SAFETY-RELEVANT APPLICATION

Description

[0001] The invention relates to safety-relevant, preferably medical applications, in particular to a device for a safety-relevant, preferably medical application and a method for operating such an application. State of the art

[0002] A variety of medical devices are already known from the prior art that require users, such as nurses and doctors, to enter numerical values ​​into user interfaces as part of a medical device's user interface. In many cases, the entered data or parameters are safety-critical, also referred to herein as safety-relevant, meaning that incorrect input can or does lead to dangers for the patient, the operator, or others.

[0003] For safety-critical devices, such as an infusion pump, the flow rate is an example of a safety-critical parameter. Incorrectly entering the flow rate can lead to dosing errors. Depending on the infused drug, this can cause serious harm to the patient.

[0004] However, the state of the art always has the disadvantage that user-friendliness rather than maximum security is the priority.

[0005] There is a need to provide concepts to increase the safety level in safety-relevant applications, especially in those where numerical values ​​can be entered by the operator.

[0006] WO 2016 / 205051 A1 discloses a machine for treating medical fluids, comprising: a pump for pumping out the medical fluid; an input device configured to: display touch buttons, wherein at least some of the touch buttons each represent a grapheme, and detect haptic interactions between a user and the touch buttons, wherein an interaction causes information related to the touch button to be received by the medical fluid treatment machine; and a control unit configured to control the input device, wherein controlling the input device includes causing the input device to switch between displaying i) a first set of touch buttons corresponding to a first language and ii) a second set of touch buttons corresponding to a first language or a second language. Brief description of the invention

[0007] The object of the invention is therefore to avoid or at least mitigate the disadvantages of the prior art. In particular, the security level when entering numerical values ​​in security-relevant applications is to be increased / improved.

[0008] This object is achieved by providing a device for a safety-relevant application. The device has a user interface. The user interface is designed to display a predetermined number of digits. The predetermined number of digits is designed to be assigned numerical values ​​by a user. The user interface is designed to limit a selection of a predetermined number of digits available for a user input when the user enters a numerical value, for example, his / her first input, at one of the digits to be assigned / available.

[0009] By restricting the ability to assign values ​​to digits, the user is proactively prevented from entering incorrect values ​​and thus causing damage.

[0010] In particular, this refers to user interfaces for the input of data by a user of a machine. The user interface can also be the point at which a person interacts with a machine or device, in this case the device for the safety-relevant application.

[0011] A safety-relevant application could, for example, be the administration / infusion of medication or something similar. In general, a safety-relevant application can be understood as an application in which a person is exposed to direct danger or harm if the user interface is incorrectly entered or operated.

[0012] The safety aspects of the device for the safety-relevant application can be divided into three categories. Primary safety encompasses risks that arise directly from a system, for example, a fire caused by an electronic fault. Functional safety encompasses hazards that can arise from the device itself, for example, depending on the correct functioning of the device's hardware or software. Indirect safety encompasses both the indirect effects of device faults and deficiencies in the human-machine interface, in this case the user interface. Non-functional properties such as the processing time of a request also belong to this category. Thus, the safety relevance in this case can primarily concern indirect safety as a non-functional property of the device.

[0013] To clarify, digits are defined as the locations on the display of an electronic device, namely the user interface, where values ​​can be assigned. Input here can be limited to numeric values, i.e., numbers from 0 to 9.

[0014] Advantageous embodiments are claimed in the subclaims and are explained in more detail below.

[0015] The device may be a medical device. Examples include an infusion pump or a dialysis machine. The safety-relevant application thus directly relates to humans and poses a risk to life and limb.

[0016] The user interface of the device can be a touchpad for manual input and output. Furthermore, the user interface can include a mouse for input. The mouse can be used in conjunction with the touchpad or with a screen without touch functionality. The user interface can also include or be a touchscreen for manual input / output.

[0017] This can make entering numerical values ​​easier.

[0018] The digits to be assigned can be assigned numeric values ​​separately. The digits to be assigned can also be assigned sequentially. In this regard, it should be noted that the digits can be designed so that they can only be assigned a numeric value individually by the user.

[0019] This can further reduce the risk of incorrect input.

[0020] The user interface can further be designed to distribute the selection of digits available for user input across an equal number of digits for pre-decimal places and decimal places. The user interface can also or additionally be designed to distribute the selection of digits available for user input across an equal number of digits for a unit and a sub-unit, preferably hours and minutes or minutes and seconds. Thus, for example, only four digits can be assigned values. When entering a unit, the addition of a further sub-unit of a sub-unit can be blocked. The same can apply when entering a sub-unit and a sub-unit, meaning that the upper unit is blocked. In this regard, for example, two pre-decimal places and two decimal places can be assigned, but not an odd distribution.

[0021] The user interface can further be configured to move, by means of user input, a decimal point provided on the user interface for displaying pre-decimal and decimal places between the digits to be assigned. For this purpose, the decimal places can be displayed smaller than the pre-decimal places. By moving the decimal point, the user can also make it disappear, so that by moving the decimal point on the user interface display, the user only selects pre-decimal digits.

[0022] Likewise, the touchpad / touchscreen can be designed to display a keyboard when the user clicks on a respective digit to be assigned, which is intended to assign the respective digit to be assigned with this value when a numerical value displayed on the keyboard is touched.

[0023] The device may further comprise a memory. The memory may be provided to store data. The data may comprise at least one hard numerical limit value and one soft numerical limit value. These limit values ​​may relate to the safety-relevant application. Likewise, respective hard and soft upper and lower limits relating to the safety-relevant application may be stored in the memory. The user interface may be in communication with the memory. This communication may be established directly or indirectly via a processing unit or control unit contained in the device. The processing unit or control unit may be designed in the form of a network, for example a bus, to process data from the memory and the user interface.The user interface may be configured to delay or prevent input progress based on the hard and soft numerical limits. This may be based on a command provided to the user interface by the processing unit or control unit.

[0024] The user interface can be configured to restrict further input or undo a previous input based on a comparison between at least one of the digits assigned numerical values ​​and the at least one hard numerical limit. Likewise, the user interface can be configured to restrict the selection of digits available for user input and / or a numerical value range available for selection at the at least one of the available digits based on the comparison between the at least one of the digits assigned numerical values ​​and the at least one hard numerical limit. The processing in the sense of the comparison can be performed by the processing unit or control unit.

[0025] This allows the user's attention to be drawn to the device through appropriate restrictions and / or delays.

[0026] The user interface can additionally be configured to indicate that further input is required based on a comparison between the at least one of the digits assigned numerical values ​​and the at least one soft limit. The value in the at least one of the digits assigned numerical values ​​or a total value of all assigned digits can be within the at least one hard limit or within a range defined by the hard upper limit and lower limit, but outside the at least one soft limit or outside a range defined by the soft upper limit and lower limit.

[0027] This can further increase patient safety.

[0028] The above-mentioned object can further be achieved by a method for operating a device for a safety-relevant application. The device can be a device as described above. The method comprises displaying, via a user interface, digits to be assigned numerical values ​​by a user. The method further comprises input of a numerical value by a user at one of the digits to be assigned / available. The method also comprises limiting, via the user interface, a selection of digits available for user input based on the input. As a result, further input can be limited and / or delayed by entering a value at one of the displayed digits on the user interface.

[0029] A safety aspect when operating safety-relevant devices can thus be improved.

[0030] In other words, the invention relates to a numeric editor for safety-critical applications on touchscreen user interfaces, for example in the form of a user interface. In particular, the invention relates to an editor concept for touchscreen user interfaces that is intended to minimize the probability of incorrect inputs. The input concept used in consumer goods such as smartphones primarily serves user-friendliness rather than maximum security. The proposed concept strikes a balance between security and ergonomics. It can be used considering a medical infusion pump, which is safety-critical and has a limited screen size. However, the concept is not limited to infusion pumps. Application in other safety-critical devices in healthcare and beyond is conceivable.

[0031] In other words, the invention can be a technical device comprising a control unit, a control unit connected to it, and an output unit also connected to the control unit. The control unit can require the input of numerical parameters by a user, and the control unit can use this input to generate a setpoint for an output unit.

[0032] In one or more embodiments, a specific input device, also called an editor, may be provided in the operating unit to minimize the probability of incorrect input of the numerical parameters.

[0033] Various variants of the technical equipment can be provided. For example, the technical equipment can be a device whose purpose is to perform, control, and / or document one or more safety-critical processes, which, if input errors occur, could endanger people, goods, the environment, and / or financial assets.

[0034] In particular, the purpose of the device may be the administration and / or documentation of medical infusions. Furthermore, the purpose of the device may be the performance and / or documentation of dialysis treatments, temperature therapy, ultrasound therapy, electromagnetic radiation therapy (including infrared and X-rays), particle therapy, and / or X-ray diagnostics.

[0035] Likewise, the purpose of the device may be to control a safety-critical process of a vehicle, an aircraft, a weapon system, industrial plants, business processes, traffic flows, or a power plant.

[0036] The control unit can be a device with a programmable processor and memory. This can also be equipped with sequential logic, for example, for performing infusions or dialysis treatments, which is executed on the processor and requires the input of parameters.

[0037] The operating unit, as at least one part of the user interface, can be a device with a visual output surface and a touch-sensitive input medium located on this surface. The output surface can display operating elements, whereby the detection of touches can trigger specific reactions in the operating unit and the control unit. Resistive, capacitive, force-based, and / or temperature-based touch sensors can be used for this purpose. Likewise, the output surface can be coupled to the input using a computer mouse or trackpad, gesture control, and / or camera-based eye tracking. The operating unit can be at least part of a tablet or personal computer.

[0038] The dispensing unit can comprise an actuator / motor that executes movements according to the preset values ​​of the control unit. The actuator can be coupled to a syringe so that an infusion can be administered in a controlled manner. The motor can be coupled to an infusion tube via peristalsis so that an infusion can be administered in a controlled manner. Furthermore, the dispensing unit can comprise a generator of X-rays, electromagnetic waves, particle streams, and / or documentation elements.

[0039] The numerical parameters intended for input in the form of numerical value ranges can be safety-critical numerical values, such as setting parameters for infusion therapy (e.g., flow rate, volume to be administered, infusion duration, bolus amount, drug concentration, and / or dose rates) or dialysis treatment. The safety-critical numerical values ​​can also be safety-critical information regarding time, energy quantities, performance values, and / or speeds.

[0040] Users can be those performing safety-critical processes required to operate the technical equipment. These include, for example, medical personnel (including nurses and doctors), hospital technicians, maintenance personnel, machine users, vehicle users, and system users.

[0041] According to one embodiment, the specific input device, the editor, can be designed as follows. Decimal places of the numeric parameter can be displayed in such a way that they are visible together, but can be selected individually on the control unit. For example, a keyboard with a number line is only displayed and activated when a decimal place is selected by the user. The keyboard can allow the value at the selected decimal place to be entered. After the value has been selected, the keyboard on the control unit can be hidden and deactivated again. The decimal places to the right of the edited numeric place can be filled with zeros after the value has been selected, provided they have not already been assigned specific values ​​by the user. In addition, the keyboard can also have an input element for deleting the value at the selected decimal place.If individual values ​​on the keyboard lead to invalid inputs, the corresponding control elements are deactivated and their deactivation is indicated to the user (e.g. by being grayed out).

[0042] Alternatively, these values ​​are not displayed on the keyboard at all. Additionally, a control element can be provided for deleting / resetting the entire parameter value. Furthermore, different display sizes can be provided for decimal places before and after the comma to prevent confusion. Additional control elements can be provided for moving the decimal point. Likewise, no decimal points can be present. An additional display of dependent numerical parameters can also be provided during the operating process. Furthermore, an identification of the numerical parameter in question (using a parameter name, graphic elements, and / or the technical unit) can be provided.

[0043] A further control element can be provided for confirming the value once the user has completed entering the numeric parameter. A check for permissible value ranges by the operating and / or control unit can be provided upon confirmation. The check can be carried out by the operating and / or control unit for value ranges that are conspicuous from a safety perspective (soft limit range) upon confirmation. The user can be asked whether the value should really be used if the value lies within the conspicuous value range. The test result can also be output acoustically. A graphical display of the permissible or conspicuous value ranges on a number line can also be provided.

[0044] It will be apparent to those skilled in the art that the explanations presented herein may be implemented using hardware circuits, software means, or a combination thereof. The software means may be associated with programmed microprocessors or a general-purpose computer, an ASIC (Application Specific Integrated Circuit), and / or DSPs (Digital Signal Processors).

[0045] For example, [the device for the safety-relevant application, the user interface, the memory, the processing unit and the control unit can be partially implemented as a computer, a logic circuit, an FPGA (Field Programmable Gate Array), a processor (for example comprising a microprocessor, a microcontroller (µC) or a vector processor) / core (main memory, can be integrated in the processor or used by the processor) / CPU (Central Processing Unit; several processor cores are possible), an FPU (Floating Point Unit), an NPU (Numeric Processing Unit), an ALU (Arithmetic Logic Unit);in German: arithmetic-logical unit), a coprocessor (additional microprocessor to support a main processor (CPU)), a GPGPU (English: General Purpose Computation on Graphics Processing Unit), a parallel computer (for simultaneously executing arithmetic operations, including on several main processors and / or graphics processors) or a DSP.

[0046] It will also be apparent to those skilled in the art that, although the details described herein are described with reference to a method, these details may also be implemented in a suitable device, a computer processor, or a memory connected to a processor, the memory being provided with one or more programs that perform the method when executed by the processor. Methods such as swapping and paging may be used.

[0047] Although some of the aspects described above have been described with reference to the device, these aspects may also apply to the method. Likewise, the aspects described above with reference to the method may apply to the device in a corresponding manner.

[0048] In this context, if a component is "connected," "in communication," or "accesses" another component, this may mean that it is directly connected to it or directly accesses it; however, it should be noted that another component may be present in between. On the other hand, if a component is "directly connected" to or "directly accesses" another component, this means that there are no other components in between. Short description of the characters

[0049] The invention is explained below with the aid of drawings. They show: Figure 1 shows a schematic representation of a medical device, namely an infusion pump, as an example of a device for a safety-relevant application with a graphical display and touchscreen user interface; Figure 2 shows a schematic representation of a basic design of an editor; Figure 3 shows a schematic representation of an editor with a movable decimal point; Figure 4 shows a schematic representation of an editor with a movable decimal point (only pre-decimal places); Figure 5 shows a schematic representation of a time editor; Figure 6 shows a schematic representation of an editor with a selected digit and numeric keypad; Figure 7 shows a schematic representation of an editor with a specified digit; Figure 8 shows a schematic representation of an editor with a limit bar; and Figure 9 shows a schematic representation of an editor with a soft limit warning.

[0050] The figures are merely schematic in nature and serve solely to facilitate understanding of the invention. The same elements are provided with the same reference numerals. The features of the individual embodiments can be interchanged.

[0051] Furthermore, spatially relative terms such as "beneath," "under," "lower," "above," "upper," "left," "left," "right," "right," and the like may be used herein to conveniently describe the relationship of an element or structure to one or more other elements or structures illustrated in the figures. The spatially relative terms are intended to encompass other orientations of the component in use or operation, in addition to the orientation illustrated in the figures. The component may be oriented differently (rotated 90 degrees or in a different orientation), and the spatially relative descriptors used herein may be interpreted accordingly. Character description

[0052] The method and the device will now be described by way of example using embodiments.

[0053] The concept is aimed at safety-critical applications, especially with regard to medical devices such as the infusion pump 1 with touchscreen user interface 2 in Figure 1 , also described above as the user interface 2 or as part thereof, which requires the input of numerical data by a user, also called operator.

[0054] The editor 3, as an interaction tool or input tool for the human-machine process as part of the user interface 2 described above, is designed with security in mind. One interaction principle includes a mechanism that forces the user to focus their attention on the input process, for example, when entering values ​​for an infusion pump 1, as shown in Figure 1 shown to maximize in order to avoid errors.

[0055] The basic idea is to divide a number into digit fields (4), referred to herein as digits, which must be individually selected by the user and assigned a numerical value. This approach forces the user to think about the number while editing, while visually focusing on the relevant screen elements of the editor (3).

[0056] In particular, the number fields 4 are designed to be interactive.

[0057] The editor 3 uses a series of numeric fields 4, which allow individual numeric values ​​to be entered during programming (see Figure 2 ).

[0058] The 5 digits before the decimal point and the 6 digits after the decimal point are separated by a decimal point, allowing the user to clearly distinguish between the 5 digits before the decimal point and the 6 digits after the decimal point. The decimal places are displayed smaller for further visual differentiation. The spacing between the 4 digit fields can be increased to distinguish between hundreds and thousands places.

[0059] Numeric fields 4 enabled for editing can be displayed in color, for example, with a white background, and values ​​can be entered by touching the touchscreen user interface 2 at these locations. Numeric fields 4 that cannot be edited for various reasons (e.g., due to limit restrictions resulting from the device's physical properties or the application) are displayed in a different color, for example, gray. Therefore, the user can only enter values ​​that correspond to certain limit values ​​or fall within permissible ranges.

[0060] The Editor 3, as in Figure 2For example, a display can display a maximum of six digit fields (4). However, the user may not be able to edit all six digit fields (4) where application logic prevents the specification of restricted or illogical values. If decimal places (6) are used, the editor (3) can force the user to edit a maximum of four consecutive digit fields (4), preventing the user from entering an illogical value such as "1000.01." Rather, values ​​such as "10.25" or "110.5" can be considered compliant by the application logic. Where only ante-decimal places (5) are required to specify a value, the editor (3) can also be displayed without the decimal point.

[0061] As in the Figures 3 and 4As shown schematically, the editor 3 can have a movable decimal point. In one application scenario, the decimal point remains in a fixed position and cannot be moved. However, some scenarios require the flexibility to specify more or fewer digit fields 4 either to the right or left of the decimal point (see Figure 3 ). For these cases, Editor 3 allows the user to move the decimal point to a different position using the decimal point move arrows 7. The decimal point can never be moved without conscious action by the user.

[0062] Moving the decimal point does not change the general functionality of Editor 3. All additional decimal places 6 and numeric fields 4 are smaller to ensure differentiation from the pre-decimal places 5. The buttons 7 for moving the decimal point also move at the decimal point location to increase clarity of decimal point positioning. Once a value has been entered, the arrows 7 for moving the decimal point disappear.

[0063] As in Figure 5shown, editing of time information can also be provided. Time editors 3 can follow the same scheme and have a division into hours 8 as the upper unit, minutes 9 as the middle unit, and seconds 10 as the lower unit, regardless of whether they contain editable numeric fields 4 or not. The simultaneous display of hours 8, minutes 9, and seconds 10 is intended to prevent the user from confusing hours 8 with minutes 9 and minutes 9 with seconds 10. If the application logic does not allow the entry of hours 8, minutes 9, or seconds 10, the corresponding numeric fields 4 are highlighted in a different color, for example, grayed out (see Figure 5 ).

[0064] In one possible variant, the user can optionally enter either hours 8 combined with minutes 9, or minutes 9 combined with seconds 10. If editing begins by entering the 4-digit fields for hours 8, the 4-digit fields for seconds 10 are grayed out and no longer available for editing. This reduces the confusion between hours 8, minutes 9, and seconds 10.

[0065] Selecting a numeric field 4 or the general usage concept of the implementation of the numeric editor 3 requires that the user first touches a specific numeric field 4 that requires a numeric value input.

[0066] When selecting one of the number fields 4 as the selected number field 11, a number pad appears at the bottom of the editor 3 in the form of a (virtual) fold-out / fold-out keyboard 12, which was previously hidden (see Figure 6). It displays all values ​​that can be entered at the selected position, selected numeric keypad 11. Values ​​that cannot be used at the selected position 11 due to limits or other restrictions are grayed out on the numeric keypad and are therefore unavailable.

[0067] Once the user has entered a value for the selected numeric field 11, the number appears in the numeric field 11, and the virtual keyboard 12 disappears. The editor 3 fills all pre-decimal places 5 to the right of the specified pre-decimal place 5 with zeros 13 to avoid manual entry of zeros 13. If the user does not want zeros 13 in a specific numeric field 4, they can select that numeric field 4 to change its value. In all cases, the editor 3 only fills numeric fields 4 with zeros 13 where no hard boundaries are violated.

[0068] The process of selecting a numeric field 4 is repeated until the user has entered the complete value for the desired parameter to be applied.

[0069] After the user has specified a value, it must be confirmed by touching the "Confirm" button before further processing. The choice not to use the specified value can be made by touching the "Cancel" button. In this case, the device, for example, infusion pump 1 from Figure 1 , the changes made by Editor 3 and returns to the previous value (if available) for that parameter.

[0070] To delete a value in the editor 3 and start over, the user can touch the "Delete" button 14, which deletes all values ​​from the numeric fields 4.

[0071] Editor 3 contains the concept of limits, which are visually indicated by the so-called limit bar 15. The limit bar 15 is displayed above the numerical value on the Figure 8 shown representation.

[0072] The limit bar 15 indicates the non-permissible value ranges, also known as hard limits, at its ends. The middle section of the bar contains the standard value range (e.g., marked in color, gray area) and the soft limit range (e.g., marked in color, yellow area). The soft limit range indicates values, also known as soft limits, that are permissible but require special attention / confirmation for safety reasons.

[0073] Application-specific limits of an infusion pump 1 can be provided by the drug library, which is a collection of drug- and hospital-related safety information stored in a memory of the infusion pump.

[0074] Exceeding hard limits is not permitted by the editor 3, since if certain numeric fields 4 or values ​​entered therein violate hard limits or correspond to an invalid numeric entry, the progress in the process flow is delayed or prevented.

[0075] If the user specifies a value that lies within the soft limit range for the parameter, the infusion pump 1 reacts by marking the area of ​​the limit bar 15 that lies outside the soft limits in a different color, for example yellow (see Figure 8A dynamic cursor on the bar indicates where the user-entered value lies within the range of possible values. This serves to inform the user before the value is confirmed. For infusion pumps 1, soft limits for a specific drug may be set in the device's drug library.

[0076] If the user confirms a value that is outside a soft limit, the user interface 2 displays a soft limit warning message 16 for additional security. The soft limit warning message 16 prompts the user to either override the soft limit warning 16 (i.e., accept the value) or return to edit the value to change it (see Figure 9 ). List of reference symbols

[0077] 1Infusion pump 2User interface 3Editor 4Numeric fields 5Integer places 6Decimal places 7Arrows for moving the decimal point 8Hours 9Minutes 10Seconds 11Selected numeric field 12Foldable keyboard 13Zeros 14Delete 15Limit bar 16Soft limit warning

Claims

1. An apparatus (1) for a safety-relevant, preferably medical application, comprising a user interface (2, 3) intended to display a predetermined number of digits (4) for inputting a numerical parameter, wherein the user interface (2, 3) is configured to limit the predetermined number of digits (4) depending on limits of the numerical parameter or at least one other safety-relevant limitation to a selection of digits (4) available for a user input, and to input a numerical value by the user for one of the digits (4) available for a user input.

2. The apparatus (1) according to claim 1, wherein the apparatus (1) is a medical apparatus (1), preferably an infusion pump or a dialysis machine.

3. The apparatus (1) according to claim 1 or 2, wherein the user interface (2, 3) includes a touchpad for manual input / output and / or a mouse for input.

4. The apparatus (1) according to any of the preceding claims, wherein the user interface (2, 3) includes a touchscreen for manual input / output.

5. The apparatus (1) according to any of the preceding claims, wherein the digits (4) available for a user input can be filled separately and / or successively with numerical values.

6. The apparatus (1) according to any of the preceding claims, wherein each individual digit (4) can be separately selected from the available digits (4), and the user interface is intended and configured, with or by selecting the respective digit (4), to provide, preferably visualize, further preferably fold out a virtual keyboard (12) generally valid for all selectable digits (4) or individually designed or filled for the currently selected digit (4), via which keyboard a numerical value can be associated with the currently selected digit (4).

7. The apparatus (1) according to any of the preceding claims, wherein the user interface (2, 3) is configured to distribute the selection of the digits (4) available for user input to an equal number of digits (4) for pre-decimal point positions and post-decimal point positions, or to an equal number of digits (4) for a unit and a subunit, preferably hours and minutes and minutes and seconds, respectively.

8. The apparatus (1) according to any of the preceding claims, wherein the user interface (2, 3) is configured to shift a decimal point provided on the user interface (2, 3) for displaying pre- and post-decimal point positions between the digits (4) available for user input by the user.

9. The apparatus (1) according to any of the preceding claims, wherein the digits (4) available for user input have digits for pre-decimal point positions and digits for post-decimal point positions, the user interface (2, 3) being configured to zero-fill all pre-decimal point positions to the right of the pre-decimal point positions input so as to avoid manual input of zeros.

10. The apparatus (1) according to any of the preceding claims, wherein the apparatus (1) has a memory intended to store data comprising at least one hard numeric limit and / or one soft numeric limit with respect to the safety-relevant application, the user interface (2, 3) communicating with the memory and being configured to delay or prevent an input progress on the basis of the hard and / or soft numeric limits.

11. The apparatus (1) according to claim 10, wherein the user interface (2, 3) is configured, based on a comparison between at least one of the numerical values for at least one of the digits (4) available for a user input and the at least one hard numeric limit, to restrict a further input or to reverse a previous input.

12. The apparatus (1) according to claim 10, wherein the user interface (2, 3) is configured to limit a selection of available numerical values for at least one of the digits (4) available for a user input based on the at least one hard numeric limit.

13. The apparatus (1) according to claim 10, wherein the user interface (2, 3) is configured, based on a comparison between at least one of the numerical values for at least one of the digits (4) available for a user input and the at least one soft limit, to notify that a further input is required.

14. A method for operating an apparatus (1) for a safety-relevant application, preferably an apparatus (1) according to any of the preceding claims, the method comprising: Displaying, by a user interface (2, 3), the predetermined number of digits (4) for inputting a numerical parameter, Limiting, by the user interface (2, 3), the predetermined number of digits (4) to a selection of digits (4) available for a user input based on limits of the numerical parameter or at least one other safety-relevant limitation; and inputting a numerical value, by a user, for one of the available digits (4).