DE202015104887U1 - Multifunction terminal with soft key arrangement for safety-relevant operation - Google Patents

Abstract

A multifunction terminal (20; 30) for secure operation comprising: a display device having a computer unit (25; 35) for generating pixel graphics and a screen (22; 32) for displaying them; an image data line (26; 36) from the computer unit to the screen; a key softkey arrangement (23; 33) having a plurality of keys (24; 34) external to the input capture screen, wherein the function of a key is changed dynamically by the computing unit as the portion of the key (27; 37) changes in image representation can be adjusted; characterized in that; an inspection unit (28, 38) independent of the computer unit is provided and connected to the image data line (26, 36) for acquiring image data, and for detecting key actuations directly or indirectly, e.g. via the computer unit, to which the button arrangement (23; 33) is connected, the check unit, when the button is pressed, receiving or detecting a corresponding button identification; in the test unit, a first image is predefined, which assigns a range (27, 37) of the image representation according to key assignment for each key identifier; the check unit (28; 38) generates a check code on key operation for at least part of the image data of the area corresponding to the key ID of the operated key (24; 34) according to the first map; and that the multifunction terminal (20; 30) and / or a higher-level security computer (40) determines and / or checks an input value on the basis of the check code.

Description

The invention relates generally to the input or operation of a multifunction terminal (hereafter: MFT) with a computer-aided display device. In particular, the invention relates to a device for safety-relevant operation or input on a combined display and input device, namely an MFT with soft key arrangement and a display device for generating pixel graphics. In this case, any pixel-based display, but in particular a TFT panel, is considered a display device.

When combined display and input units are used, it should be ensured that the information entered as input exactly matches that which the operator deliberately selected or dialed via the input.

This is from the European patent EP 2 551 787 B1 the applicant a device for safety-relevant operation of a MFT known, which is particularly suitable for touchscreens. A touchscreen is understood to mean a display with integrated operating capability via touch input within the screen area. Buttons within the displayed graphic allow intuitive and ergonomic operation without separate input devices, such as mouse or keyboard.

In the field of application are in particular applications in which the safety in the sense of safety or operational safety (Engl. Safety) of certain operations or inputs is crucial, for example in the cab of a vehicle, e.g. Railway locomotive, or at the control console for the operation of a plant, e.g. a reactor. However, the field of application of the invention is not limited to fixed MFTs but also includes small portable devices, e.g. for remote control of machines or plants. For example, tablet PCs are now used to control container cranes in ports. Furthermore, the invention may be applied in the field of critical security, in particular of data processing equipment and devices requiring authorization, e.g. ATMs, find application.

Already the pure representation of information is error-prone. So z. B. errors in each component of the display generating computer unit occur, for. Example, by a defective microprocessor, in the graphics processor, in the individual memory modules, in the power supply or in the operating system and in libraries used in software production. A clear improvement is achieved with the method for displaying a security-relevant information in accordance with WO 2011/003872 A1 However, the doctrine, however, alone makes the presentation safer per se.

If, in addition to the mere presentation of security-relevant information, security-relevant inputs are also made to a combined display and input device, such as a touchscreen, obviously further error sources are added. Basically, sources of potential errors represent all hardware and software components used to capture and process the input.

A further complicating factor with MFTs is that the function of the controls or buttons is not fixed. The function should be user-definable by changing the assigned area during programming and, as a rule, be dynamically or context-dependent changeable during the application.

• a) das MFT ordnet dem Bedienelement fälschlicherweise einen anderen als den richtigen Informationsgehalt zu;
• b) das betätigte Bedienelement wird vom MFT nicht als betätigt erfasst (z.B. bei Notaus kritisch); und
• c) eine Betätigung eines Bedienelements wird willkürlich bzw. zufällig ausgelöst, ohne dass eine Eingabe bzw. Bedienung durch den bedienenden Nutzer tatsächlich stattgefunden hat.

Accompanying safety-critical error modes concerning the data input (data entry) or actuation are in particular:

• a) the MFT erroneously assigns the control element a content other than the correct one;
• b) the operated control element is not detected as actuated by the MFT (eg critical in the event of an emergency stop); and
• c) an actuation of a control element is arbitrarily or randomly triggered without an input or operation has actually taken place by the user operating.

In particular with regard to the former case, the invention comes from the European patent EP 2 551 787 B1 decisive improvement especially with touchscreens. Even the last two cases can be avoided with this solution with some additional effort. However, this solution is primarily designed for touch screens and may require calibration before startup and / or during operation.

An object of the present invention is therefore to provide a further development for those cases in which a touch screen is not desired, for example due to lack of space, due to unclean environment or relatively small display. This can be the case, for example, in industrial machines, public devices, measuring instruments, or the like, but also in control panels and vehicle driver's cabs. The invention also relates to cases in which a touch screen is present, but certain inputs should not be made on this, for example, to avoid the second and / or third of the above error cases b) and c), for which Touchscreens are more vulnerable due to their complexity and the underlying technology.

The purpose proposed by the invention multifunction terminal (MFT) for safety-relevant operation includes next to the display device with computer unit and screen for pixel graphics a softkey button arrangement with multiple physical buttons outside the screen for detecting different inputs by an operator. In this case, the function of the keys can be dynamically adjusted in each case with a change in the representation in an area assigned to the key. In the present case, a soft key arrangement is understood to mean an arrangement with individual actual keys, wherein buttons are not included as virtual keys on a touch screen thereof.

According to the invention, it is proposed to provide a test unit which is independent of the computer unit and to connect the latter, on the one hand, to the image data line for acquiring image data and, on the other hand, to connect the key arrangement to detect key actuations. The connection with the soft key arrangement may be direct or indirect, e.g. via the computer unit.

The test unit according to the invention receives or identifies a corresponding key identifier when the key is pressed, e.g. the keys are individually connected to the test unit. Based on this, the test unit generates a check code for at least part of the image data of the area which corresponds to the key code of the actuated key when the keys are pressed. For this purpose, a first image is predefined in the test unit, which assigns a range of image representation according to key assignment for each key identifier, assigns immutable in particular for the given application.

Based on this design of the test unit, the entire system can determine and / or check an input value based on the test code. This can e.g. cause the multifunction terminal itself and / or a higher-level security computer.

Unlike the illustrative computer unit in conventional art, e.g. As an IBM-compatible PC, the test unit can be designed with much less effort as a safe unit in terms of safety technology (for example, for SIL-2 or SIL-3 certification).

For increased redundancy, it may be provided that the computer unit in a conventional manner, as in previously known MFTs with soft key arrangement, first the desired function according to key operation detected, i. determines the input value. In parallel, the test unit can independently determine and output a redundant input value or output only one test code. A comparator, e.g. in a higher-level safety computer, it is then possible to compare both input values or input value from the computer unit and test code from the test unit for the purpose of a safety-related reaction.

In a first embodiment, the test unit itself detects the input values. For this purpose, it can be provided that a second mapping is predefined in the test unit, which assigns each functionally permissible test code to the input value corresponding to the representation. The test unit determines an input value based on the generated test code and the second figure. If the check code is inadmissible, the check unit may generate an error message to indicate a faulty operation of the computer unit. In the first embodiment, the test unit outputs the corresponding input value upon key operation and in case of a valid check code. This can be output as the only specific input value to the computer unit of the display device. Even without redundancy, this design offers security advantages, since a security certification for a conventional, complex Panel PC is much more complex than for the test unit. Additionally or alternatively, the input value from the test unit can also be output as a redundant value in the sense of a second independent channel to an independent safety computer for the purpose of checking. The cause of the desired key function takes place, if necessary, solely on the basis of the input value from the test unit or after its countercheck in comparison to the input value conventionally determined by the computer unit.

In a second embodiment, the test unit generates no input values, but only generates the test codes for the purpose of safety-related further processing. For this purpose it can be provided that the test unit outputs the generated test code, e.g. to the computer unit of the display device and / or to an independent security computer. The generation of the check code can be used for the purpose of determining a corresponding input value and / or for checking an input value determined from the key arrangement via a second channel, in particular via the computer unit.

Even if the insecure computer unit determines the key function without redundancy, based on the check code, the security is improved since inadmissible cases can be intercepted by the test unit, for example by shifting the assigned areas by one key position or by an error in the display Context menu. This results from the fact that the test unit always generates the test code for the image data actually displayed.

Although continuous generation of check codes independent of the key operation is also conceivable, preferably the check unit will only generate one or more check codes from the associated portion of the image data when a key press occurs. As a result, the reliability with regard to the error cases b) and c) mentioned above can be significantly increased in conjunction with proven technology for the key arrangement.

Accordingly, the test unit can be designed so that it respectively during a button operation for the area corresponding to the key code of the operated key, repeatedly generates a test code for several image repetition cycles and determines therefrom the number of all generated test codes. Thus, in order to increase the safety only in the presence of a sufficient and / or predominant number of a certain permissible check code, this particular check code can be reused, e.g. for determining an input value or for outputting the check code to a higher-level security computer.

Specifically, for the above purpose, during the period of a key operation at periodic intervals, the test unit may generate a check code for the area corresponding to the key ID of the operated key, respectively, so that a plurality of check codes are generated at a total of one key operation. This also increases system security in terms of redundancy.

The above advantages can be realized with little effort if the soft key arrangement comprises a controller which generates at least one signal each time the key is pressed, in particular an interrupt request (IRQ), which the test unit receives directly or indirectly. In this case, the controller can each generate a signal when a key is pressed, when a key is released and / or at each clock interval during which a key remains depressed. In particular, in the case of ANDing the last option with one or both of the push / release detection modes, operation of movements, e.g. the method of a robot arm or a machine can be realized.

• – die Rechnereinheit erzeugt ein erstes Bildelement in einem vorbestimmten Bereich;
• – die Prüfeinheit erkennt eine Betätigung der Taste, welche dem vorbestimmten Bereich abbildungsgemäß entspricht und erzeugt einen ersten Prüfcode hierzu;
• – die Rechnereinheit erzeugt ein zweites Bildelement im vorbestimmten Bereich; und
• – die Prüfeinheit erzeugt anschließend, z.B. nach einem vordefinierten Zeitintervall, einen zweiten Prüfcode zu dem vorbestimmten Bereich, welcher bestimmungsgemäß das zweite Bildelement anzeigen soll.

A further safety improvement is achieved if the computer unit and the test unit are designed to implement a safe operating sequence in order to use a predefined sequence of picture elements in the image area assigned to the key and / or parameters of the sequence as a criterion. Such an operating sequence may include:

• The computer unit generates a first picture element in a predetermined area;
• - The test unit detects an actuation of the button, which corresponds to the predetermined area according to the image and generates a first check code for this purpose;
• The computer unit generates a second picture element in the predetermined area; and
• - The test unit then generates, for example, after a predefined time interval, a second check code to the predetermined area, which is intended to display the second pixel.

• – Drücken der Taste bei korrekter Anzeige des ersten Bildelements im vorbestimmten Bereich;
• – korrekte Anzeige des ersten Bildelements im vorbestimmten Bereich während einer Zeitdauer, insbesondere der Zeitspanne, in der die Taste gehalten wird;
• – Zeitdauer zwischen Erzeugung des ersten und des zweiten Prüfcodes, wenn die Taste gehalten wird;
• – Zeitdauer der Anzeige des zweiten Bildelements im vorbestimmten Bereich während einer Zeitdauer, insbesondere der Zeitspanne, in der die Taste gehalten wird;
• – Zeitdauer zwischen Drücken und Loslassen der Taste, falls im vorbestimmten Bereich beim Drücken das erste Bildelement und beim Loslassen das zweite Bildelement angezeigt wird; und/oder
• – Loslassen der Taste bei korrekter Anzeige des zweiten Bildelements im vorbestimmten Bereich.

In particular, the proposed operating sequence can increase the security if the triggering of a key function takes place only if a condition is fulfilled which depends on the parameters of the generation of the first check code and the second check code. Thus, this condition may include at least one or a combination of:

• Pressing the key when the first picture element is correctly displayed in the predetermined area;
• Correct display of the first picture element in the predetermined range during a period of time, in particular the time period in which the button is held;
• The time between generation of the first and second check codes when the key is held;
• - Duration of the display of the second pixel in the predetermined range during a period of time, in particular the period in which the key is held;
• The time between pressing and releasing the key if the first pixel is displayed in the predetermined area when pressed and the second pixel is displayed when released; and or
• - Release the button with correct display of the second pixel in the predetermined range.

The proposed criteria an intuitive interaction or haptics can be modeled for example by a button after pressing as pressed, edged, or displayed in the color changed and the test unit as it presupposes the desired or properly right feel as another safety criterion , Possible discrepancies are recognized as an error case by the test unit and can thus be recognized by the user. Alternatively, it can also be provided that the changed representation, ie the difference between the first and second picture element of the sequence, is imperceptible to the user. In principle, sufficient Hamming distance are also at optical imperceptible differences (eg slight variation or modulation in the background color) generates distinguishable check codes.

In an embodiment which is particularly reliable for avoiding errors b) and c) above, only the soft key arrangement is provided for operation, i. In particular, the MFT does not include a touch screen. Key arrangements with several one-sided or multi-sided, i. laterally above and / or below the screen adjacent keys, preferably in the form of corresponding rows of keys along the narrow or long sides of the screen. Particularly robust for this purpose are membrane keys, in particular short-stroke membrane keys, e.g. Lifting buttons with metal dome or Metallschnappscheibe or polyester bubble or the like., Each button has a mechanically-acting normally open and / or a normally closed for shorting or opening electrical contacts.

The test unit can generate the test code (s) for the entire image area according to key assignment, but only for pixels of a critical part from the area according to key assignment, where critical here means a subrange suitable for distinguishing different representations in the assigned image area, e.g. in the different menu contexts or possible status displays.

It is expedient for the first image and / or the second image to be bijective or one-to-one. The mappings may be used as program instructions, e.g. as a mathematical relation, be preprogrammed, and / or stored in a memory, preferably in the form of a look-up table.

In a robust and real-time capable embodiment, the test unit is implemented as an independent module, with an FPGA connected to the image data line for test code generation and with a microcontroller connected to the soft key arrangement for operation control and detection of key identifications. An FPGA enables quasi-synchronous generation of the check codes, e.g. in the form of checksums, from the image data. The first image and / or the second image may be preprogrammed or stored in the microcontroller. The invention is advantageously applicable to multifunction terminals, in which the screen is a TFT screen, preferably with native image resolution of at least 640 × 480 pixels, and the computer unit is a standard PC, IPC, or embedded PC with CPU and graphics processor , eg an IBM-compatible PC considered unsafe.

A significant advantage of the invention is that the performing computer unit itself does not have to be secure and also subsequent software and / or hardware updates of the computer unit do not lead to the loss of security or to a costly recertification.

• – im Führerstand für ein Fahrzeug, insbesondere für ein schienengebundenes Triebfahrzeug, zum Bedienen sicherheitsrelevanter Fahrzeug-Funktionen;
• – als Steuervorrichtung, insbesondere im Steuerpult, für eine
• industrielle Maschine oder Anlage, zum Bedienen sicherheitsrelevanter Maschinen- bzw. Anlage-Funktionen;
• – als Endgerät in einem System mit Autorisierungssicherheit, insbesondere für Bankgeschäfte.

The proposed MFT is suitable for use inter alia:

• In the driver's cab for a vehicle, in particular for a rail-bound traction vehicle, for operating safety-related vehicle functions;
• - As a control device, in particular in the control panel, for a
• industrial machine or system for operating safety-relevant machine or system functions;
• - As a terminal in a system with authorization security, especially for banking.

Further details, advantages and features of the invention can be taken from the following description of the figures, in which two preferred embodiments of the device according to the invention and of the method according to the invention are explained in more detail without limiting the scope of protection. Hereby show:

1 a black-and-white photograph of an MFT with multi-key softkey layout outside the screen, wherein the function of a key can be dynamically adjusted with each change of image representation in an area associated with the key;

2 : a schematic diagram of a first MFT according to the invention for security-relevant input on a display device; and

3 : A schematic diagram of a second MFT invention for security-relevant input to a display device.

In 1 shows an HMI or MFT with per se known construction, generally with 1 designated. For the representation of Pixelgrafik is a TFT display 2 connected to a computer unit not shown here in detail via an image data line. Outside the screen or TFT display 2 , here laterally on both narrow sides as well as above and below directly on the surface of the TFT display 2 adjacent are row-shaped membrane keyboards 3 from individual short-stroke membrane keys 4 intended. These serve as a so-called "softkey key arrangement" for recording entries on the MFT 1 by an operator to make the interpretation of a keystroke or a key operation changeable, ie the function of a key in each case with a change of the image representation in an area assigned to the key can be adapted dynamically and context-dependent, eg depending on the operating state, by the computer unit.

At a MFT 2 from the prior art, a key operation is detected by the same computer unit, in which the pixel graphics are generated on the TFT display 2 is visualized. If a button 4 is pressed, this is detected by the computer unit and processed as a "keyboard event" by application software on the computer unit, which also checks which function is currently this key 4 assigned. Thus, the key assignment or function may depend on the current operating state. To help the operator select the key to be operated 4 To help, the application software typically becomes a contextual icon, graphic element, icon, icon, or the like in an associated portion of the area of the TFT display 2 near the button, typically an area immediately adjacent to the button 4 , The operator becomes the selection on the membrane keypad 3 usually according to the displayed symbol. For MFTs 1 From the prior art, the assignment or logical link between the displayed key assignment and the operation of a key (key event) performed function is indirect and lies alone in the application software. This must explicitly establish the connection through appropriate software routines. Since the computer unit and application software is usually quite complex, among other things, the reliability of the association between displayed key assignment and function will be very dependent on the software quality (stability).

The embodiments of the invention according to 2 - 3 show a solution with one MFT each 20 ; 30 which links the displayed key assignment directly to a unique, in particular unique, code (hereinafter "check code"). The MFTs 20 ; 30 show next to the TFT display 22 ; 32 in a known per se at least one row 23 ; 33 with several individual short-stroke membrane keys 24 ; 34 on. The computer unit is in 2 - 3 With 25 ; 35 and via an image data line 26 ; 36 with the TFT display 22 ; 32 connected.

The linking of the predefined assignment of image areas 27 ; 37 will be outside the respective computer unit 25 ; 35 through a separate, more reliable test unit 28 ; 38 realized. The test unit 28 ; 38 is safe in the sense of safety technology and allows certification of the MFT 20 ; 30 eg to SIL-2.

Becomes a key 24 ; 34 pressed, this key operation is through the separate test unit 28 ; 38 detected, for example, by receiving a key ID, queried or otherwise determined. In the example below 2 are the individual keys 24 of the MFT 20 directly with corresponding inputs of the test unit 28 , eg I / O ports of a microcontroller of the test unit 28 , connected. In the example below 3 has the softkey button layout 33 its own microcontroller 31 which, when pressed, interrupts with the respective key code to the test unit 38 transmitted, for example, according to a PC-compatible protocol that also in conventional MFTs 1 to 1 is being used.

The separate test unit 28 ; 38 taken separately, in both cases similar to a test unit the European patent EP 2 551 787 B1 constructed and generated according to the fixed predetermined assignment to the image areas 27 ; 37 a check code based on the principle WO 2011/003872 A1 starting from the pixel data stream from the computer unit 25 ; 35 to the TFT 22 . 32 , For this reason, the image data line is 26 ; 36 through the separate test unit 28 ; 38 it loops, or reads out the data in parallel, using an FPGA (not shown) that can generate the check codes.

Each image area 27 ; 37 , in which a key assignment (see "A", "B", "C") is displayed context-dependent, a so-called monitoring area is permanently assigned in the test unit. This is in the test unit 28 ; 38 , For example, by a look-up table (LUT) or the like., A first figure is predefined, which for each key identifier of the individual keys 24 ; 34 an image area 27 ; 37 firmly assigns the image representation according to key assignment. Based on this, the test unit generates 28 ; 38 independent of the computer unit in a key press a check code for all or at least part of the image data of the image area 27 ; 37 , which is the key ID of the operated key 24 ; 34 ,

By pressing, ie pressing or releasing, a certain key 24 ; 34 will be in the test unit 28 ; 38 the monitored area associated with the button activates and with the next screen update or refresh, a deterministic check code (eg, a checksum according to the method WO 2011/003872 A1 ) generated.

A key advantage here is that the so generated by the test unit 28 ; 38 Check code directly and unchangeable with the at this time ie currently in the respective image area 27 ; 37 displayed key assignment or presentation is linked.

With the separate test unit 28 to 2 Either the check code or by a second figure, for example in the form of a look-up table or the like., In the test unit 28 certain input value via a return channel 39 to the computer unit 25 be issued. The computer unit can then indirectly transfer the acquired input value to a higher-level security computer.

The input value can also be directly from the separate test unit for further safety enhancement 38 be transferred to a higher-level system. With the separate test unit 38 to 3 This code can in turn, for example, by a second figure, for example in the form of a look-up table or the like., Immediately in the desired meaning, for example, "KEY A pressed", ie the input value to be translated. The so from the test unit 38 independent of the computer unit 35 certain input value can be eg directly via an interface or a secure output channel 39 be transmitted directly to a higher-level security computer of a secure system.

In both cases, the actual is in the respective image area 27 ; 37 displayed key assignment the function derived. Assignment error on the computer unit 25 ; 35 are avoided.

Unless the separate unit 28 ; 38 has been designed as a secure unit, it can be realized in this way a safe soft key operation concept. The user triggers exactly the function he actually selected based on the displayed pixel graphic.

LIST OF REFERENCE NUMBERS

1

Multifunktionsterminal (MFT)

2

TFT-Display

3

Folientastatur

4

Taste

Fig. 2

20

Multifunktionsterminal (MFT)

22

TFT-Display

23

Tastatur bzw. Tastenreihe

24

Taste

25

Rechnereinheit

26

Bilddatenleitung

27

Bildbereich („Softkey-Anzeige“ zu Taste)

28

Prüfeinheit

29

Rückkanal

40

Sicherheitsrechner

Fig. 3

30

Multifunktionsterminal (MFT)

31

Mikrocontroller

32

TFT-Display

33

Tastatur bzw. Tastenreihe

34

Taste

35

Rechnereinheit

36

Bilddatenleitung

37

Bildbereich („Softkey-Anzeige“ zu Taste)

38

Prüfeinheit

39

Ausgabekanal

40

Sicherheitsrechner

Fig. 1

1

Multifunction terminal (MFT)

2

TFT display

3

keypad

4

button

Fig. 2

20

Multifunction terminal (MFT)

22

TFT display

23

Keyboard or row of keys

24

button

25

computer unit

26

Image data line

27

Image area ("softkey display" to button)

28

test unit

29

backchannel

40

computer security

Fig. 3

30

Multifunction terminal (MFT)

31

microcontroller

32

TFT display

33

Keyboard or row of keys

34

button

35

computer unit

36

Image data line

37

Image area ("softkey display" to button)

38

test unit

39

output channel

40

computer security

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• EP 2551787 B1 [0003, 0009, 0042]
• WO 2011/003872 A1 [0005, 0042, 0044]

Claims (20)

Multifunction terminal ( 20 ; 30 ) for safe operation comprising: a display device with a computer unit ( 25 ; 35 ) for generating pixel graphics and a screen ( 22 ; 32 ) to their representation; an image data line ( 26 ; 36 ) from the computer unit to the screen; a soft key layout ( 23 ; 33 ) with several buttons ( 24 ; 34 ) outside the input capture screen, wherein the function of a key is changed by changing the image representation in an area associated with the key ( 27 ; 37 ) can be dynamically adjusted by the computer unit; characterized in that; a test unit independent of the computer unit ( 28 ; 38 ) is provided and for capturing image data with the image data line ( 26 ; 36 ), as well as for the detection of key presses directly or indirectly, for example via the computer unit, with the key arrangement ( 23 ; 33 ), wherein the test unit receives or detects a corresponding key identification when the key is pressed; in the test unit, a first image is predefined, which defines a region for each key identifier ( 27 ; 37 ) assigns the image representation according to key assignment fixed; the test unit ( 28 ; 38 ) generates a check code for at least part of the image data of the area which corresponds to the key code of the actuated key ( 24 ; 34 ) according to the first figure; and that the multifunction terminal ( 20 ; 30 ) and / or a higher-level security computer ( 40 ) determines and / or checks an input value based on the check code. Multifunction terminal according to claim 1, characterized in that in the test unit ( 28 ; 38 ) a second mapping is predefined which assigns each functionally permissible check code to the input value corresponding to the representation and the test unit ( 28 ; 38 ) determines an input value based on the generated check code and the second mapping and / or generates an error message if the check code is inadmissible. Multifunction terminal according to claim 2, characterized in that the test unit ( 28 ; 38 ) outputs the corresponding input value when the key is pressed and the test code is permissible, in particular to the computer unit ( 25 ; 35 ) of the display device or to an independent security computer ( 40 ). Multifunction terminal according to claim 1, characterized in that the test unit ( 28 ) outputs the generated check code, in particular to the computer unit ( 25 ) of the display device and / or to an independent security computer, for the purpose of determining a corresponding input value and / or for checking an input value determined from the button arrangement via a second channel. Multifunction terminal according to one of the preceding claims, characterized in that the test unit ( 28 ; 38 ) only when a key operation occurs, at least one check code generated. Multifunction terminal according to one of the preceding claims, in particular according to claim 5, characterized in that the test unit ( 28 ; 38 ) during or during a key operation for the area corresponding to the key code of the actuated key, repeatedly generates a test code for several image repetition cycles, determines the number of all generated test codes and only if a sufficient and / or predominant number of a certain permissible test code is available used to determine an input value or output. Multifunction terminal according to one of the preceding claims, in particular according to claim 5, characterized in that the test unit ( 28 ; 38 ) during the period of a key operation at periodic intervals respectively for the area corresponding to the key ID of the operated key generates a check code. Multifunction terminal according to one of the preceding claims, in particular according to one of claims 5 to 7, characterized in that the soft key arrangement comprises a controller ( 31 ), which generates at least one signal each key operation, which receives the test unit directly or indirectly, wherein the controller generates a signal in each case: - when pressing a button ( 34 ); - when releasing a key ( 34 ); and / or - at each clock interval during which a key ( 34 ) remains pressed. Multifunction terminal according to one of the preceding claims, in particular according to one of claims 5 to 8, preferably according to claim 8, characterized in that the computer unit ( 25 ; 35 ) and the test unit ( 28 ; 38 ) for implementing a secure operating sequence, comprising: - the computer unit generates a first picture element in a predetermined area; - The test unit detects an actuation of the button, which corresponds to the predetermined area according to the image and generates a first check code for this purpose; The computer unit generates a second picture element in the predetermined area; - The test unit then generates a second check code to the predetermined area. Multifunction terminal according to claim 9, characterized in that the triggering of a key function only takes place upon fulfillment of a condition which depends on the generation of the first check code and the second check code. Multifunction terminal according to claim 10, characterized in that the condition comprises at least one of: - pressing the key when the first picture element is correctly displayed in the predetermined area; Correct display of the first picture element in the predetermined area during a period of time; The time between generation of the first and second check codes when the key is held; - Duration of the display of the second pixel in the predetermined range during a period of time; The time between pressing and releasing the key if the first pixel is displayed in the predetermined area when pressed and the second pixel is displayed when released; and / or - releasing the key when the second picture element is correctly displayed in the predetermined area. Multifunction terminal according to one of the preceding claims, characterized in that for operation only the soft key arrangement ( 23 ; 33 ) is provided, with several laterally, above and / or below the screen ( 22 ; 32 ) adjacent buttons. Multifunction terminal according to one of the preceding claims, characterized in that the soft key arrangement has a plurality of membrane keys ( 24 ; 34 ), in particular short-stroke membrane keys, and each key has a closer and / or an opener for shorting or opening electrical contacts. Multifunction terminal according to one of the preceding claims, characterized in that the test unit ( 28 ; 38 ) generates key codes only for pixels of a critical part from the area according to key assignment. Multifunction terminal according to one of the preceding claims, characterized in that the first image and / or the second image, as a program instruction, for example as a mathematical relation, are preprogrammed and / or stored in a memory, preferably in the form of a lookup table /are. Multifunction terminal according to one of the preceding claims, characterized in that the test unit ( 28 ; 38 ) as an independent module with one with the image data line ( 26 ; 36 FPGA for test code generation and one with the softkey key arrangement ( 23 ; 33 ) connected microcontroller for operation control and detection of key identifications, wherein the first image and / or the second image are preprogrammed or stored in the microcontroller. Multifunction terminal according to one of the preceding claims, characterized in that the screen is a TFT screen ( 22 ; 32 ), preferably with native image resolution of at least 640 × 480 pixels, and the computer unit ( 25 ; 35 ) is a PC, IPC, or embedded PC with CPU and graphics processor. Driver's cab for a vehicle, in particular for a rail-bound traction vehicle, characterized by a multifunction terminal according to one of claims 1 to 17, for operating safety-relevant vehicle functions. Control device, in particular control panel, for an industrial machine or system, characterized by a multifunction terminal according to one of claims 1 to 17, for operating safety-relevant machine or system functions. Terminal in a system with authorization security, in particular for banking, characterized by a multifunction terminal according to one of claims 1 to 17, for confirming or rejecting an input on the display device.

Images