Method and monitoring unit for a safety-related graphical user interface - Patents.com

Abstract

The present invention relates to a safety-related input on a graphical user interface (GUI). In this case, a computer (1) generates image data that is transmitted to a display (2) via an image data line (3). The graphical user interface has at least one graphical operator control element (6) selectable by an input device (4). Furthermore, a monitoring unit (21) is connected to the image data line (3) and reads image data for safety functions. According to the present invention, the monitoring unit (21) is supplied with input information from the input device (4) and is connected to a verification device (14) via a secure signal path (11B) for user verification purposes. According to the present invention, the monitoring unit (21) is further provided to ensure and / or verify the correct expression of a detected selection (5) of the operator control element (6) and, in case of user verification of the expressed selection of the operator control element (6), activate or initiate an associated safety-related operator control command via the secure signal path (HD). This allows safe input even with input devices that are not safety-certified, for example, relative and / or indirect pointer devices such as a commercially available computer mouse. Furthermore, a suitable architecture for the monitoring unit is proposed that is suitable for the proposed input method.

Description

[Technical field]

[0001] The present invention relates generally to graphical user interfaces (GUIs) in safety critical applications in the sense of hazards or operational safety. [Background technology]

[0002] The invention particularly relates to user interfaces where certain operations or inputs are critical or important for safety, for example in signal boxes for railway technology or control desks or system controllers for the operation of industrial systems, reactors etc. In such applications it must be ensured that the information or inputs recorded as inputs exactly correspond to those chosen or selected by the operator.

[0003] Even the mere presentation of information as computer graphics is subject to failures (errors), as a result of which failures can occur, for example, in each individual component of the computer generating the graphics, for example due to a faulty microprocessor, in the graphics processor, in the individual memory modules, in the power supply, but also in particular due to software failures in the operating system, in the libraries used in the software production, in particular the application software generating the GUI or other software components generating the GUI.

[0004] A great improvement is provided by the technology available under the product name IconTrust®, used to display safety information according to the concept in US Pat. No. 6,299,433 or US Pat. No. 6,299,452 by the present applicant. This technology allows the display to be made safer, e.g. suitable for safety integrity levels SIL-2 and above. One major advantage is that, from a safety technology point of view, virtually any type and complexity of hardware and software that has not been assessed as safe (hereinafter "unsafe") can be used in a presumably safe manner by equipment that uses an independent safety-certified monitoring module.

[0005] It is clear that further sources of failure arise if, in addition to the mere display of safety-related information, safety-related inputs are also made on the user interface (GUI). Potential sources of failure are essentially all hardware and software components used to record and process inputs. This is particularly applicable if inherently unsafe systems made of commercially available hardware are to be equipped with safety modules according to the above-mentioned approach in order to avoid a safety verification or certification of the entire system. On the other hand, this is particularly desirable if the various graphical control elements or buttons in the GUI are intended to be freely available, for example to allow intuitive operation of the usual kind with a computer mouse or a touch panel, or to allow subsequent changes to the GUI without updated certification.

[0006] Where modularity or current graphical user interfaces / GUIs are desired, the issue is that the GUI must be freely programmable in both functionality and presentation, in addition to being able to change dynamically or context-dependently during use. Relevant safety-critical failure modes for GUI data entry or operation are manifold and include, by way of example only, the following cases: a) an insecure display computer incorrectly associates the activation of a graphical control element with information content other than the correct one (e.g. from a different context), b) an activated control element is not correctly displayed or recorded as activated (i.e. critical in the case of an emergency stop), or c) activation of a control element is naturally or accidentally triggered without actual user control or user-actuated input.

[0007] In particular in the first case, the invention of the Applicant's US Pat. No. 5,399,663 offers a decisive improvement, especially in the case of touch panels. The two previous cases can also be avoided with this solution concept, with some further effort. This concept has so far been successful on the market under the product name SelectTrust® and is primarily designed for touch panels. A variant, especially for HMI devices with programmable keys (so-called soft keys), is described in US Pat. No. 5,399,663.

[0008] Both solutions allow safety-related input into a GUI generated by a non-safety assessed or non-safety certified computer. In this case, the user interface is shown on a display with at least one graphical control element selectable in a user-controlled manner with a respective input device. An independent monitoring unit or safety module is connected to the image data lines and reads out at least a portion of the image data for the desired safety function.

[0009] The solutions according to US Pat. No. 5,399,433 and US Pat. No. 5,499,443 allow for safe input in the sense that the user - whether via touch operation or via a softkey keyboard associated with the display - i.e. an absolute and direct input device for discontinuous input, activates the associated graphical control element and the monitoring unit for this activation is safely determined depending on the coordinates associated with a predefined area in the unit or module. On the basis of these safely determined coordinates, the monitoring unit directly converts the image data relating to the predefined area into a safety-related command, in particular by encoding. Thus, no non-safe display computer is involved. Due to the association in the unit or module, the touchkey or softkey input arrangement connected thereto and the image data conversion or encoding, it is inherently guaranteed that the activation of the command safely corresponds to what the user actually perceives and selects on the display. In this context, the display itself can be evaluated as a safe device for the present purposes.

[0010] Both solutions according to US Pat. No. 6,399,433 and US Pat. No. 6,399,442 require a reliable determination of security related image area coordinates that are adapted to a special input device and for which encoding and / or conversion into security related commands is performed. Both are associated with a certain amount of effort and limit the available hardware. [Prior art documents] [Patent documents]

[0011] [Patent Document 1] International Publication No. 2011 / 003872 [Patent Document 2] European Patent No. 2353089 [Patent Document 3] European Patent No. 2551787 [Patent Document 4] German Utility Model No. 202015104887 Summary of the Invention

[0012] It is therefore a first object of the present invention to provide a further development enabling secure input on a graphical user interface using a variety of conventional or unsecured input devices, in particular using relative pointing devices such as a computer mouse, in a conventional desktop workstation having a commercially available PC as the display computer, where input is understood in terms of user-controlled selection or actuation of graphical user interface control elements that is at least feasible using unsecured input devices, in particular pointing devices, e.g. computer mice, trackballs, joysticks, touchpads, touchpoints, graphics tablets, digitizers, etc.

[0013] This object is achieved by a method according to claim 1 and by a safety module according to claim 10. In this case, the solution should be suitable for at least a safety integrity level SIL-2 or a safety integrity level (according to IEC 61508 / IEC 61511) or higher, in particular SIL-3.

[0014] A general method or system allows for safety-related or safety-purposed input on a graphical user interface (GUI) where a computer generates pixel-formatted image data for a display, which is sent from the computer to the display over an image data line, and where an input device allows for control of the GUI.

[0015] When the user interface is displayed on the display - in at least one operating state or context - at least one graphical control element associated with a safety-related function is displayed, the control element being selectable in a user-controlled manner using an input device, for example by a pointer or cursor.

[0016] Furthermore, a comprehensive monitoring unit or safety module, independent of the display computer, is connected to the image data line and reads out at least a portion of the image data for safety purposes, the monitoring unit being independent or separate from the display computer, particularly in terms of signals.

[0017] According to a first aspect of the invention and in terms of a technical procedure, the following is provided: input information, in particular image pixel-related relative or absolute coordinates, is provided from an input device via a logical or physical signal path, more precisely a first channel of the monitoring unit, according to which a control element selection can be recognized, a monitoring unit for receiving a user-controlled confirmation of the selection is connected via a secure signal path, in particular a dedicated and separate physical second channel, to a signal-independent confirmation device of the display computer and / or the input device, which is specifically designed as a secure device, the monitoring unit ensures - in particular by itself ensuring, justifying or verifying - that the or each user control selection of a control element having a safety function is supplied to the display in the image data as expected or is actually correctly shown on the display; and - in the event of a confirmation by a user control received via the second channel, the monitoring unit releases or initiates, within the period during which a control element selection is reliably displayed, a safety-related function associated with this control element in a specifically guaranteed or verified manner.

[0018] In particular, said initiation may in this case be effected via a third channel specially provided for secure communication, by outputting a corresponding command.

[0019] According to the invention, a selection using an input device does not yet entail the activation or control of a function for safety purposes. Instead, this function firstly displays (or makes visible to the user) only the control elements for safety purposes. The activation or control of the control elements is actually triggered only by a verification device connected to the monitoring module and / or designed to be safe, as long as the module verifies or determines or guarantees by itself that the requirements envisaged for the module are met. In particular, these requirements include the expected or correct reproduction of the selection in the image data supplied to the display.

[0020] In this case, the display and control concept of a classical computer workstation can be retained and any commercially available input device can be used. In particular, according to the invention, a COTS (commercial off-the-shelf) pointing device can be used. Preferably, a conventional indirect and relative pointing device for 2D input is preferably used as input device, in particular a computer mouse or, also by way of example, a trackball, joystick, touchpad, digitizer, etc.

[0021] The safety of the operation or input is achieved, inter alia, by the independent activation of an additional confirmation device, for example a safety button connected to the monitoring unit in combination with the reliably displayed selection according to the invention. The user is thus included as an instance to confirm the actual intended input by means of the confirmation device.

[0022] Therefore, the approach proposed by the present invention - different from that of Patent Document 3 or Patent Document 4 - can omit the secure input and determination of input information, especially absolute coordinates, for example by using a touch panel or by direct input (using soft keys), and the input process is basically divided into three sub-steps, namely: i) Generation or determination of input information, e.g., selected coordinates, independent of the actual operation; ii) a display based on the selection or selection of a control element for confirmation or validation of an input by a user in response to the displayed selection; and iii) subsequent or subsequent activation of a safety-related function associated with the control element in response to a confirmation by the user provided by an additional confirmation device. is divided into

[0023] In sub-step i), for example, the coordinates can be determined using a commercially available computer mouse, which transmits the shift as a change in coordinates (DELTA coordinates) to the controller as a relative pointing device. For example, absolute coordinates can thereby be generated based on the previous position and its change or shift. To perform sub-step ii), the absolute coordinates can for example be kept in the monitoring unit, i.e. in a more secure module, and can preferably be displayed securely by this module in the absolute coordinates known by the module, for example in the form of a mouse pointer. Alternatively or additionally, the display can also be made via a non-secure display computer, in particular for positions and / or coordinates outside the predefined image area with the safety-relevant control element. Within the predefined image area with the safety-relevant control element, the display should be made securely or reliably at a position corresponding to the absolute coordinates stored in the module. In sub-step iii), on the basis of this, the user or viewer can recognize, acknowledge or confirm that the display is a valid selected position with respect to the safety-relevant control element in order to activate the desired control. This can be done in sub-step iii) by activating an independent safety confirmation device, such as a button. Based on this, the monitoring unit or module can generate or output a corresponding command.

[0024] In summary, the securely displayed selection is in this case separated from the actuation of the control element by confirmation with the confirmation device. The invention makes unnecessary a laborious determination of input information (e.g. absolute coordinates), which is difficult to implement with commercially available input devices. Furthermore, it is irrelevant via which channel (e.g. even an insecure channel) the input information of the monitoring unit is transmitted. An insecure input device may for example be connected to an insecure computer. The input information may be transmitted to the monitoring unit via the image data line, selectively together with the image data, for example in a pixel data container according to US Pat. No. 5,399,323.

[0025] Since the type and generation of the input information is essentially irrelevant via the proposed solution, any input device can be used, in particular an indirect and / or relative COTS pointing device.

[0026] Preferably, contrary to the teachings in US Pat. No. 5,999,233 and US Pat. No. 5,999,233, a pointing device is used that is particularly suitable for relative and continuous input, in particular an indirect pointing device for 2D input. Commercially available or COTS peripheral devices, in particular a computer mouse, can be used in this case. Such a device allows intuitive pointer or cursor guidance in a GUI. Thus, the relative movements recorded by the pointing device are converted, in particular into pointer movements or image coordinates relative to the resolution of the display.

[0027] Input information from an input device, particularly a pointing device, can be provided to the monitoring unit via any interface. When the input device is connected to the monitoring unit, in particular to a controller component of the monitoring unit, or indirectly connected by a desktop PC, e.g. a computer with a connected computer mouse, In particular, it may be performed directly by an input device.

[0028] Selection or indication may be achieved, for example, by using a mouse pointer overlaid by the monitoring unit or some other visual indication, for example by a colored frame, or by changing the color of the selected control element via the monitoring unit or module.

[0029] The monitoring unit may, for example, record approval or confirmation of a subsequent input by the user regarding a safety-critical control element visually highlighted by the monitoring unit for the purpose of outputting a control command in the GUI according to the safety-critical control element or its intended use.

[0030] In a preferred embodiment, the monitoring unit itself ensures that the selection of the recognized control element is correctly represented in the image data provided to the display. This can be achieved by the monitoring unit modifying at least a portion of the image data intended for display in a predefined image area associated with the control element, and the monitoring unit correspondingly forwarding the modified image data to the display. This modification can for example include a pointer display by the monitoring unit, or the image data modified by the monitoring unit can represent a pointer depending on the position of the input information currently provided to the monitoring unit. Additionally or alternatively, the modification can result in a visual highlighting or visual indication of the selection to the user, especially in the predefined image area associated with the respective control element on the display.

[0031] The image data may be digital image data, particularly for pixel formatted representation.

[0032] In particular, it may be provided that image data modified by the monitoring unit is overlaid with computer-generated image data only in certain areas, in particular in relatively small image areas relative to the entire graphical user interface, i.e. the GUI display is generated at least in large part by the display computer.

[0033] As an alternative to ensuring the selection of the correct display by changing the image with the monitoring unit itself, it can be provided that the image data generated by the computer for display represents the selection of the control element. In this case, it is specifically provided that the monitoring unit verifies that the selection of the recognized control element is in each case correctly represented in the image data supplied to the display. This can be achieved by the monitoring unit calculating a check code for image data intended for display in a predefined image area associated with a control element and comparing this check code with at least one pre-stored reference code. For example, a technique based on the concept in the applicant's patent DE 10 200 43 336 is suitable for this purpose.

[0034] For an easily implemented operability of the user interface on the display computer and / or for easy recognition of selections on the monitoring unit, it should be provided that--depending on whether a conventional input device is directly connected to the monitoring unit or to the display computer--the input information is transmitted from the input device to the computer via the monitoring unit or to the monitoring unit via the computer. In a preferred embodiment, a conventional input device, in particular a computer mouse, is directly connected to the monitoring unit.

[0035] In particular, in the context of image data correction to ensure the display of the correct selection by image correction using the monitoring unit, it is preferably provided that the monitoring unit comprises a first computing component on the input side to which computer-generated image data is supplied, in particular from a display computer, via an image data line, and that depending on the selection of the safety-critical control element, the first computing component modifies this image data in order to visually enhance the selection and image data (including the resulting modified image data, if necessary) on the output side and outputs it to the display. In this case, the monitoring unit may further comprise a second computing component that is used to verify the image data from the first computing component, in particular the modified image data, on the output side, for example with regard to the image data encoding for the purpose of comparing the computer-generated code.

[0036] In particular, in one embodiment it may be provided that the first computing component calculates a first level check code for the computer-generated input or input image data of the input side intended for display in a predetermined image area, and the monitoring unit compares this first level check code with at least one pre-stored reference code for the predetermined image area, in which case the first computing component preferably calculates the check code for the computer-generated image data in a first step on the input side and later corrects the image data in a second step.

[0037] In a hardware and computationally efficient embodiment (e.g. where display validation can be used modularly), the following may be defined: one, more precisely the first computing component of the monitoring unit, calculates a first second-level check code on image data modified by the first computing component intended for the display of a given image area, one, more precisely the second computing component of the monitoring unit, calculates a second second-level check code on the output image data modified by the first computing component intended for the display of a given image area, The monitoring unit compares the resulting second level check codes with each other, in particular for the purpose of verifying that the selection has been highlighted as intended by the first computing component.

[0038] In this case, each of both computing components preferably calculates a third check code with respect to image data for a given image area without selection, and the monitoring unit compares the third check codes with each other for the purpose of verifying the display of the control element before highlighting to indicate a selection, or more precisely without highlighting.

[0039] In order to reduce the required computational power, it may be provided that the computing component calculates said check code or codes only if the selection of the control element is recognised by the monitoring unit.

[0040] The corresponding check code can in particular be determined for example for pixel-formatted image data for a given image area associated with the control element which corresponds completely or only partially to the display area of ​​the control element. Any suitable coding method can be used in this case, for example a CRC calculation. In this respect, reference is made to the teachings in US Pat. No. 5,999,623 or US Pat. No. 5,999,623.

[0041] The first computing component can modify the data for visual emphasis of the selection, for example by overlay, color change, etc., so that the selected control element appears in a second selected state that is visually distinct from the first non-selected display state. This improves ergonomics and simplifies the visual perception of the selection for the user. On the one hand, a mere pointer display by the control element is now understood as a selection of the displayed control element. On the other hand, if the current coordinates correspond to a safety-related control element, the pointer may be hidden and replaced by a visually perceptible selected state display.

[0042] In principle, the first computing component, in an embodiment, can output modified image data in the image data stream to the display along with the computer-generated image data, which can be accomplished simply, for example, by overwriting or overlaying the computer-generated image data only in certain graphics-relevant regions, leaving other computer-generated image data untouched.

[0043] The monitoring unit is preferably designed as a circuit module having at least one integrated circuit, and is connected to the first computing component via a serial circuit arrangement on an image data line, preferably near the display, in particular directly at the image data input of the display.

[0044] In an embodiment particularly suited to a conventional control concept, a pointer or cursor, in particular a mouse pointer controlled by a computer mouse, is shown on the display to operate the user interface. In this case, it can be provided that the pointer is generated exclusively by the monitoring unit based on input information provided to the monitoring unit, for example by means of a first computing component, in particular by image data modification in the monitoring unit. In this case, an input device, preferably a relative pointing device, in particular a computer mouse, can be preferably again directly connected in the monitoring unit. The module then transfers this input information to the computer for display.

[0045] The methods and devices may be implemented such that a pointer or cursor in the GUI is visible to the user, and in particular is permanently visible, displayed or overlaid, to allow normal and continuous operation.

[0046] A relative and / or indirect pointing device, preferably suitable for continuous pointer guidance, is preferably used as input device. In this case, a COTS pointing device may be used, for example with a USB connection. However, it is not within the scope of the present invention to provide a COTS pointing device, but it is within the scope of the present invention to provide an independent SIL-capable confirmation device that is safe in terms of electrical signaling, for example a custom-made pointing device compatible with a conventional relative pointing device (e.g. a computer mouse) that further comprises a push button as an integrated part. In this case, the confirmation device is preferably connected to the monitoring unit independently of the signal connection for the pointing device via a separate and independent signal path that is preferably designed to be logically and / or physically safe.

[0047] In further embodiments involving pointer manipulation, it may be provided that a pointer is generated by the display computer at least outside all predefined image areas for safety-critical control elements. In this context, it may also be provided here that if the selection of a safety-critical control element in the respective relevant area is recognized by the monitoring unit, preferably by image data modification in the monitoring unit, the computer-generated pointer is not displayed. In this embodiment, in particular an input device, in particular a computer mouse, may be directly connected to the display computer in a conventional manner, for example via a USB port. The display computer then transfers the input information to the monitoring unit.

[0048] For example, it may be advantageous for the image data verification in particular by means of the check code calculation if the pointer, in particular the mouse pointer, is in each case periodically hidden and displayed, preferably at a frequency that is not perceived as unpleasant by the user. For example, for each N consecutive image periods of the image data, the mouse pointer may be consequently displayed by the computer or the monitoring unit only for m image periods less than N. This provides, in particular for the control element, the option of calculating the check code for the image data with the pointer hidden. This greatly simplifies the verification of the correct display, since the pointer is fully positionable or movable on a very fine grid in the GUI. Alternatively, the pointer display may be fixed or clipped to a single predefined position by suitable software in the control element, as long as the determined coordinates or input information do not deviate from the relevant area.

[0049] Depending on the input device, the input information may represent, in particular, absolute coordinate information, as is common with touch displays, or relative coordinate information, as is common with computer mice, which in this case can be readily converted to absolute coordinate information using computational techniques.

[0050] On the device side, a monitoring unit is also proposed for monitoring the Graphical User Interface (GUI), which includes at least: - a digital image data interface, in particular an LVDS interface, an HDMI interface, etc., used to connect to an image data line for transmitting computer-generated image data from a computer to a display; at least one computing component that performs a safety function and that reads at least a portion of the image data via an image data interface; and - A device interface for inputting information, in particular based on an input device for user-controlled selection of graphical control elements Equipped with.

[0051] Still further, in accordance with the first aspect of the present invention, the monitoring unit comprises a physical confirmation input to which a security confirmation device can be connected for input confirmation or user approval, and the at least one computing component is configured to ensure and / or verify that selection of a recognised control element is correctly represented in image data supplied to the display, in particular according to one of the previously mentioned method aspects referenced.

[0052] Also according to a first aspect of the invention, the monitoring unit outputs the relevant safety-related control command, in particular via the safety interface, if it receives a confirmation input via the confirmation interface during selection of the displayed control element, more precisely in a chronologically predetermined context together with the selection of the displayed control element.

[0053] The proposed monitoring unit preferably comprises at least one computing component arranged for image data correction and / or calculation of a check code on the basis of the image data. The monitoring unit may comprise at least one memory for specifying predetermined image areas and / or reference codes, in particular for verification purposes.

[0054] The monitoring unit preferably comprises a controller component for the input device, which is connected to a device interface used for direct connection of the input device, e.g., in particular a computer mouse, can then be directly connected to the monitoring unit, in particular in this case the monitoring unit preferably comprises a data interface, in particular a bidirectional data interface, for transmitting the input information to an external or separate computer for display.

[0055] According to a further independent aspect of the invention, it is proposed that the monitoring unit has a two-stage or possibly two-channel computer architecture, comprising: a first computing component, more precisely a computing component configured to receive computer-generated image data at an input side, to modify at least a portion of the image data intended for display in a given image area depending on a safety function, and to provide image data for display at an output side Equipped with a second computing component, more precisely a computing component configured to validate the image data output from the first computing component by calculating a check code for the image data, in particular modified image data intended for display in a given image area; Equipped with.

[0056] This is regarded as an independent invention in which the use of a monitoring unit enables - in particular, but not exclusively, for secure input - the generation of safety-purpose overlays or highlights in a safe manner in a graphical user interface.

[0057] In this context, the monitoring unit according to the second aspect may be set or configured in particular to compare the calculated check code with at least one pre-stored reference code, in particular for the purpose of verifying that the emphasis by the first computing component is as intended and / or for the purpose of initiating a response for safety purposes.

[0058] A monitoring unit with this two-tier architecture is particularly, but not exclusively, suitable for the method according to the first aspect described in the introductory chapter, but may also be advantageously used for other applications, for example to safely show a status indication as to whether an area is monitored or not, to safely show designated monitoring areas for mere display (without input functionality), and to ensure that areas represented as being obstructed are hidden, overlaid or marked as being obstructed etc.

[0059] In particular according to the second aspect, the first computing component may be configured to calculate, for computer-generated image data for display in the monitored area, a check code for a comparison for safety purposes with at least one pre-stored reference value, in particular a reference code, for the monitored area. In this case, the first computing component may first calculate the check code for the computer-generated image data at the input side and then in a second step modify the image data, for example to highlight safety information or as a safety response in case of a fault. In particular, in an embodiment according to the second aspect, it may be provided that the first and second computing components implement different coding methods, in particular of different types, i.e. of diverse aspects, and / or are implemented by two independent integrated circuits, such as FPGAs, ASICs, etc., in order to minimize the sensitivity to faults on the system by diversification.

[0060] In particular in an embodiment according to the second aspect, at least one computing component having a safety function, in particular the first and second computing components, may in each case generate a computed check code for a selected image region.

[0061] The computing component may be connected to a voter arrangement, e.g. one or more processors, provided or configured to compare the generated check code with pre-stored reference data, whereby the voter arrangement may preferably be implemented as a two-channel processor circuit (preferably as a 2oo2 (2-out-of-2) voter in case of two computing components), with other X-out-of-Y voter concepts also being possible depending on safety and / or availability requirements.

[0062] If a second computing component is used, it may likewise have a two-channel design for image data correction, i.e. have redundancy with respect to the first one, but this is not essential. If the computing component has two channels, the second one can redundantly correct at least a part of the image data in the same manner as the first computing component. If both of them each calculate a corresponding first or second check code for the corrected or redundantly corrected image data, the check codes can be compared with each other for functional safety, especially in a voter configuration, by a monitoring unit. This makes it possible to ensure that the first computing component corrects the image data in the expected manner or correctly, for example to highlight or hide safety-critical areas.

[0063] Regardless of the first or second aspect, the monitoring unit preferably comprises a module for communication for safety purposes via a bus interface which is consequently usable as a safety interface for outputting control commands for safety purposes, e.g. for communication according to IEC 61784-3-3, PROFIsafe protocols etc.

[0064] Regardless of the first or second aspect, the monitoring unit may be configured, in particular by a configurable or programmable computing component, such as an FPGA, a logic unit or computing component and / or a microcontroller, so as to be configured for a computer-implemented execution of at least one method step according to one of the procedural embodiments described above. In this case, the term "computing component" is not limited to a programmable computer, such as a von Neumann computer, but also includes any unit capable of processing image data by computation, such as a pre-configured FPGA, ASIC, etc.

[0065] The proposed monitoring unit according to the first or second aspect is particularly suitable for being equipped with a display device, in particular with a TFT panel, used for displaying pixel graphics. The modular monitoring unit may also be integrated into the device, for example directly at the image data input. In this case, the display may comprise at least one connection for an input device connected to the device interface of the monitoring unit and a connection for a security validation device connected to a validation input of the monitoring unit.

[0066] The invention also relates to a system for security-related input into a GUI, comprising a computer and a display for pixel graphics connected to said computer via a graphics data line. According to the invention, in particular according to a first aspect, in this case a monitoring unit physically independent from the computer is provided as described above.

[0067] According to the first aspect, the system may further comprise an input device, in particular a computer mouse, for operating a user interface, preferably directly connected to the device interface of the monitoring unit. Still further, according to at least the first aspect, a separate and safe confirmation device, in particular a safety button, for example having an open / close contact, is connected to the physical confirmation input of the monitoring unit.

[0068] The method features and device features described above are mutually combinable and are to be considered in each case independently or individually as essential to the invention.

[0069] The proposed solution can be advantageously used for parameterization in safety-related processes or systems, e.g. process technology or automation technology, in order to enable a safe and at the same time user-friendly operation, e.g. by means of a GUI.

[0070] The field of application of the invention is not limited to display or desktop computer systems, but also includes so-called convertible or small portable devices, for example for the remote control of machines or systems. Such small devices, such as tablet PCs, are used here, for example, to control container cranes in ports or to program industrial robots. Furthermore, the invention can also be used in the area of ​​critical access or authority security, in particular for systems requiring authority.

[0071] Without limiting the scope of protection, further characteristics and advantages of the present invention can be gathered from the following more detailed description of preferred exemplary embodiments, with reference to the attached drawings, in which: [Brief description of the drawings]

[0072] [Figure 1] FIG. 1 is a schematic diagram of a system for secure user input in an unsecure computer-generated graphical user interface (GUI). [Diagram 2] Three exemplary embodiments for monitoring a GUI are shown: one having an input device connected to a computer for display and a confirmation device connected to a monitoring unit according to the present invention (FIG. 2A), one having an input device and a confirmation device connected to a monitoring unit according to the present invention (FIG. 2B), and a variant of the confirmation device of FIG. 2B (FIG. 2C). [Diagram 3] To illustrate the method according to the present invention, various states of a merely exemplary GUI on a display with control elements in various states and a mouse pointer for selecting a control element are shown, with a non-safety related control element selected (FIG. 3A), with no selection (FIG. 3B) and with a safety related control element selected (FIG. 3C). [Figure 4] Two exemplary embodiments of the monitoring unit are shown (FIGS. 4A-4B) together with a schematic signal flow diagram illustrating how the monitoring unit ensures that the recognized selection of the control element is correctly represented in the image data. [Diagram 5] 5A and 5B show the architecture of a monitoring unit for secure input (FIG. 5A) and / or display (FIG. 5B) in safety-critical applications according to a separate further aspect of the invention. [Figure 6] 1 is a schematic diagram of a display device with an integrated monitoring unit according to one embodiment of the present invention; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0073] FIG. 1 shows diagrammatically an arrangement or system 10 for safety-related input on a graphical user interface (GUI) comprising a computer 1 generating pixel-formatted digital image data. The image data is fed via suitable image data lines 3 to a COTS display 2, e.g. a TFT computer screen, for display. Any COTS computer, e.g. a desktop PC, can be used as computer 1 for displaying graphics (hereinafter referred to as PC1 for short). PC1 is considered as unsafe from the point of view of safety requirements, more precisely unsafe from the point of view of signalling technology, i.e. unsafe from the point of view of safety technology. PC1 is programmable or programmed to display any desired GUI on display 2, depending on the application, inter alia, by selectively using various context-dependent modes or screen masks (see FIGS. 3A-3C). Part of the system 10 in FIG. 1 is an input device for operating the GUI, specifically in FIG. 1 a relative, continuous and indirect pointing device, in this case a commercially available computer mouse 4. In FIG. 1, as an example, a COTS computer mouse (hereinafter referred to as "mouse" 4 for short) is connected to PC1 in a conventional manner. From a safety perspective, Mouse 4 may also be considered as unsafe.

[0074] Using a mouse 4 or some other relative, indirect and continuous control, the user can manipulate graphical control elements in the usual way by moving a position pointer or mouse pointer 5 in the GUI representation generated by the PC 1.

[0075] In order to achieve a desired safety integrity level, e.g. SIL-3, despite the use of non-safe components, e.g. a non-safe PC 1 and a COTS input device, in this case a mouse 4, an additional modular monitoring unit 11 is provided, as shown diagrammatically in FIG. 1. The monitoring unit 11 is provided in the form of a separate hardware or as an independent module and is safety certified. The modular monitoring unit 11 (hereinafter referred to as SMU for short) is connected to the image data line 3 and can be connected, for example, to an image data input of the display 2. The SMU 11 is configured to read out at least a portion of image data from the image data line 3 in order to perform safety functions, in particular for the purpose of detecting faults, and to monitor a predefined image area and / or to selectively also modify the image data for the purpose of drawing on the display 2. The image data line 3 can carry image data, preferably pixel-formatted digitally, in any suitable signal format, e.g. LVDS.

[0076] The SMU 11 is also supplied with input information via a first signal path, i.e., channel 11A, which need not be of a secure design. This information includes specific coordinates, either relative coordinates (FIG. 2B) or graphics-related pointer coordinates (FIG. 2A) generated thereby from a mouse pointer 5 (also called a "cursor"), based in particular on the manipulation of the mouse 4. The pointer coordinates in FIG. 1 may be determined by the PC 1, for example, based on the relative coordinates of the mouse 4, and transmitted from the PC 1 to the SMU 11 via the first channel 11A. Depending on the input device, e.g., a digitizer, the device may also generate absolute coordinates and transmit them to the SMU 11 via channel 11A.

[0077] Based on such input information, in particular the pointer coordinates, the SMU 11 can recognize the selection or user-controlled selection of a safety-critical control element 6 (shown here only diagrammatically). In this context, any GUI control element will be regarded as a safety-critical control element 6, the actuation of which is intended to have, be associated with or initiate (e.g. PIN entry) an application-dependent safety-related function in the sense of hazards or operational safety (e.g. switching of points in a railway signal box) or access or authority security. This kind of safety-critical control element will be referred to in the following as safety- or safety-relevant entry element (SEE) for short.

[0078] FIG. 1 further shows an independent confirmation device 14 (hereafter CD for short), which is connected to the SMU 11 via a second signal path, i.e. channel 11B. The CD 14 is preferably designed independent from the mouse 4 in terms of hardware. The CD 14 is preferably SIL-capable and in any case connected to the SMU 11 via its own secure channel 11B. The CD 14 is used in the system 10 for a user-controlled confirmation of a desired operation or actuation of a safety-critical control element, shown diagrammatically as SEE 6, previously selected with a cursor 5 controlled by the mouse 4. In this respect, actuation of a button on the mouse 4 is not made available for initiating a critical function associated with the SEE 6, which is ignored or taken into account in the SEE 6 by appropriate programming. Instead, a corresponding actuation must be made by the user via the CD 14, e.g. a secure button or push button. The users thus separately and independently approve or confirm their selection or choice for one or each offered SEE 6, in each case by entering or actuating the additional CD 14.

[0079] Selection of the control element, optionally including one of the plurality of SEEs 6, is made in response to user control of cursor 5. SMU 11 is also further configured, e.g., programmed, on a computer, to ensure, but at least verify, that a recognized selection or choice of one of the plurality of SEEs 6 (see Figures 3A-3C below) is correctly represented in the image data provided to display 2 via image data line 3. Thus, it is ensured that the selection currently being made in the program within SMU 11, e.g. based on pointer coordinates of cursor 5, corresponds to that shown to the viewer or user by an appropriate display on display 2. This can be implemented via software techniques in SMU 11.

[0080] In this case, how said indication is made to the user, in particular whether it is generated by PC1 or by SMU 11, is of secondary importance, as long as the user visually recognizes the selection that SMU 11 has taken into account or which is considered currently valid. This indication should already be achieved, in particular by the cursor 5 pointing in a conventional manner to SEE 6, since this is visible to the user and corresponds to a normal control. Thus, the display and control concept of a classical desktop workstation with PC1, display 2 and mouse-operated cursor 5 in the GUI is maintained.

[0081] The desired safety integrity level, e.g. SIL-3, is achieved by the system 10 in particular in that only the safe or SIL-compliant SMU 11, and not the (non-safe) display PC 1, initiates a safety-related control command or releases a safety-related function appropriate for the selected SEE 6 upon receiving a user-controlled confirmation from a CD 14 specifically provided for this purpose. The clarity associated with the selection of any control element of the GUI is inherent in a pointer-based GUI with a cursor 5 (since there is only one cursor 5 at any time). The confirmation, when it is made, is associated with exactly one single selection currently considered as being safe to be displayed by the SMU 11, i.e. with exactly one SEE 6, and is discarded in other cases. For this purpose, the activation of the CD 14 is monitored or queried by the SMU 11, in particular during the display selection of the relevant SEE 6, and is used by the SMU 11 to initiate a control command associated with this SEE 6. The monitoring or interrogation of CD14 is omitted if SMU11 does not recognize a valid selection of one of the SEE6 selectively, or is performed only if a selection is recognized (fail-safe behavior). In this case, the display 2 is considered safe, since a normal fault case can be recognized by the user (fault detection). However, additional hardware measures may be implemented to ensure a correct display on the display 2.

[0082] 2A-2C show three embodiments of a system 20A, 20B, 20C according to the invention for secure input using a relative pointing device with an SMU 11 or 21 in an image data stream 3. In the embodiment shown in FIG.

[0083] FIG. 2A shows a system 20A that generally corresponds to the concept in FIG. 1, specifically with a mouse 4 that is directly connected to PC1, for example to a USB port, and a secure button as CD 14. CD 14 is directly connected to an independent SMU 11 via a secure channel 11B. In this case, the relative coordinates of the mouse 4 are converted in PC1 into image-related or absolute pointer coordinates for controlling the cursor 5 and are continuously transmitted to the SMU 11 via channel 11A, which is not necessarily of a secure design. Alternatively, the absolute pointer coordinates may be determined in SMU 11 and sent back to PC1 via channel 11A. Channel 11A is designed to be bidirectional in system 20A so that SMU 11 can send control commands back to PC1, in particular with respect to the representation in the display 2, for example with respect to hiding the cursor 5 when it points to SEE6, in order to further visually emphasize the SEE6 (selection) or the like to which the cursor 5 is currently pointing. If a mouse is connected to PC1, it is preferably programmed so that SEE6 is not controllable via PC1 or directly via the buttons on the mouse4.

[0084] Furthermore, the SMU 11 is connected to a secure external parent computer 7, e.g. a system controller or the like, via a secure signal path, i.e. channel 11D. When a user-controlled confirmation is received at button 14 during a displayed SEE selection (pointed to by cursor 5), e.g. a GUI acknowledgement button for system parameterization, issues a safety-related control command associated with the SEE 6 to the secure computer 7, e.g. via channel 11D. The secure signal path, i.e. channel 11D to the secure computer 7 can be implemented by a suitable bus or a suitable network, e.g. PROFINET (see FIG. 6) or ProfiSafe, preferably having a security view (OSI model) suitable for secure signal transmission.

[0085] The CD 14 can be designed to be functionally safe, for example by means of a suitable controller technology in the SMU 11, and can be designed, for example, as a single-channel button 14. From a purely software point of view, the reliable functioning of the CD 14 can be ensured by a suitable controller. Considering higher safety requirements, the CD 14 may for example have a two-channel design equipped with a switch and / or designed to be physically safe. Above all, it must be ensured that the CD 14 does not erroneously send to the SMU 11 an action that was not actually performed. The absence of an executed action in the CD 14 will be perceived as a fault by the user.

[0086] In the system 20A according to Fig. 2A, a pointer 5 controlled by a mouse 4 can for example be continuously overlaid with a display PC 1, and the representation on the display 2 is monitored for correctness by an SMU 11, for example according to the concept in US 6,940,633, i.e. by using a check code which the SMU 11 calculates over a pixel-formatted monitored area, and by using the check code in comparison with or reference to a value which is then compared to a reference value. For the sake of simplicity, the teachings of US 6,940,633 or US 6,940,633 regarding the use of check codes are incorporated herein as a preferred solution.

[0087] 2B shows a preferred system 20B which differs from FIG. 2A mainly in that in this case the mouse 4 is directly connected to the SMU 21 via channel 11A. The SMU 21 may comprise, for example, an input device controller suitable for this purpose, for example in an existing microcontroller or processor or any suitable separate integrated hardware component. The input device controller may also be implemented separately and externally and interfaced with the SMU 21 (FIG. 6), e.g. 22B, the conversion of relative coordinates generated or transmitted by mouse 4 to image-related pointer coordinates is performed in image-related designated coordinates within SMU 21. The resulting image-related pointer coordinates or relative mouse input coordinates, and optionally mouse button interrupts, are continuously transmitted to PC1 via data channel 11C for the purpose of subsequently controlling the GUI, so that for non-safety related inputs, PC1 can process the pointer position and optionally mouse 4 button actuations to display the GUI. In the configuration according to FIG. 2B, SMU 21 always has the current, optionally also safety, input data from the input device, in this case mouse 4.

[0088] In particular in the system 20B according to Fig. 2B the pointer 5 is continuously displayed via the control of the mouse 4, preferably in the SMU 21 or by itself. For this purpose the SMU 21 performs the modification of the image data transferred to the display 2, for example by overlaying graphics generated by the PC 1 in certain areas (see below with reference to the following Figs. 4A-4B). In this context the SMU 21 inherently always has knowledge of the pointer coordinates and of each selection of the SEE 6, later confirmed by the user via the CD 14, in order to trigger relevant critical functions, for example when transferring relevant safety-related control commands via the channel 11D to the secure computer 7.

[0089] 2C shows a further variant of the system 20C, which differs mainly in the type of confirmation device (CD). In the system 20C, a softkey keyboard 25 provided in an HMI with a display 2 is connected via a safe signal path 11B to an SMU 21 as a safe confirmation device. The softkey keyboard 25 corresponds to a design according to US Pat. No. 5,399,433, which is incorporated here for the sake of simplicity.

[0090] The functional safety of the physical keys 24 is ensured by the softkey controller 26. Alternatively, the SMU 21 can read out the buttons 24 directly and safely. The keys 24 are usually arranged in the margins of the display 2. The PC 1 can in this case display graphical icons 23, symbols etc. associated with the individual keys 24 of the softkey keyboard 25. Depending on the context, different or always the same keys 24 can be used for the confirmation input to the SEE 6, in which case the safety relevance or the necessary confirmation process can be visually displayed to the user in the GUI, for a more intuitive use, for example by means of a suitable icon 23. The accuracy of the display of such additional icons 23 related to the confirmation process can likewise be monitored by the SMU 21, for example by encoding the relevant image data and comparing it with an assumed reference code, according to the concept in the patent application WO 2005 / 023363.

[0091] The system 20C can also perform a separation between the selection of the pointer-based selection or the important SEE6 and their actual actuation / control by an independent confirmation, in this case by one of the softkey buttons 24. The corresponding softkey button 24 is associated in a predefined manner with the selected SEE6 in the SMU 21 for the confirmation input. Thus, taking into account the actual confirmation by the user, i.e. when a predefined key 24 is pressed, the SMU 21 can output the associated control command to the secure computer 7 via the channel 11D. Furthermore, if the cursor 5 is displayed exclusively by the SMU 21, the system 20C can also selectively perform further functions according to US Pat. No. 5,999,366 or also according to US Pat. No. 5,999,366. On the other hand, if the position-variable cursor is displayed by the PC 1, taking into account the requirement for a unique check code based on image data, such a solution is not possible without extensive software processing. However, in this case the focus is on the secure operation of the GUI via the cursor 5 using a relative, continuous and indirect input device such as the mouse 4, meaning that the other functions of the softkey button 24 beyond the confirmation input are optional.

[0092] The function, or more precisely the method, will be briefly explained below with reference to the schematic diagram of GUI2A in FIGS. 3A-3C.

[0093] The user moves a cursor 5 over the image rendered by the display 2, i.e. within the GUI 2A. In this case, a number of non-safety related control elements 9 are also provided, the operation of which is performed by the PC 1 in a completely conventional manner, optionally without involvement by the SMUs 11;21.

[0094] On the other hand, if the position of the cursor 5, recognizable by the pointer coordinates, enters a predefined image area (monitoring area) corresponding to the SEE 6, the SMU 11;21 will recognize a selection related to safety. For this purpose, the pointer coordinates (absolute coordinates) are constantly stored and updated in the SMU 11;21 based on an indirect (Fig. 2A) or direct (Fig. 2B / 2C) transmission from the input device 4. The selection is recognized as the display area of ​​the SEE 6, more precisely as a predefined corresponding monitoring area, by the graphics-related image coordinates stored in the SMU 11;21. This is therefore recognized when the cursor 5 enters this graphics area of ​​the GUI 2A, for example, at the input stage of the SMU 11;21. Alternatively, an additional visual emphasis of this area may be performed by the PC 1 and under the control of the SMU 11;21, or preferably by the SMU 11;21 itself, for example by a clearly recognizable frame 8 as shown diagrammatically in Fig. 3C.

[0095] The SMU 11;21 has knowledge of an existing selection of the SEE 6 based on the current pointer coordinates of the pointer 5. In case of such a selection, the SMU 11;21 verifies or ensures a correct pointer display and, optionally, an appropriate visual highlighting. On this basis, the SMU 11;21 can recognize a confirmation input, in particular a confirmation input made during an active highlighting of a selected SEE 6, via the secure button 14 or 24 as an approval by the user and associate it with a corresponding safety-critical function of the SEE 6. Considering a corresponding confirmation input in the CD 14 or 24, the SMU 11;21 can activate the safety-critical function and, for example, output a corresponding command to the secure computer 7. This command may take any predefined form and may, for example, correspond to encoded image data for the SEE 6. In this case, actuation of a conventional mouse button of the mouse 4 will be ignored as it is considered unsafe and a release or command output by the SMU 11;21 will have no effect. This can be more easily implemented if the mouse 4 is directly connected to the SMU 11;21 (FIG. 2B).

[0096] In particular, verification of the enhancement caused by an insecure PC1 can also be achieved in this case by encoding image data of the relevant monitoring area in SMU11;21 and comparing it with a target code or a reference code, for example according to patent document 1.

[0097] A visual emphasis of the selection of SEE6 can be achieved by a representation by the cursor 5 only. For the purpose of computational simplification, when the mouse 4 is moved into the image area of ​​SEE6, in particular when the cursor 5 is generated graphically by the PC1, the cursor 5 can be selectively set and kept in a predetermined position via some kind of clipping or snapping. For example, in this case the cursor 5 may be displayed at or superimposed on the pointer coordinates corresponding to the geometric center of SEE6, such that the current pointer coordinates (absolute coordinates) can be overwritten or ignored. In this way, graphics verification for safety purposes, for example by code comparison in the SMU 11;21, can potentially be significantly simplified, since the cursor 5 always receives a predetermined graphical representation in the selected SEE6 in case of selection or selection. Furthermore, operational safety is increased, or more precisely, the user can recognize the above behavior as being related to safety. In this variant, the normal display mode is not returned until the cursor 5 is moved by the mouse 4 significantly away from the monitored image area of ​​SEE6. In other words, the system is advantageously configured so that when the cursor 5 is moved into the surveillance image area of ​​SEE6, it behaves differently to the user than the remainder of GUI2A, for example being held in a predetermined image position or being hidden.

[0098] On the one hand, highlighting the selection is preferably performed by the SMU 11;21 itself, in particular by modifying the image data transferred to a display to which the SMU 11;21, suitably connected to the image data line 3, has access. For this purpose in particular, the SMU 11;21 itself indicates the cursor 5 in the image data, as a result of which the encoding for security purposes of the image data is also simplified (see Figures 4A-4B below).

[0099] In any case, the SMU 11;21 can ensure that when selecting an SEE 6, the pointer coordinates of the displayed cursor 5 (visible to the user) correspond to it or are in the correspondingly monitored image area. The selection or selection (even pre-selection) of an SEE 6 is confirmed independently of the selection and subsequently by the user, in particular by activating a CD 14;24. This process is monitored by the SMU 11;21 as a necessary condition for initiating the relevant safety-related actions, for example via a separate channel 11D for this purpose.

[0100] 4A-4B show a schematic representation of a preferred embodiment and architecture of a SIL-compliant or SIL-capable SMU 21, 21', for example for the concept according to FIG. 2B. The description in FIGS. 4A-4B is partly designed as a signal flow diagram illustrating a preferred mode of functionality. The SMUs 21, 21' are implemented as independent modular hardware on their own circuit boards or printed circuit boards with an interface for connecting image data lines from the PC 1 on the input side, and at least one interface for connecting a corresponding input device such as a mouse 4, as well as for connecting a confirmation device (CD) 14, for example a secure button. On the output side, the SMUs 21, 21' have an interface for transferring image data to the display 2 via image data lines 3, and at least one data output or further interface for a data channel IC, for example for communication with the PC 1. A common interface can be selectively used for the mouse 4 and the data channel 11C. Still further, a connection to a secure computer 7 (FIG. 2B) or the like can be provided. The image data is preferably transmitted via a dedicated channel 3.

[0101] The SMU 21 in Fig. 4A-B has a two-stage cascaded architecture with two at least logically independent units or computing components 41, 42, which can be selectively designed in the form of shared hardware, e.g. integrated circuits. On the other hand, an embodiment with two physically independent computing components 41, 42, in particular a first FPGA 41 and an independent second FPGA 42, is preferred. The computing components, i.e. FPGAs 41, 42, are used in particular for computer processing of image data and for calculating check codes. The first FPGA 41 has an input for image data from the PC1 and an output for image data to the display (LVDS transmitter). The second FPGA 42 has only one input for image data, meaning that it cannot change the display.

[0102] The functioning of the FPGAs 41, 42 is controlled and complemented by a processor arrangement 50 of suitable design, which is connected for signaling purposes to said inputs and to the two FPGAs 41, 42. The processor arrangement 50 is a component of the SMU 21 and can be designed to have one or more channels, for example two channels, as explained below with reference to Figs. 5A-5B. The processor arrangement 50 can then implement a suitable X-out-of-Y approach according to IEC 61508 in conjunction with the image processing computing components 41, 42, in particular the test functions of the computing components 41, 42. For example, Fig. 5B shows a 2oo2 approach, which by redundant processing does not guarantee GUI functionality in case of failure of both systems first, thus giving increased safety and high availability. Thereby, the processor configuration 50 can be configured for other voting approaches, for example simply as a single channel (1oo1) for redundant processing with cross-diagnosis (1oo2), as a 1-out-of-3 voter (1oo3) or as a 2-out-of-3 voter (2oo3), depending on the safety and availability requirements. For example, depending on the design, a fail-safe can be enabled, in which case after a recognized display failure the GUI2A is first transferred to a safe operating mode with reduced functionality, and the GUI2A is only switched off for a recognized double failure, for example as shown in FIG. 5B. Thus, on the one hand, depending on the requirements, a two-stage architecture with two at least logically independent units, i.e. computing components 41, 42, is not mandatory. A single-stage or single-channel design with only one image processing stage 41 for safety-oriented verification of image data, especially when the cursor 5 is indicated by the display computer 1, is alternatively possible.

[0103] A preferred software implemented or computational functionality of SMU 21 will now be described with reference to FIG. 4A.

[0104] The processor arrangement 50 receives the relative coordinates from the mouse 4, generates pointer coordinates based thereon, and monitors or recognizes from the pointer coordinates whether a selection of SEE6 is present in the GUI 2A. If not present, the processor arrangement 50 communicates the pointer coordinates or relative coordinates and optionally a mouse button interrupt to the PC1 via the data channel 11C. Based thereon, the PC1 controls the GUI or its representation in image data to the display 2 in a conventional manner. Alternatively, the relative input signal of the mouse 4 may be sent in parallel to the PC1 and the SMUs 21, 21'.

[0105] Furthermore, the processor arrangement 50 controls the first FPGA 41 such that said FPGA 41 generates a cursor 5 in the image data for display, for example by displaying or overwriting the image data according to pointer coordinates continuously determined by the processor arrangement 50. In this case, it may be provided that the PC1 does not display the cursor 5 in the GUI, or that the PC1 itself displays the cursor only in unimportant areas, while the first FPGA 41 only displays the cursor 5 in important areas of the graphics for the GUI2A.

[0106] Alternatively or additionally, a test method according to US Pat. No. 5,999,336 may be performed for the safety of the mere display of safety-critical information by one or both of the FPGAs 41, 42 for monitored areas of the displayed GUI graphics, for which purpose parameters relating to the monitored image areas having, for example, a mere display function (and no control elements) are supplied to the SMU 21, for example from a secure computer.

[0107] If the processor arrangement 50 recognizes the presence of a selection of a SEE 6 by comparing the continuously determined pointer coordinates of the cursor 5 with the predetermined or pre-stored image coordinates of the SEE 6, more precisely of the corresponding monitoring area, the FPGAs 41, 42 can be switched into a selection monitoring mode. Alternatively, the FPGAs 41, 42 can perform such monitoring continuously or continuously, in each case being limited to the respective monitoring area, particularly with respect to a significant SEE 6 in the graphics.

[0108] For image data received on the input side from the insecure PC1 by the SMU 21, 21', the FPGA 41 generates check codes in a first functional block CRC1 using a suitable coding algorithm, for example the CRC method, for image data corresponding or corresponding to the SEE6. The successively generated codes from the functional block CRC1 are compared by the processor arrangement 50 with pre-stored reference or subject codes from the memory 55 for one or, alternatively, several SEE6s. On the input side, this ensures that the supposed SEE6 has been correctly displayed by the PC1 and is not affected by the display of the cursor 5 with a variable position. Only in a later signal flow does the FPGA 41 display the cursor 5 in the image data in the functional block 43 at a position according to the current pointer coordinates, for example by overwriting or superimposing. In the functional block CRC2, the FPGA 41 generates further pointer-related check codes for the area of ​​the image data corresponding to the current display of the cursor 5. In an additional functional block CRC4, the FPGA 41 further generates a "pointer-free" check code for a surrounding area of ​​the image data without the display of the cursor 5, e.g. the difference between the cursor area and the SEE image area for CRC2, or on the other hand the difference between the area for CRC2 and beyond up to the entire display of the GUI. To generate the "pointer-free" check code CRC4, a check code CRC4 is calculated for a difference or a remaining amount of pixels in the monitored image area, e.g. pixels representing the entire GUI2A (amount A) and an amount of pixels representing the cursor 5 (amount B), which means that amount A without amount B, i.e. pixels for the cursor 5, are not included in the difference amount. Other suitable methods can also be used as algorithms for the check code, i.e. in addition to the CRC checksum.

[0109] The image data correspondingly modified by the FPGA 41 by displaying the cursor 5 are output from an output of the FPGA 41 to the display 2 via the image data line 3. These modified image data are then fed in parallel to a second logical or physical stage, in this case a second FPGA 42 which, unlike the FPGA 41, is connected to the image data line 3 via only one input. The second FPGA 42 re-overlays the display of the cursor itself according to the current pointer coordinates of the processor arrangement 50 in an identical manner to that of the first FPGA 41, but these data are not output. In the functional block CRC3, the FPGA 42 generates a further pointer-related check code for the area of ​​the image data which corresponds to the currently displayed representation of the cursor 5 by the FPGA 42 in a similar manner to the CRC2 in the FPGA 41. In the functional block CRC5, the FPGA 42 forms a further pointer-free check code (see above) for the surrounding area of ​​the image data without displaying the cursor 5, i.e. for the amount of difference of the relevant pixels which corresponds to the CRC4 in the FPGA 41.

[0110] The check codes calculated in the program stages, more precisely in the blocks CRC2, CRC3, CRC4, CRC5, are evaluated and in particular compared in a security-oriented manner by the processor arrangement 50. For this purpose, the processor arrangement 50 compares the pointer-related check codes CRC2 and CRC3 with one another in a comparator or function block 53 for fault detection purposes, i.e. to verify and ensure that the cursor 5 has been correctly displayed by the FPGA 41. Furthermore, the processor arrangement 50 compares the pointer-free check codes CRC4 and CRC5 with one another in a comparator or function block 53 for fault detection purposes, i.e. to verify and ensure that the display of the cursor 5 or the modification of the image data in the FPGA 41 does not cause any useless or unwanted changes in other screen areas of the GUI. If one of the comparison levels indicates a deviation based on CRC1, CRC2 or CRC4, activation or release of the safety-critical function of the SEE6 is prevented or not allowed, and optionally the failure is indicated to the user by further image data modification (e.g., by making the SEE6 invisible). Only if all safety-oriented tests or comparisons are positive, the processor arrangement 50 employs a user-controlled input in the secure CD 14, which is recognized as an approval of the safety-related action associated with the respective SEE6, especially during the period of the selection to be displayed. The SMU 21 initiates this function or action only if the selection is verified as correct, in this case by an output from the processor arrangement 50 via a suitable interface to the secure system, e.g. the secure computer 7 or, e.g., the system controller. The processor arrangement 50 generates a voter, preferably a 2oo2 voter as described above, but this is not essential.

[0111] A two-tier or two-channel architecture with a second FPGA 42 controlled and read out independently of the processor arrangement 50 in this case allows a reliable display of all safety-related GUI functions, in particular also the display of the cursor 5 by the first FPGA 41. Contrary to the PC1, the monitoring module, i.e. the SMU 21, can be SIL-capable or SIL-compliant and in particular safety-certified.

[0112] The SMU 21' in FIG. 4B has the same design and function as possible as described with respect to FIG. 4A, but differs in particular in that the image data communicated from the PC1 to the SMU 21' is directly fed to the two FPGAs 41, 42 on the input side, i.e. the FPGA 42 cannot be influenced by the output of the FPGA 41. On the other hand, the check functions for safety purposes can be performed identically or equally. In particular, in this case, by comparing the check codes from CRC2 and CRC3, it is also guaranteed or verified that the cursor 5 has been displayed by the FPGA 41 as expected. In both cases, the display and the encoding can be performed in particular continuously and synchronously with the image data, for example for each new screen. In both embodiments, if the selection based on the position of the cursor 5 has been recognized by the processor arrangement 50 and, optionally, the correct display of the SEE6 has been determined by CRC1, both of which are prerequisites for the subsequent authorization, the encoding according to the levels CRC2...CRC5 can be performed thereafter only if necessary.

[0113] On the other hand, as a variant of the aforementioned functionality, it may also be provided that the cursor 5 is shown by the display PC1, in particular as long as the pointer position is outside a preconfigured graphics-related or pixel-related input area (EB) of a predefined area of ​​interest for the SEE6. The SMU 21;21' simultaneously reports whether the cursor 5 is located in image coordinates inside or outside the EB, for example by transmitting the pointer coordinates to the PC1 via channel 11C. In view of this response, optionally, the PC1 is requested to hide the cursor 5 if a selection is present (pointer coordinates are within the EB). If its coordinates are within the EB, the SMU 21;21' itself may additionally visually highlight the associated EB, for example by a change in color or by selectively hiding the cursor 5. This mode of operation may be verified in a secure manner, as described above. It is advantageous if the cursor 5 is directly displayed or the selection is highlighted by the secure SMU 21;21', so that the image data generated by the PC1 without the cursor 5 or highlighting can be more easily verified for correctness, in particular with regard to the correct representation of all SEEs or EBs.

[0114] Fig. 5A shows a further preferred architecture for a monitoring module, i.e. SMU 21, for example according to Fig. 4A, with a two-channel embodiment of a voter arrangement, i.e. processor arrangement 50, with two independent controllers, i.e. processors 51, 52. The processors 51, 52 perform all the relevant control and verification functions as described above with respect to Fig. 4A in order to discover irregular fault-related behavior with respect to higher safety requirements, doubly and independently in each case, and generate a 2-out-of-2 voter using the FPGAs 41, 42 as verification encoders. For this purpose, each of both processors 51, 52 is connected to the two FPGAs 41, 42 for signaling purposes and verifies each other independently for proper and correct functioning (two-channel concept). An external interface 61 for a relative pointing device, e.g. mouse 4, and in particular for a safety button 4, may be implemented as a separate component or may be integrated into the processors 51, 52.

[0115] 5B shows a further, preferably serial, two-channel architecture for the monitoring module 80. The monitoring module 80, despite the above-mentioned functionality for secure input, is also considered as a further development of the teachings in US Pat. No. 5,399,433, which is essentially used for monitoring a secure representation of input parameters (optionally, without the input functionality) and should be considered as essential to the present invention.

[0116] The input parameters to be monitored can be provided, for example, by the secure computer 7 to the monitoring module 80 via an interface 70 .

[0117] The FPGA 41 generates check codes for one or more graphics-related predefined monitoring areas for safety-critical display. Each of the check codes CRC1.1 and CRC1.2, each determined by one of the two FPGAs 41 or 42, is independently compared with a predefined reference value corresponding to an input parameter, which is prestored as a reference value for the respective input parameter, for example during configuration, in a two-channel embodiment of the processors 51, 52. The reference value for comparison may be determined as a reference code based on the input parameters, for example using a look-up table, or the current input parameters are compared with a reference parameter recovered from the determined code, for example using a look-up table. Regarding further functions, in particular the generation of check codes for monitoring areas, the teachings in the patent application WO 2005 / 023363 are incorporated here with reference to FIG. 5B.

[0118] A two-stage and preferably also two-channel hardware embodiment for the FPGAs 41, 42 corresponds to Fig. 4A. In this case, the second FPGA 42 is again connected to the image data line 3 via an input only (read-only connection), i.e. it cannot modify the image data while the upstream first FPGA 41 is reading it (e.g. as an LVDS receiver) and it will selectively transfer it without modification (e.g. as an LVDS transmitter).

[0119] With the monitoring module 80 according to FIG. 5B, two functions in particular that are advantageous from a safety point of view can be implemented, allowing higher safety integrity levels, for example SIL-3 and above.

[0120] On the other hand, visual fault detection for safety purposes, in particular by the FPGA 41 using image data corrections by non-display or display (for example switching to white) or other indications visible to the user in the image data at the output of the FPGA 41, can be verified by the second FPGA 42 in case of faults detected using the check code method. In this case, the FPGA 42 verifies the assumed graphics fault detection in case of a fault that is assumed to be generated in the image data at the output of the FPGA 41 by a correspondingly assumed representation, for example using the check code method, by generating a check code for the graphics fault indication. The graphics fault indication or fault detection can be verified by the FPGA 42 performing the same functions as the first FPGA 41, which indicate the image data corrections for image data that are recognized as defective, i.e. in this case the FPGAs 41, 42 also form a two-channel arrangement for verifying and correcting image data. On the other hand, the FPGA 42 may generate pre-stored code corresponding to the expected or target behavior of the image modification by the first FPGA 41 without redundantly repeating the image modification in the FPGA 42 .

[0121] A comparison is made with the check codes from the FPGA 41, 42 with the corresponding object values ​​or object codes. This comparison is re-run independently in both processors 51, 52 via the two channels to increase safety. This ensures a correct fault detection or a fault detection in a manner that is visible to the user. The fault detection and cross-validation is preferably limited to the respective predefined monitoring area and in each case limited with respect to it, so that the rest of the display remains unaffected. If this cross-validation of the fault detection with the FPGA 42 does not yield a positive result, safety-oriented measures can be taken, for example, turning off the display or switching it to a non-safe mode. As a result, the system provides higher safety, since two different ways are provided to avoid an inappropriate display of safety-critical information. Selective fault detection for the individual monitoring areas first increases the level of availability, for example by hiding, displaying or marking as faulty (incorrect) by the first FPGA 41. This is because the further verified safety-critical image areas that are selectively displayed as correct are not affected. A second method for ensuring a fail-safe operation is realized in this case on the basis of a second stage with an additional FPGA 42 interacting with the processor arrangement 50. If the first method does not selectively signal a fault in the monitored image area as envisaged, this result is signalled by the second FPGA 42, for example so that the entire display can be switched off by a voter or by the processor arrangement 50. A 2oo2 voter such as a processor arrangement is also advantageous for this purpose. In particular due to these two independent fault detection methods, the monitoring module 80 can guarantee a safety integrity level SIL-3, since a fatal double fault can be excluded. Furthermore, at least the second method in the monitoring module 80 can also be implemented by a two-channel design and / or in various ways.

[0122] Additionally or alternatively, with regard to increasing the accuracy of the monitored display areas, which is performed by the FPGA 41 as envisaged by the image data correction, the second FPGA 42 can also perform this verification. In this case, the visual emphasis and / or indication can be performed in various ways, for example by displaying an underlying graphical frame or a graphic symbol, icon or widget that allows the user to recognize which areas of the current drawing of the display 2 are actually monitored by the monitoring module 80 or are verified by the monitoring module 80 in a safety-critical manner. For this purpose, the second FPGA 42 can also generate a check code for the image data at the output of the FPGA 41, for example for the monitoring areas including the envisaged graphical emphasis, which check code is likewise compared independently and selectively via two channels in both processors 51, 52 with corresponding object values ​​or object codes. Thus, in this case, the FPGAs 41, 42 can generate two different check codes for each monitoring area, a first check code for the image data of the monitoring area without an indication of being monitored and a second check code with an indication of being monitored. Subject to a suitable coding algorithm, for example with a large Hamming distance, the coding of the two channels is realized simultaneously in relation to the original image data generated by the PC1 as a result. Corresponding predetermined comparison data are stored in the voter and / or processor arrangement 50 for the first and second check codes (see CRC1.1 and CRC1.2), which data correspond to the valid cases, i.e. the correct representation of the initial parameters according to the first verification code and the correct display with highlighting of the monitored area according to the second check code. In this way, the monitoring of the respective image area reliably recognized as active by the second FPGA 42 and the processors 51, 52 may be output, for example, to a secure computer 7.

[0123] Furthermore, the monitoring module 80 itself can generate in a secure manner a visual indication of the operating mode in which it is operating, for example with active monitoring (secure) or inactive monitoring (unsecure). This can also be done by image data modification by the first FPGA 41 and safely cross-verified via the proposed architecture with the second FPGA 42 and preferably two processors 51, 52. A status indication by the monitoring module 80 is particularly advantageous when the GUI is intended to display screen masks according to different modes or different contexts.

[0124] The monitoring module 80 allows essentially any kind of desired changes to be performed in a secure manner on the image data generated in an insecure manner by the PC1. This is realized in a first stage by being able to modify the image data, for example in the FPGA 41, and in a second stage for verification of the image data modification by the first stage, for example by the second FPGA 42. Both computing components used for this purpose, for example FPGAs 41, 42, can also implement a two-channel monitoring function, in particular for critical image data as described above, but this is optional.

[0125] This two-stage embodiment can also be realized by a single integrated circuit, e.g. a single FPGA, or by a single processor with a logical, more precisely virtual, division or separation into two stages of computing components or modules. However, a two-channel embodiment with two actual hardware-based computing components, e.g. FPGAs 41, 42, is advantageous. In this case, various kinds of components with design diversity, e.g. FPGAs 41, 42, can be used to minimize the risk of system failure, e.g. failure of a common core. The same applies to the processors 51, 52.

[0126] Similar two-channel voter embodiments of the processors 51, 52 are galvanically isolated from the FPGAs 41, 42, preferably by isolation components, for higher safety, so that a physically separate processor area 50 is provided on a common printed circuit board of the monitoring module 80.

[0127] For validation purposes, a full two-channel architecture for the monitoring module 80 having two computing components 41, 42 for image data encoding and two processors 51, 52 for functional control and operation performing identical functions with respect to image data modification for test purposes--e.g. as described above--is particularly advantageous with respect to fault limitation and fault detection. Preferably, at least both processors 51, 52 each have independent or at least non-reactive resources such as power supplies, clocks, signal paths, etc.

[0128] Figure 6 shows, in schematic form, a secure display device 60 for displaying pixel graphics, in particular having a TFT panel, for example with an SMU 21 integrated into the device according to Figure 4A. Computer-generated image data is transferred to the SMU 21, optionally after conversion from a signal format adapted for PC displays such as HDMI to LVDS by an existing monitor controller, and from there output to the TFT controller of the display device 60.

[0129] The display device 60 also has an integrated special interface module or gateway 61 connected to the SMU 21 via a bidirectional data connection, so that only one connection is needed for this purpose on the SMU 21 and the gateway 61 is configurable according to the application. The gateway 61 in FIG. 6 has a connection for the COTS input device 4 and a corresponding output for connection to the PC1 (not shown in FIG. 6) for non-secure display, e.g. a USB connection, via which the relative coordinates are transferred to the PC1 for controlling the GUI or operating the PC1. In parallel, the gateway 61 supplies the relative coordinates to the SMU 21, in particular for displaying the cursor 5, as described above. The gateway 61 has an input for the verification device, i.e. the CD 14, and among other things provides a logically secure channel between the verification device 14 and the SMU 21. Furthermore, the gateway 61 provides an interface for safety communication via a secure industrial bus, e.g. PROFINET or also the PROFISafe protocol, in particular for the purpose of transmitting safety commands or information or, e.g., safety commands generated by the SMU 21 itself based on a validation input on the CD 14.

[0130] In addition to the secure input functionality according to the present invention, the SMU 21 can also implement secure display and / or absolute input devices according to the concepts in U.S. Patent No. 6,399,633, such as secure input using a capacitive touch device according to U.S. Patent No. 6,399,633. For the sake of brevity, the teachings of both the latter and former documents are incorporated herein in their entirety.

Claims

1. 1. A method for safety-related input on a graphical user interface, comprising: a computer generating image data for display and including an input device for controlling the graphical user interface, the method comprising: transmitting the computer-generated image data from the computer to the display over an image data line; displaying the graphical user interface on the display with at least one graphical control element selectable in a user-controlled manner using the input device; a monitoring unit connected to the image data line and reading at least a portion of the image data for a safety function; - said monitoring unit is supplied with input information coming from said input device, and in response to said input information said user-controlled selection of said control element is recognizable by said monitoring unit; - said monitoring unit is connected to a confirmation device for receiving said user-controlled confirmation via a secure signal path; - the monitoring unit ensures and / or verifies that the recognized selection of the control element is correctly represented in the image data provided to the display; - the monitoring unit releases or initiates a safety-related control command associated with the control element upon receiving a confirmation by the user control during the displayed selection of the control element; A method characterized by:

2. the monitoring unit modifies at least a portion of the image data intended for display in a predetermined image area associated with the control element, and the monitoring unit correspondingly forwards the modified image data to the display, whereby the monitoring unit ensures that the image data provided to the display correctly represents the selection of the recognized control element; the modified image data represents a pointer responsive to the input information; and / or the modified image data provides a visual enhancement of a selection for the user in the predetermined image region of the display; and / or the modified image data is superimposed on the computer-generated image data in a specific area; 2. The method of claim 1 .

3. 2. The method of claim 1, wherein the computer-generated image data represents a selection of the control element, and the monitoring unit verifies that the image data supplied to the display correctly represents the recognized selection of the control element by calculating a check code for the image data intended to be displayed in a predetermined image area associated with the control element and comparing the check code with at least one pre-stored reference code.

4. the input information is transmitted from the input device via the monitoring unit to the computer for display, or transmitted via the computer for display to the monitoring unit; 3. The method of claim 1 or 2, wherein the monitoring unit releases or initiates a safety-related control command associated with the control element and outputs the control command via the safe signal path.

5. the monitoring unit comprises a first computing component to which the computer-generated image data is provided at an input, and which, in response to a selection of the safety-critical control element, modifies the image data to visually emphasize the selection, and transfers the image data to an output for display; and the monitoring unit comprises a second computing component used to verify the output image data of the first computing component; 3. The method of claim 2.

6. 6. The method of claim 5, wherein the first computing component calculates a first level check code for the computer-generated image data intended to be displayed in the predetermined image area, and the monitoring unit compares the first level check code with at least one pre-stored reference code for the predetermined image area, and the first computing component calculates the first level check code for the computer-generated image data on the input side in a first step, and then modifies the image data in a second step.

7. - the first computing component calculates a first second-level check code for the image data modified by the first computing component intended for display in a given image area; - the second computing component calculates a second second-level check code for the image data at the output of the first computing component intended for display in a given image area, - the monitoring unit compares the first second-level check code and the second second-level check code with each other to verify that a selection has been highlighted as intended by the first computing component; each of the computing components calculates a third check code with respect to the image data of the predetermined image area without selection, which the monitoring unit compares with each other in order to verify that the display of the control element is as intended; and / or - one or more of the computing components calculate the check codes for the image data for the predetermined image area associated with the control element only when selection of the control element is recognized.

7. The method according to claim 5 or 6.

8. the first computing component modifies the image data for visual emphasis of selection such that the selected control element is displayed in a selected second state visually distinguishable from an unselected first display state by displaying a frame or changing color; and / or The first computing component outputs or transmits the modified image data in an image data stream along with the computer-generated image data for display.

8. The method according to any one of claims 2 and 4 to 7.

9. a pointer is displayed on the display for controlling the graphical user interface; the pointer is generated exclusively by the monitoring unit by image data modification in the monitoring unit, enabled based on the input information provided to the monitoring unit, the input device being directly connected to the monitoring unit and forwarding the input information to the computer for display, or the pointer is generated by the display computer outside of all predetermined image areas, and when a selection of a safety-critical control element is recognized by the monitoring unit in the respective associated image area by image data modification in the monitoring unit, the computer-generated pointer is not displayed, and the input device is directly connected to the display computer, which forwards the input information to the monitoring unit; and / or - in each case, for N successive image periods of the image data, the pointer is displayed by the computer or the monitoring unit only for m, less than N, of the image periods, and / or the input information represents absolute or relative coordinate information, 9. The method according to any one of claims 1 to 8.

10. A monitoring unit for monitoring a graphical user interface, comprising: - a digital image data interface for connection to an image data line for transmission of computer-generated image data from the computer to the display; at least one computing component that performs security functions and reads at least a portion of said image data through said digital image data interface; a device interface for inputting information based on an input device for user-controlled selection of graphical control elements; Equipped with - the monitoring unit comprises a physical verification input for a security verification device; at least one said computing component is configured to ensure and / or verify that the recognized selection of said control element is correctly represented in the image data provided to said display; and - the monitoring unit is configured to output relevant safety-related control commands during the displayed selection of the control element in response to receiving a confirmation input via a confirmation interface; A monitoring unit characterized by:

11. at least one said computing component is configured for image data modification and / or for calculating a check code from said image data, - the monitoring unit comprises at least one memory for specifying predetermined image areas and / or reference codes; and / or - the monitoring unit comprises a controller component for the input device, the controller component being connected to the device interface for direct connection of the input device to the monitoring unit; 11. The monitoring unit of claim 10, wherein the monitoring unit comprises a data interface for transmitting the input information to the computer.

12. To monitor a graphical user interface according to the method defined in claim 2, The monitoring unit is a two-stage computer architecture in two specific channels, a first computing component configured to receive the computer-generated image data at an input, modify at least a portion of the image data intended for display in a predetermined image area in response to a safety feature, and provide the image data at an output for the display; and a second computing component configured to validate the image data provided by the first computing component by calculating a check code for the image data intended to be displayed in a predetermined said image area; 1. A computer architecture comprising:

11. A monitoring unit according to claim 10, characterized in that the monitoring unit is configured to compare the calculated check code with at least one pre-stored reference code in order to verify that the emphasis by the first computing component is as intended and / or to initiate a response for safety purposes.

13. 13. The monitoring unit of claim 12, wherein the first computing component is configured to calculate, for the computer-generated image data intended for display in the monitored area, the check code for safety comparison with at least one pre-stored reference value for the monitored area, the first computing component first calculating the check code on the input side for the computer-generated image data and subsequently correcting the image data in a second step, and the first and second computing components are implemented by two independent integrated circuits of different designs.

14. 14. A monitoring unit according to any one of claims 10 to 13, wherein at least one computing component having a safety function computes and generates a respective check code for a selected image area, and a voter arrangement is connected to said computing component for comparing the generated check code with pre-stored reference data.

15. 15. The monitor unit of claim 14, wherein the voter configuration is implemented as a two-channel processor circuit, 2oo2 (2-out-of-2) voter.

16. A monitoring unit as described in claim 12 or 13, characterized in that the second computing component is configured to receive the image data on its input side and, depending on a safety function, to redundantly modify at least a portion of the image data in the same manner as the first computing component, the first computing component is configured to calculate a first check code with respect to the modified image data, the second computing component is configured to calculate a second check code with respect to the redundantly modified image data.

17. 17. A monitoring unit according to any one of claims 10 to 16, characterized in that a module for communication for safety purposes via a bus interface in the form of a safety interface for the output of the control commands relating to safety is connected to or integrated in the monitoring unit.

18. The monitoring unit is configured to carry out a method having at least one feature of any one of claims 2 to 9, 17. A monitoring unit according to any one of claims 10 to 16, characterized in that the monitoring unit is connected to a safety interface for outputting safety-related control commands.

19. 1. A system for safety-related input in a graphical user interface, comprising: a computer; and a display for pixel graphics connected to the computer via an image data line; A monitoring unit according to any one of claims 10 to 18, physically separated from the computer; An input device; a safety confirmation device; - the input device for operating the graphical user interface is directly connected to the device interface of the monitoring unit; The independent safety verification device is connected to a physical verification input of the monitoring unit. system.

20. 1. A display device for displaying pixel graphics having a TFT panel, comprising: at least one connection to an input device connected to the device interface of a monitoring unit according to any one of claims 10 to 18 integrated in said display device; a connection section for a safety confirmation device connected to the confirmation input section of the monitoring unit.

Images