Improvement of operational readiness of a control device

Abstract

The invention relates to a method (100) for operating a control device (10) having at least two independently operable data processing devices (12), which are preferably part of a system-on-chip system (14), for controlling a system (16) having high security requirements. In the method (100), an interruption of an energy supply of the control device (10) is provided (101) for operational reasons. In addition, an output signal of the control device (10) is output (102) during an active switching state (A) of the energy supply. Furthermore, each of the two data processing devices (12) carries out (104) at least part of a test routine relating to its own functionality and / or a functionality of the control device (10) during an active switching state (A) of the energy supply. In addition, a time at which said test routine is successfully carried out is stored (106) and a time interval is determined (108), within which this test routine is not required after said test routine has been successfully carried out (104).

Description

[0001] 202416606

[0002] 1

[0003] Description

[0004] Improvement of the operational readiness of a control device

[0005] The invention relates to a method for operating a control device, a control device for carrying out the method, a computer program and a computer-readable medium.

[0006] To control systems with high safety requirements safely and reliably, and / or to provide a fault-tolerant control system, two independently operable data processing devices are often used. This improves fault tolerance through redundancy. During a power-up test of the data processing devices, they are checked for single faults, multiple faults, identical double faults, and / or systematic faults. Such tests are typically very time-consuming and must be performed before the data processing devices are put into safety-critical operation.

[0007] Following a successful power-on test, further test routines are scheduled during operation of the data processing equipment to achieve predetermined safety objectives. For example, test results, operating results, and / or memory contents of the data processing equipment are compared during operation. However, such test routines can currently only be performed thoroughly and completely if the data processing equipment is supplied with electrical power until each test routine is successfully completed. As soon as the power supply is interrupted, a test routine typically restarts. This poses a problem for applications where a continuous power supply for operation is not available.Following a power supply interruption, the time-consuming and extensive restart test is usually initiated immediately. However, during regular, operationally caused interruptions, only a small portion of the test routine is performed, and even then, it is usually the same part. Other parts of the test routine can rarely, if ever, be carried out. This often results in parts of the data processing equipment remaining permanently untested. Consequently, the established safety objectives cannot be met with sufficient reliability.

[0008] An application in which energy is not permanently available for the purpose of operating redundant data processing devices concerns, for example, a replacement of 202416606.

[0009] 2

[0010] Signal lamps are replaced by LED signal transmitters in a railway signal. Conventional signal lamps in railway signals are controlled, among other things, by flashing. This is achieved by activating or interrupting a power supply. If these signal lamps are to be replaced by LEDs, an analog control system is generally retained, and only the signal lamp is replaced by the LED. However, to monitor and correctly control the LED itself, an additional control device is required, which, for example, monitors and controls the emitted light intensity of the LED. Due to the analog control system, this control device only receives electrical energy during periods when the power supply is active, in order to perform its test routines.To ensure a high level of functional safety for the control device, a specially designed, application-specific electronic circuit has been used. However, this circuit has disadvantages regarding the synchronization of the required processing channels of the data processing devices. This can lead to limitations in functional safety and / or availability.

[0011] The object of the present invention is to provide a method by which a high functional safety of a control device for controlling a system with high safety requirements can be provided in a simplified manner.

[0012] This problem is solved by a method having the features of claim 1.

[0013] Furthermore, the invention is based on the objective of providing a control device for carrying out the method.

[0014] This problem is solved by a control device having the features of dependent claim 13.

[0015] Furthermore, the invention is based on the objectives of providing a computer program and a computer-readable medium.

[0016] These tasks are solved by a computer program having the features of claim 14 and by a computer-readable medium having the features of claim 15.

[0017] Advantageous further training courses are each the subject of dependent sub-claims. 202416606

[0018] 3

[0019] The method according to the invention is provided for operating a control device with at least two independently operable data processing devices. Preferably, the at least two independently operable data processing devices are redundantly configured.

[0020] Data processing devices. A system with high security requirements is controlled by means of the control device. The at least two independently operable data processing devices are preferably part of a single-chip system of the control device.

[0021] The requirement that at least two data processing devices be independently operable shall be understood to mean independent operation as defined in EN 50129, IEC 61508, and / or IEC 61511. The data processing device may be, for example, a microcontroller, a processor, or another programmable hardware component. The data processing device is expediently configured to read, receive, write, transmit, and / or manage data. It is particularly preferred that the data processing device be integrated as part of the system-on-a-chip.

[0022] The fact that the system is linked to a high safety requirement means, in particular, that a predetermined safety requirement level, in terms of functional safety, is to be achieved in accordance with a predefined safety objective. Preferably, this safety requirement level is a safety requirement level according to the standards IEC 61508, EN 50129, and / or IEC 61511.

[0023] The method according to the invention provides for an interruption of the power supply to the control device due to operational requirements. It also provides for an output signal from the control device to be issued during an active switching state of the power supply. Furthermore, it provides for each of the at least two data processing devices to perform at least part of a test routine concerning its own functionality and / or the functionality of the control device during an active switching state of the power supply. During the active switching state of the power supply, the control device is supplied with electrical energy. It is also provided for the time of successful execution of the aforementioned test routine to be stored. In addition, the method according to the invention 202416606

[0024] 4

[0025] The method proposes that a time interval is determined during which, after successful execution of the aforementioned test routine, its execution is omitted. Successful execution of a test routine, in this context, is understood to mean that the test routine has been executed up to a predefined state, preferably completely, and has been completed with a positive result. Advantageously, the test routine can be continued from the predefined state in a predetermined manner. Therefore, successful execution of the test routine can be assumed if the test routine has been executed with a positive result up to a reset point.

[0026] In this way, test routines can be reliably performed despite operational, regular interruptions to the power supply. The need for repeated restarts and subsequent terminations of a predetermined test routine can therefore be avoided. Furthermore, this enables rapid commissioning of the control device in the event of a planned power supply interruption. The functionality and / or reliability of the control device can thus be reliably and cost-effectively verified. Additionally, the startup time required to achieve operational readiness following initial commissioning can be reduced. Rapid operational readiness with high functional reliability and / or availability is therefore achievable.In a specific application example, the blinking operation of an LED can be implemented using a single-chip system based on an analog control of the system's power supply. Existing systems with high safety requirements can be upgraded with improved technology cost-effectively. Application-specific solutions can be avoided. Instead, generic, secure single-chip systems can be used to control systems while adhering to high safety requirements. This minimizes development effort. Furthermore, this approach opens up diverse application possibilities while maintaining high safety standards. Reusability of used single-chip systems can also be provided. This enables the provision of reliable interim solutions that offer a high level of functional safety.Furthermore, a single-chip system can enable higher quality in terms of architecture and / or implementation of a chip design compared to application-specific solutions.

[0027] An advantageous further training program stipulates that the aforementioned time interval is used according to a predetermined security goal based on a failure analysis, such as a 202416606.

[0028] 5

[0029] The reliability of a technical system and / or plant is determined using a Markov chain or fault tree analysis. Fault tree analysis is a method used to perform a reliability analysis of a technical system and / or plant. It is generally based on Boolean algebra and serves to determine the probability of a system, system components, or plant failure. The international standard for performing fault tree analysis is IEC 61025. In English, fault tree analysis is known as "Fault Tree Analysis." Fault tree analysis makes it possible to reliably determine the time interval within which a predetermined test routine can be omitted.Nevertheless, safety regulations and predetermined safety objectives can still be met with a high degree of reliability. This ensures efficient and reliable operation of the control device. Furthermore, this approach saves computing resources and increases energy efficiency.

[0030] Furthermore, an advantageous advanced training system provides for time recording using a real-time clock. Specifically, this real-time clock has its own independent power supply. With the help of the real-time clock, adherence to predetermined test intervals can be reliably and seamlessly achieved. Even during a deactivated switching state, in which the power supply is interrupted, compliance with a predetermined time interval for the purpose of executing the test routine can still be monitored.

[0031] In an advantageous embodiment, each of the at least two independently operable data processing devices has its own integrated real-time clock. The integrated real-time clock is particularly preferably an energy-buffered real-time clock. Alternatively or additionally, the single-chip system of the control device can include a separately implemented real-time clock module. This real-time clock module particularly preferably has its own independent power supply, such as a battery or a capacitor.

[0032] In a further advantageous embodiment, within the framework of a test routine performed as a comparative test, a real-time clock of a first data processing device of the at least two mentioned data processing devices, a second data processing device of the at least two mentioned data processing devices and / or the separately executed 202416606 is used.

[0033] 6

[0034] The time recording data from the real-time clock module is compared and verified. This allows for the verification of the reliability of the time recording data from the respective real-time clocks.

[0035] Furthermore, an advantageous refinement provides that the aforementioned test routine is divided into predetermined sub-steps. These predetermined sub-steps are then executed sequentially, based on successive active switching states of the power supply. This allows test routines to be carried out step by step and completely. In a preferred embodiment, the number of predetermined sub-steps can be aligned with a specific operating time of the power supply. This approach also ensures high accuracy and high quality in the execution of the test routine.

[0036] In another advantageous embodiment, information regarding the progress of the test routine achieved during the active switching state of the power supply is persistently stored. Preferably, persistent storage is implemented using a non-volatile electronic memory, such as a magnetoresistive random access memory (MRAM) and / or a ferroelectric random access memory (FRAM). This allows the progress information to be retained even when the switching state is deactivated. This eliminates the need to restart the test routines and allows them to resume from the point of progress reached.

[0037] An advantageous implementation variant provides that, after a deactivated switching state in which the control device's power supply is interrupted, the aforementioned test routine is continued during an active switching state following the deactivated switching state, based on the persistently stored information regarding the progress of the test routines. This avoids redundant execution of the same part of a test routine. The process flow can thus be optimized. Efficient execution of the test routines is thereby provided at a low cost.

[0038] Preferably, the test routine involves a power-on test, by means of which the functionality of each of the at least two independently operable data processing devices is verified based on a self-test. The self-test is, in particular, a self-test of the type mentioned above. This makes it possible to detect single errors, multiple errors, and / or systematic errors. (202416606)

[0039] 7

[0040] The reliability of the control device can be reliably tested in this way. Predefined safety objectives can therefore be reliably achieved.

[0041] Preferably, the test routine is used to perform a comparative test of work results, test results, and / or memory contents of at least two independently operable data processing devices. The functionality of the control device can be reliably tested during its operation. This ensures a high level of reliability for both the control device and the system being controlled.

[0042] Furthermore, an advantageous advanced training provides that a corresponding time interval is determined and assigned for each of several test routines. Within this time interval, after the successful execution of one of the several test routines, the execution of that test routine is omitted. It is also stipulated that the several test routines are executed in a sequence according to their respective assigned time intervals.

[0043] The efficiency of the process can be further increased in this way. The sequence of multiple test routines can therefore be aligned with a corresponding time interval. In particular, it can be provided that the duration for executing a test routine is predicted. Based on the predicted duration, the sequence of the test routines to be executed can then be further influenced in such a way as to avoid exceeding a predetermined time interval. The process flow can thus be further optimized.

[0044] In the preferred application, the power-on test and the comparative test are performed concurrently. Particularly preferably, a predetermined output signal is also output concurrently, based on the switching state of the power supply. In this way, predetermined parts of the power-on test and the comparative test can be performed concurrently during operation of the control device and during the output signal generation. This further increases both time efficiency and reliability.

[0045] Advantageously, the output signal of the control device is provided according to a switching state of the control device's power supply. The control device can thus be controlled according to the switching state of the power supply. In the preferred application, an LED is activated and actuated during the active switching state, which then emits a predetermined optical signal. Existing analog control devices, in which the 202416606

[0046] 8

[0047] The switching state of the power supply, which is used to control a system, can be supplemented with modernized technology in this way.

[0048] In the event of a deactivated switching state, the output signal is preferably terminated. A voltage-free and current-free state can thus be provided as a safe state. This makes it possible to achieve safe operation of the system in a simple manner.

[0049] In an advantageous embodiment, an alternating output signal is generated according to a predetermined active and deactivated switching state of the power supply. This is particularly preferred for the flashing control of an LED, especially an LED of a railway signal. Flashing operation of an LED signal can thus be implemented safely. Test routines for achieving a predefined safety objective can be reliably performed despite frequent changes in the switching state of the power supply. An LED signal of a railway signal can therefore be operated safely, in compliance with a predetermined safety requirement level, to achieve a predetermined level of functional safety.Conventional signal transmitters, such as incandescent lamps, can thus be replaced by modernized technology in a reliable manner.

[0050] The method according to the invention can be carried out by means of the control device according to the invention.

[0051] The control device according to the invention comprises a single-chip system which provides at least two independently operable data processing devices. Furthermore, the control device according to the invention comprises a power supply unit by means of which the single-chip system can be supplied with electrical energy and which is configured to control the operation of the single-chip system according to a switching state of the power supply unit. Preferably, the single-chip system is connected to the power supply unit in such a way that an output signal of the single-chip system can be controlled according to a switching state of the power supply unit. The single-chip system and the independently operable data processing devices are, in particular, the single-chip system and the data processing devices described above.In an alternative embodiment, the at least 202416606.

[0052] 9 two independently operable data processing devices may be arranged separately on a common semiconductor device.

[0053] The power supply unit is preferably a second-type control device by means of which the power supply can be activated or deactivated. Preferably, the power supply unit is permanently operational. In particular, the power supply unit is part of an object controller or a control unit of a rail system. For example, the power supply unit can be part of a central or decentralized control unit. In the preferred application, the power supply unit is designed to reduce the duration of a power supply interruption to a predetermined time. A required power-on test can therefore be carried out in a timely manner after a predetermined time interval, even without outputting a control signal via the data processing device.

[0054] Furthermore, the invention provides a computer program which, when executed, causes the control device according to the invention to carry out the method according to the invention.

[0055] Furthermore, the invention provides for a computer-readable medium. This medium contains instructions according to which the control device according to the invention is caused to carry out the methods according to the invention. Advantageously, the computer-readable medium is implemented as a CD-ROM, a DVD, a USB or flash memory, or a non-physical medium such as a data stream and / or a digital carrier signal.

[0056] The properties, features, and advantages of the invention described above, as well as the manner in which these are achieved, are explained in more detail in connection with the following description of the figures. Where appropriate, the same reference numerals are used in the figures for the same or corresponding elements of the invention. The description of the figures serves to explain the invention and does not limit the invention to the combinations of features specified therein, including functional features. Furthermore, all features specified below can be considered in isolation and combined appropriately with the features of any claim. The following figures are schematic drawings and not to scale.

[0057] It shows: 202416606

[0058] 10

[0059] FIG 1 shows an embodiment of an LED signal transmitter which is associated with high safety requirements;

[0060] FIG 2 illustrates an example of a method for operating a control device for controlling the embodiment of the LED signal transmitter.

[0061] Figure 1 shows a schematic representation of an LED signal generator 16 of a railway signal, which must meet high safety requirements. The LED signal generator 16 is controlled by a control device 10.

[0062] The embodiment of the LED signal transmitter 16 described here features an LED 20 as the light source. In this embodiment, the control device 10 is configured to control the LED 20 and monitor its light emission. For this purpose, the embodiment of the control device 10 comprises a single-chip system 14 and a power supply unit 18. The single-chip system 14 has two independently operable data processing units 12. Each of the two data processing units 12 has its own real-time clock 22, each with its own power supply for time recording. The power supply unit 18 is configured to provide electrical energy to the single-chip system 14 for operation.Furthermore, the activity of LED 20 is controlled analogously by the power supply unit 18, i.e., by activating or deactivating the power supply to the single-chip system 14. As soon as the single-chip system 14 is supplied with electrical energy, an output signal is sent to LED 20 by the single-chip system 14. LED 20 then illuminates. As soon as the power supply unit 18 interrupts the power supply to the single-chip system 14, the output signal is stopped and LED 20 goes out. In this way, the output signal of the single-chip system 14 is controlled according to the active or deactivated switching state of the power supply unit 18.

[0063] Particularly preferably, the emission characteristics of the LED 20 to be monitored are monitored and, if necessary, influenced by means of the single-chip system 14. In particular, the luminous intensity and / or color of the LED 20 is controlled and monitored by means of the single-chip system 14. Furthermore, in a preferred embodiment, the control device 10 is configured to control the LED 20 to flash based on an alternating switching state of the power supply device 18. The power supply device 18 is also preferably permanently in operation for the purpose of analog control of the single-chip system 14. The single-chip system 14 is 202416606

[0064] In contrast, LED 11 is only operational in the case of an active switching state A. Similarly, LED 20 is only operational in the active switching state A.

[0065] Figure 2 illustrates an example of a method 100 for operating the control device 10 described above for controlling the system described in the preceding context as an LED signal generator 16 of a railway signal, using a schematic flowchart.

[0066] In order to ensure a high level of functional safety during the operation of the LED signal transmitter 16, the single-chip system 14 with the two independently operable data processing devices 12 must be checked for functionality using predetermined test routines 118. The predetermined test routines include, for example, a power-on test in which self-tests of the data processing devices 12 are performed, and comparative tests in which test results, operating results and / or memory contents of the two aforementioned data processing devices 12 are compared during operation.

[0067] The example of procedure 100 described here provides that a time interval is determined for each test routine 108, within which, after successful execution 104 of the aforementioned test routines, the execution of this test routine is omitted. The aforementioned time interval is preferably determined according to a predetermined safety objective and on the basis of a fault tree analysis 108. The predetermined safety objective is, for example, a predetermined safety requirement level. Furthermore, it is provided here that several different test routines are carried out 104. For each of the several test routines, it is provided that an associated time interval is determined in the aforementioned manner 108. Furthermore, the example of procedure 100 described here provides that the respective test routines are assigned their corresponding time intervals 122.Within the specified time interval, after successful execution of a respective test routine, the execution of that test routine is omitted. Preferably, various test routines are performed in a sequence according to the respective assigned time interval and a point in time of successful execution.

[0068] Initially, it is planned that the functionality of the control device 10 will be checked during the first commissioning of the LED signal generator 16. For this purpose, an initial power-on test is provided before commissioning the LED signal generator 16. During the first 202416606

[0069] 12

[0070] During the power-on test, all scheduled self-tests concerning the system-on-a-chip 14 are performed. These include, for example, a self-test of the logic and / or memory of the two data processing devices 12 of the system-on-a-chip 14. In this way, single errors, multiple errors, and / or systematic errors of the system-on-a-chip 14 can be detected. The time at which the first power-on test was successfully performed is then stored persistently 106. For example, the time of successful execution of the first power-on test is stored using a FRAM or an MRAM 106. This allows the aforementioned time to be stored even during periods without power 106. In the example described here, a power-on test is only performed again shortly before or after the time interval determined for this purpose 108, starting from the previously stored time 106, is exceeded.

[0071] To ensure accurate time recording even during a period of interruption 101 of the power supply to the single-chip system 14, the example of method 100 described here further provides that time recording is carried out using the aforementioned real-time clocks 22 of the data processing devices 12, each with its own independent power supply 110. Furthermore, it can alternatively or additionally be provided that the single-chip system 14 includes a real-time clock module. Predetermined test intervals can thus be reliably observed.

[0072] Figure 2 further illustrates the flashing operation of the LED signal generator 16. Flashing operation of the LED signal generator 16 is achieved by the power supply unit 18 outputting an alternating switching state A, D of the power supply, i.e., an active switching state A and a deactivated switching state D in alternating sequence. In order to still be able to reliably perform the aforementioned test routines 104 during this intended interruption 101 of the power supply, the example of method 100 described here provides that the aforementioned test routines are divided into predetermined sub-steps 112. This divides the test routines relating to the power-on test and / or the comparison tests into predetermined sub-steps 112. These sub-steps are then carried out sequentially according to successive active switching states A of the power supply 104.

[0073] During an active switching state A of the power supply, the output signal is sent to LED 20 by means of the single-chip system 14 102. This is done in parallel to the output of the 202416606.

[0074] 13

[0075] Furthermore, the following test routines are carried out on the output signal 102, which cannot be dispensed with according to the determined 108 and the respective assigned 122 time interval.

[0076] Preferably, the various test routines are carried out in a sequence according to an assigned time interval 122 104. Parts of the power-on test for the purpose of determining the functionality of the data processing devices 12 can be carried out concurrently with the execution 120 of parts of a comparative test of test results, work results and / or memory contents of the data processing devices 12 during operation of the single-chip system 14 118.

[0077] During the active switching state A of the power supply, information regarding the progress of the aforementioned test routines achieved during the active switching state A is stored permanently 114. Furthermore, a time 106 is stored at which a predetermined test routine was successfully executed 104. This time 106 is stored based on the time continuously recorded by the real-time clock 22, independent of any switching state A, D of the power supply 110. Therefore, information regarding the progress of a comparative test 114, as well as information regarding the progress of a switch-on test 114, and the aforementioned times 106 are stored permanently.

[0078] To achieve a flashing operation of the LED 20 of the LED signal transmitter 16, an active switching state A is followed by a deactivated switching state D, in which the power supply to the control device 10 is interrupted 101. During this interruption, the output of a light signal by the LED 20 is also terminated 124. Furthermore, it is not possible to perform a test routine during an interruption 101 of the power supply. However, as soon as an active switching state A of the power supply is achieved, the output signal is sent to the LED 20 102. A light signal is then emitted by the LED 20 in a predetermined manner. It is also provided that, in the active switching state A, which follows the aforementioned deactivated switching state D, test routines are continued according to the determined time interval 108, based on the persistently stored 114 information regarding the progress of the respective test routine 116.Substeps of a test routine that have already been performed are therefore not repeated. Instead, further predetermined substeps of the relevant test routine are performed. Further progress achieved during the continued active switching state A is then stored again permanently. Similarly, time points 202416606 are also stored.

[0079] 14 stored 106, for which a successful execution 104 of a respective test routine was achieved.

[0080] A flashing operation of the LED signal generator 16 can thus be reliably and cost-effectively implemented, even though no power supply is available for executing test routines 104 during deactivated switching states D. During active switching states A, however, test routines are executed stepwise 104. Using the determined time intervals 108, the execution of the test routines 104 can therefore be designed efficiently. Thus, only those test routines 104 that must be executed according to the determined time interval 108 are carried out. Test routines for which the time interval from the last successful execution 104 has not yet been exceeded do not need to be executed during an active switching state A. This saves computing resources and increases the energy efficiency of the system.

[0081] Although the invention has been further illustrated and described in detail by the preferred embodiments, the invention is not limited by the disclosed examples and other variations can be derived by the person skilled in the art without leaving the scope of protection of the invention.

[0082] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identities are included.

Claims

1. 202416606 15 Patent claims 1. Method (100) for operating a control device (10) with at least two independently operable data processing devices (12), which are preferably part of a single-chip system (14), for controlling a system (16) with high security requirements, in which an interruption of the power supply of the control device (10) is provided for due to operational reasons (101); - an output signal of the control device (10) is output during an active switching state (A) of the power supply (102); at least part of a test routine concerning its own functionality and / or the functionality of the control device (10) is carried out by each of the at least two data processing devices (12) during an active switching state (A) of the power supply in which the control device (10) is supplied with energy (104); a time of successful execution (104) of the said test routine is stored (106); - a time interval is determined (108) within which, after successful execution of the aforementioned test routine, the execution of this test routine is dispensed with.

2. Method (100) according to claim 1, wherein the said time interval is determined according to a predetermined safety objective on the basis of a failure analysis, such as a Markov chain or a fault tree analysis (108).

3. Method (100) according to claim 1 or 2, in which time recording is carried out by means of a real-time clock (22), in particular a real-time clock (22) with independent power supply (110).

4. Method (100) according to one of the preceding claims, wherein the said test routine is divided into predetermined sub-steps (112) which are carried out successively according to successive active switching states (A) of the power supply (104).

5. Method (100) according to any one of the preceding claims, 202416606 16 in which, during the active switching state (A) of the power supply, information concerning a progress of the said test routine achieved during the active switching state (A) is stored permanently (114).

6. Method (100) according to claim 5, in which, after a deactivated switching state (D) in which the power supply of the control device (10) is interrupted (101), the said test routine is continued during an active switching state (A) following the said deactivated switching state (D) on the basis of the remanently stored (114) information concerning the progress of the test routines (116).

7. Method (100) according to one of the preceding claims, wherein the test routine relates to a power-on test by means of which the functionality of each of the at least two independently operable data processing devices (12) is checked on the basis of a self-test (118).

8. Method (100) according to one of the preceding claims, in which a comparative test of work results, test results and / or storage contents of the at least two independently operable data processing devices (12) is carried out by means of the test routine (120).

9. Method (100) according to any one of the preceding claims, wherein - for several test routines, a corresponding time interval is determined (108) and assigned (122), during which, after a successful execution (104) of one of the several test routines, the execution of this test routine is dispensed with; - the multiple test routines are performed in a sequence according to the time interval assigned to each (104).

10. Method (100) according to one of the preceding claims, wherein the output signal of the control device (10) is output according to a switching state (A, D) of the power supply of the control device (10) (102).

11. Method (100) according to any one of the preceding claims, 202416606 17 in which, as a result of a realization of a deactivated switching state (D), an output of the output signal is terminated (124).

12. Method (100) according to one of the preceding claims, in which an alternating output signal (102) is output according to an alternately provided active (A) and deactivated switching state (D) of the power supply, by means of which preferably a flashing control of an LED (20), in particular an LED (20) of a signal transmitter of a railway signal, is realized.

13. Control device (10) for carrying out the method (100) according to one of the preceding claims comprising: - a single-chip system (14) with at least two independently operable data processing devices (12); - a power supply device (18) by means of which the single-chip system (14) can be supplied with electrical energy and which is configured to control the operation of the single-chip system (14) according to a switching state (A, D) of the power supply device (18).

14. Computer program which, when executed, causes the control device (10) according to claim 13 to carry out the method (100) according to any one of claims 1 to 12.

15. Computer-readable medium comprising instructions which cause a control device (10) according to claim 13 to carry out the method (100) according to any one of claims 1 to 12.

Images