input terminal for the confirmation device or CD 14 and also provides a logical safety channel between the confirmation device 14 and the SMU 21. In addition, the Gateway 61 provides an interface for safety-related communication, which is realized via a safety industrial bus, such as PROFINET or according to the PROFIsafe protocol, in particular for transmitting safety-related instructions or information, which are generated by the SMU 21 itself, for example from a confirmation input on the CD 14 or also, for example, safety-related instructions.

[0149] In addition to the safety input function according to the invention, the SMU 21 can also implement a safety expression according to the principle from WO 2011 / 003872A1 and / or a safety input according to EP 2 551 787 B1 by means of an absolute input device, such as a capacitive touch device. The teachings of the last-mentioned documents are hereby fully incorporated by reference for the sake of simplicity.

Claims

1. A method for safety-related input on a graphical user interface, wherein: The computer (1) generates image data for a display (2) and has an input device (4) for operating the user interface, wherein the method comprises: Transmitting computer-generated image data from the computer (1) to the display (2) via an image data line (3); Displaying a user interface (2A) having at least one graphical operating element (6) on the display, wherein the graphical operating element can be selected by the user in a controlled manner by means of the input device; and wherein the monitoring unit (11; 21) is connected to the image data line (3) and reads out at least part of the image data for implementing a safety function; It is characterized in that - feeding input information from the input device to the monitoring unit (11; 21), based on which a user-controlled selection of the graphic operating element (6) can be detected by the monitoring unit; - the monitoring unit (11; 21) is connected to a secure confirmation device (14) via a secure channel in order to receive a confirmation controlled by the user, and - the monitoring unit (11; 21) ensures and / or verifies that the recognized selection of the graphic operating element (6) is correctly represented in the image data fed into the display (2); and The monitoring unit (11; 21) starts or triggers a safety-related operating instruction assigned to the graphic operating element (6) when receiving a confirmation controlled by the user during the expression of the selection of the graphic operating element (6).

2. The method according to claim 1, characterized in that: The monitoring unit ensures that the recognized selection of the graphic operating element (6) is correctly represented in the image data fed into the display (2) by the monitoring unit (11; 21) modifying at least a portion of the image data which is intended for display in a predetermined image area which is assigned to the graphic operating element (6) and transmitting the correspondingly modified image data to the display. wherein the modified image data expresses the pointer (5) according to the input information; and / or the modified image data implements the user's selection as a visual highlight (8) on the display (2); and / or the modified image data is partially overlapped by the computer-generated image data.

3. The method according to claim 1, characterized in that Computer-generated image data represent the selection of the graphic operating element (6), and the monitoring unit (11; 21) verifies that the recognized selection of the graphic operating element (6) is correctly represented in the image data fed into the display (2), in that the monitoring unit (11; 21) calculates a check code for the image data intended for display in a predetermined image area assigned to the graphic operating element (6) and compares the check code with at least one prestored reference code.

4. The method according to claim 1, characterized in that: Input information is transmitted from the input device (4) to the expressing computer through the monitoring unit (11; 21) or transmitted to the monitoring unit (11; 21) through the expressing computer (1).

5. The method according to claim 2, characterized in that: the monitoring unit (21) comprises a first computing unit (41) to which computer-generated image data are fed on the input side and which modifies the image data as a function of the selection of a safety-critical graphical operating element (6) in order to visually highlight the selection and transmits the image data on the output side to the display (2), and The monitoring unit (21) comprises a second computing component (42) for verifying the image data at the output of the first computing component (41).

6. The method according to claim 5, characterized in that The first computing component calculates a first-level check code for computer-generated image data, which are intended for display in a predetermined image area, and the monitoring unit compares the first-level check code with at least one prestored reference code for the predetermined image area, wherein the first computing component calculates the first-level check code for the computer-generated image data on the input side in a first step and subsequently modifies the image data in a second step.

7. The method according to claim 6, characterized in that - the first calculation means calculates a second-level first check code for the image data modified by the first calculation means, the image data being intended for display in a predetermined image area; - the second calculation unit (42) calculates a second check code of a second level for the image data at the output side of the first calculation unit, the image data being intended for display in a predetermined image area; - in order to verify the compliance of the selected visual highlighting (8) by the first computing means, the monitoring unit (21) compares the verification codes of the second level with one another; and - two computing components (41; 42) respectively calculate a third check code for the image data of a predetermined image area without selection, the monitoring unit (21) comparing the third check codes with each other in order to verify that the display of the graphic operating element (6) complies with the regulations; and / or The calculation component (41; 42) calculates a check code for the image data of a predetermined image region assigned to the graphic operating element (6) only when the selection of the graphic operating element (6) is detected.

8. The method according to claim 2, characterized in that: The first computing unit (41) modifies the image data in order to visually highlight the selection, so that the selected graphical operating element (6) can be visually displayed in a selected second state that is distinguishable from a non-selected first presentation state, and / or The first computing component (41) outputs or forwards the modified image data in an image data stream together with the image data generated by the computer to the display (2).

9. A method according to any one of the preceding claims, wherein: A mouse pointer is displayed on the display (2) in order to operate the user interface, characterized in that: - The mouse pointer is generated solely by the monitoring unit (11; 21) through modification of the image data in the monitoring unit, wherein the input device (4) is connected to the monitoring unit (11; 21) and continues to transmit the input information to the represented computer (1); or - The mouse pointer is generated outside all predetermined image regions by the represented computer (1), and when a safety-critical graphical operation element (6) is selected as recognized by the monitoring unit (11; 21), the pointer generated by the computer is not displayed by modification of the image data in the monitoring unit in the correspondingly configured image region, wherein the input device (4) is connected to the represented computer (1) and continues to transmit the input information to the monitoring unit (11; 21); and / or - For N successive consecutive image cycles of the image data, the mouse pointer is represented only for a number of m < N image cycles by the represented computer (1) or the monitoring unit (11; 21); - and / or the input information represents absolute coordinate information or relative coordinate information.

10. A monitoring unit for monitoring a graphical user interface (11; 21), which comprises: - A digital image data interface for connection to an image data line (3) for transmitting image data generated by a computer from the represented computer (1) to the display (2); - At least one computing component (41; 42), which implements a safety function and reads at least part of the image data through the image data interface; - A device interface for input information of the input device (4) for controllably selecting a graphical operation element (6) by a user; It is characterized in that - The monitoring unit (11; 21) has a physical confirmation input (11B; 11C) for a safety confirmation device (14), and - The at least one computing component (41; 42) is arranged to ensure and / or verify that the recognized selection of the graphical operation element (6) is correctly represented in the image data fed into the display; and - The monitoring unit (11; 21) is arranged to output a configured safety-related operation instruction when a confirmation input is received through the physical confirmation input (11B; 11C) during the represented selection of the graphical operation element (6).

11. The monitoring unit according to claim 10, characterized in that - The at least one computing component (41; 42) is arranged to modify the image data and / or to calculate a check code from the image data; - The monitoring unit (11; 21) has at least one memory (55) for presetting predetermined image regions and / or reference codes: and / or - The monitoring unit (11; 21) has a controller component for the input device, which is connected to the device interface to directly connect the input device to the monitoring unit.

12. The monitoring unit according to claim 10, characterized in that The monitoring unit (21) has a two-level computer structure, which has: a first computing unit (41) which is configured to receive computer-generated image data on the input side and to modify at least a portion of the image data in accordance with a security function, the image data being intended for display in a predetermined image area, and which is configured to provide the image data to a display (2) on the output side, and - a second calculation unit (42) arranged to check the image data provided by the first calculation unit (41) by calculating a check code for the image data determined for display in the predetermined image area, and The monitoring unit (21) is designed to compare the calculated verification code with at least one prestored reference code in order to verify that the visual highlighting (8) by the first computing component complies with regulations and / or to initiate a safety-related reaction.

13. The monitoring unit according to claim 12, characterized in that: The first computing component (41) is configured to calculate a check code for computer-generated image data, which are intended for display in a surveillance area, for safety-related comparison with at least one prestored reference value for the surveillance area, wherein the first computing component first calculates a check code (CRC1) for the computer-generated image data on the input side and subsequently modifies the image data in a second stage (43), The first computing component (41) and the second computing component (42) are implemented by two separate integrated circuits.

14. The monitoring unit according to claim 13, characterized in that: The first computing component (41) and the second computing component (42) are implemented by two FPGAs of different structures.

15. The monitoring unit according to claim 12, characterized in that: The first calculation unit and the second calculation unit respectively generate a check code (CRC2; CRC3; CRC4; CRC5), and a voting device component (50) is connected to these calculation components for comparing the generated check code with the pre-stored reference data.

16. The monitoring unit according to claim 15, characterized in that The voting device component (50) is implemented as a dual-channel processor circuit (51; 52).

17. The monitoring unit according to claim 15, characterized in that: The voting device assembly (50) is implemented as a 2oo2 voting device.

18. The monitoring unit according to any one of claims 12 to 17, characterized in that The second computing component (42) is configured to obtain image data on the input side and redundantly modify at least a portion of the image data in the same manner as the first computing component according to a safety function, and the first computing component (41) is configured to calculate a first check code (CRC2) for the modified image data, and the second computing component (42) is configured to generate a second check code (CRC3) for the redundantly modified image data, wherein the monitoring unit compares the first check code (CRC2) with the second check code (CRC3).

19. The monitoring unit according to claim 18, characterized in that The voting device component (50) compares the first check code (CRC2) with the second check code (CRC3).

20. The monitoring unit according to any one of claims 10 to 17, characterized in that A module is connected to the monitoring unit (11; 21) or is integrated into the monitoring unit, which module is used for safety-related communication via a bus interface (70) as a safety interface for outputting safety-related operating commands.

21. The monitoring unit according to claim 10, characterized in that The image data interface is an LVDS interface or an HDMI interface; and / or The device interface for inputting information is a device interface for a computer mouse.

22. The monitoring unit according to claim 11, characterized in that The monitoring unit has a bidirectional data interface for transmitting input information to a computer.

23. A system for security-related input on a graphical user interface, comprising a computer (1) for presentation and a display (2) for pixel graphics connected to the computer via a picture data line, characterized in that A monitoring unit (11; 21) according to any one of claims 10 to 18 is provided which is physically separated from the computer, wherein - an input device (4) for operating a user interface is directly connected to a device interface of the monitoring unit (11; 21); and A separate secure verification device (14) is connected to the physical verification input (11B; 11C) of the monitoring unit.

24. The system according to claim 23, characterized in that The safety confirmation device (14) is a safety button.

25. A display device for displaying pixel graphics, characterized in that: A monitoring unit (11; 21) according to any one of claims 10 to 22 is provided which is integrated into the device, and at least one port for an input device (4) connected to a device interface of the monitoring unit (11; 21) and a port for a safe confirmation device (14) connected to a physical confirmation input (11B; 11C) of the monitoring unit.

Images