HMI Validation via Modified Indication Data Equivalence Check
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Human Machine Interfaces (HMIs) in rail vehicles face challenges in validating correct operation, particularly in ensuring safety-related information is accurately and completely displayed, as data processors can fail, leading to incorrect or incomplete information being displayed, which compromises safety.
Innovation Solution
The method involves modifying indication data produced by the main processor and using a safety processor to check if the modified data is equivalent to the intended information, with the same procedures used during normal operation, and enabling a modification function to enhance validation reliability, allowing for detection of failures during both validation and normal operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a special purpose validation program is used to simulate hardware and software failures, then detection of processor failures is improved, but failures of the standard program during normal operation cannot be detected
Solution Approach 1:
The validation program is executed before normal operation to pre-validate the system configuration. This preliminary execution allows the system to detect failures in the standard program logic without requiring failure simulation during actual operation, thereby covering both validation and standard program failure detection scenarios.
Solution Approach 2:
The system dynamically switches between validation mode and normal operation mode. During validation, the system executes the validation program with modified indication data; during normal operation, it executes the standard program. This dynamic approach allows the same processor to perform both validation and standard operations, detecting failures in both contexts.
2Reliability
If the same procedures are used for both validation and normal operation, then validation reliability is improved, but the effort required for validation increases
Solution Approach 1:
The validation program executes only a subset of the complete indication data set, focusing on critical safety-related information. This partial execution approach maintains validation reliability for essential functions while reducing the overall validation effort and time required compared to validating the entire data set.
Solution Approach 2:
The system extracts and validates only the critical safety-related indication data during the validation phase, separating these essential elements from the complete data set. This extraction allows focused validation of safety-critical paths without the overhead of validating all possible data, thereby improving reliability where it matters most while reducing validation effort.
3Reliability
If a modification function is added to produce modified indication data, then detection of safety processor failures is improved, but device complexity increases
Solution Approach 1:
The main processor is designed to perform multiple functions: executing the standard program during normal operation and executing the validation program during validation mode. The modification function is integrated into this universal processor rather than being a separate component, thereby improving detection capability while minimizing the increase in device complexity through functional consolidation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method of validating a correct operation of a HMI (71), i.e. a human machine interface, comprising the following steps: a) receiving input data comprising information to be indicated by the HMI (71) and supplying the input data to a first processor (69) of the HMI, and b) processing (73) the input data using the first processor (69) according to a first predetermined procedure for producing indication data which unambiguously define the way an indication device of the HMI (71) has to indicate the information, c) modifying (84) the indication data for the purpose of validating the correct operation of the HMI (71) and obtaining modified indication data, d) outputting the modified indication data to a second processor (70), e) inputting the modified indication data and the input data to the second processor (70) f) processing (76) the modified indication data according to a second predetermined procedure for checking if the modified indication data are equivalent to the information to be indicated by the HMI (71) and outputting a corresponding check result, g) deciding (77) that the validation was successful if the check result of step f) means that the modified indication data is not equivalent to the information to be indicated, wherein the first predetermined procedure and the second predetermined procedure are exactly the same predetermined procedures as being performed during normal operation of the HMI (71), when the indication data are not modified.