EP2006817A1

EP2006817A1 - Method of notification of an alarm for a visualisation system, in particular for safety-critical applications, and related device

Info

Publication number: EP2006817A1
Application number: EP08010258A
Authority: EP
Inventors: Marcello Niccolini
Original assignee: INFOTRONIC SpA
Current assignee: INFOTRONIC SpA
Priority date: 2007-06-06
Filing date: 2008-06-05
Publication date: 2008-12-24
Also published as: ITMI20071150A1

Abstract

The invention describes a method of notification of an alarm in an electronic visualisation system (A), capable of notifying the occurrence of an alarm situation, preferably by switching off or blanking a monitor (1).

The recognition of the alarm situation takes place through the comparison between the screens transmitted by the monitor (1), checking whether the graphical elements transmitted, generally pixels or characters, vary or remain constant.

The invention also describes an electronic device (10) capable of carrying out said a method.

Description

Field of application

The present invention refers to a method of notification of an alarm for a visualisation system, in particular for safety-critical applications, for example in airport or rail traffic control systems.
The invention also refers to an electronic device capable of carrying out said method.

Prior art

As is known, the evolution of electrical characteristics of microprocessors makes it possible to obtain performance at levels unimaginable just a few years ago. Safety-critical applications, for example in airport or rail traffic control systems, profit enormously from computer systems, since they allow the exchange of enormous amounts of data in very short periods of time.
For example, physical magnitudes can be transmitted to an operations centre, where operators watch the progression over time of said magnitudes on monitors.
Sometimes incorrect information is displayed on the monitors and, as a result of this, operators in good faith take potentially catastrophic actions.
Therefore, tolerance and malfunction detection techniques have been developed, aimed at preventing malfunctions from causing a loss of safety. Said techniques are sometimes able to make a system safe, for example by neutralising a device that is malfunctioning or in any case producing incorrect information. Such techniques are often based upon:

redundancy of electronic circuitry: use of more hardware than what is strictly necessary (for example the use of two computers instead of one, or doubling the communication channels); this is an expensive solution that runs the risk of generating conflicts between different boards;
encrypting techniques: use of encryption/decryption algorithms between different electronic boards, so that each electronic board recognises the plausible information source; this is a solution that is often complicated and not always safe from outside attacks
assessment techniques: value reconstruction algorithms; however, such techniques are not fully reliable.

A conventional visualisation system A comprises a convention LCD monitor 1. It is made up of an LCD panel 2, commanded by an LCD panel controller 3, in turn controlled by an LCD monitor controller 4.
The LCD monitor controller 4 receives data from a graphic board 5, which is in turn controlled by a central microprocessor 6.
The graphic board 5 is able to process information of the microprocessor 6, on which an application program is loaded that is able to manage the visualisation of physical values of a safety-critical system.
Normally, the graphic board 5 encodes said information in graphical format, which is transmitted to the LCD monitor controller 4, which performs format adaptation operations of the graphical information. The graphical information so adapted is finally transported in the row-column matrix form from the LCD panel controller 3 and transmitted to the LCD panel 2, which visualises it.
However, malfunctions that may be present in the electronic circuitry, or possibly programming errors or outside attacks (for example due to a virus), run the risk of turning into visualisation errors of safety-critical parameters, possibly putting the safety of the system into danger.
Therefore, the microprocessor 6, the graphic board 5, the LCD monitor controller 4 and the panel controller 3 are critical components; if even just one of these malfunctions, it is possible for incorrect information to appear on the monitor, fooling the operators in a potentially catastrophic way.
The technical problem forming the basis of the present invention is to devise an error detection method that can result in the immediate blanking of a monitor and/or in the generation of an error message to the microprocessor, particularly for safety-critical applications, in the case of malfunction, and relative electronic circuitry.
The solution to such a problem must require the use of less circuitry than conventional redundancy. Said circuitry must be able to be integrated with pre-existing devices (graphic board or monitor) and must be transparent to the user.
Moreover, said method has to be simple to use and must not be able to be deactivated by outside attacks.
The blanking of the monitor thus allows the user to immediately become aware of the alarm situation; as well as being immediate, such a solution is also cost-effective because it does not require warning systems, although it does not preclude them.

Summary of the invention

The idea for a solution forming the basis of the present invention is based upon controlling the variation of graphical video elements.
In accordance with the present invention the technical problem is solved by a method according to claim 1.
Such a method notifies an alarm for a visualisation system, particularly for safety-critical applications.
The visualisation system, illustrated in figure 1 with the symbol A, comprises a graphic board, usually inserted in the board of a computer, a monitor and the relative control circuitry.
The monitor visualises screens, made up of graphical elements formed from pixels. Between the microprocessor of the computer and the LCD panel there are normally intermediate elements, such as those illustrated previously, in figure 1 - the LCD monitor controller and the LCD panel controller. Each of such elements sends graphical information to the subsequent elements. All of the graphical elements together with their value (for example the colour of the pixel) are encoded in such graphical information.
An a priori division is carried out into a subgroup of the graphical elements present in each screen, according to their variability over time:

a first group of graphical elements that are variable over time, i.e. graphical elements that are foreseen to vary over time (for example groups of pixels that visualise values that vary over time), and
a second group of constant graphical elements, i.e. that do not vary over time (for example groups of pixels that visualise the logo of the producer of the application software).

Such a division is carried out a priori; the method comprises the following steps, usually repeated for each screen:

a step of reading said digital graphical information: it is checked what kind of graphical information is sent towards the monitor;
a first check that the digital graphical information corresponding to the graphical elements of said first group actually vary over time;
a second check that the digital graphical information corresponding to the graphical elements of said second group actually remain constant over time;
a notification step of an alarm upon the negative outcome of at least one of said first and second checks; usually said notification is expressed through the blanking of the monitor (for example turning it off); in this way the operator immediately knows that the alarm has occurred.

The further characteristics and advantages of the solution according to the present invention shall become clearer from the description, made hereafter, of a preferred example embodiment thereof, given for indicating and not limiting purposes with reference to the attached drawings.
Moreover, the same technical problem is solved by a device according to claim 12.
The device according to the invention comprises:

connections to digital information transmission cables;
electronic circuitry for checking the presence of malfunctions, comprising a memory on which graphical elements that are variable over time are saved in the first group and constant graphical elements are saved in the second group,
alarm means, for example a switch able to switch off the monitor.

Said electronic circuitry comprises means able to perform:

a first check that the digital graphical information corresponding to the graphical elements of the first group actually vary over time; and
a second check that the digital graphical information corresponding to the graphical elements of the second group actually remains constant over time.

Brief description of the drawings

Figure 1 shows a graphical system according to the prior art;
Figure 2 shows a block diagram according to the present invention;
Figure 3 shows a first embodiment of the present invention;
Figure 4 shows a second embodiment of the present invention;
Figure 5 shows a third embodiment of the present invention;
Figure 6 shows a fourth embodiment of the present invention;
Figure 7 shows a component according to a variant of the embodiment of figure 4 in greater detail.

Detailed description

A graphical information flow 5A, comprising pixels, the position and value (colour) of said pixels, is transmitted from a graphic board 5 to an LCD monitor 1. Such information is intercepted by a device 10, which comprises the following blocks.
A first block 11 is able to decode the intercepted graphical information and to preliminarily check the graphical format used.
Such decoded graphical information is supplied to two different blocks.
In a first block 12 a first group of pixels that are variable over time are preloaded. Moreover, the first block 12 comprises a memory 12B in which the pixels of the current screen and belonging to said first group, as well as transmitted from the graphic board 5 and decoded by the block 11, are loaded. Moreover, the first block 12 comprises a memory 12C in which the pixels, with their value, of the previous screen, belonging to said first group, as well as transmitted from the graphic board 5 and received by the block 11, are loaded. The block 12, through internal logic means (for example a microprocessor 12D), checks whether the value of each pixel of the memory 12B is equal to the value of the corresponding pixel of the memory 12C. If all of the pixels are the same, it means that the screens have not changed. The first block 12 sends a notification signal 12A to its output each time a change of at least one pixel is detected.
In a second block 13 a second group of pixels that must not vary over time are preloaded. Moreover, the second block 13 comprises a memory 13B in which the pixels of the current screen, belonging said first group, as well as transmitted from the graphic board 5 and decoded by the block 11, are loaded. Moreover, the second block 13 comprises a memory 13C in which the pixels, with their value, of the previous screen and belonging to said second group, as well as transmitted from the graphic board 5 and transmitted by the block 11, are loaded. The second block 13, through internal logic means (for example a microprocessor 13D), checks whether the value of each pixel of the memory 13B is equal to the value of the corresponding pixel of the memory 12C. If all of the pixels are the same, it means that the screens have not changed. The second block 13 sends a notification signal 13A to its output each time a change of at least one pixel is detected.
The blocks 12 and 13 then supply the information of the change of at least one pixel of a screen compared to the previous screen to two inputs of a block 14.
The block 14 comprises a counter 14B that counts the time passed. Such counting starts from an initial value (for example 0) to an end value (for example 255) that is programmable according to the latency times of the application. If he block 14 receives a notification signal 12A that indicates the variation of at least one pixel of the first group (pixels that are variable over time), then the counting is reset to zero. If the block 14 receives a notification signal 13A that indicates the variation of at least one pixel of the second group (pixels that are constant over time), then the counting is taken to its end value.
In both cases, when the counting reaches the end value, the block 14 sends an alarm notification signal 14A to a switch 15, which is able to open the power supply line 16 of the monitor 1, blanking the monitor so as to not allow incorrect information to be displayed and in this way expressing an alarm. The alarm notification signal 14A could also be sent to the central microprocessor in another embodiment of the present invention.
The electronic circuitry can be integrated into the graphic board of the computer or else into the monitor, resulting in a negligible increase in hardware; possibly, said device 10 could also be external, allowing it to be inserted into a pre-existing visualisation system.
A configuration block 17 is also inserted. Said block receives in input the position of the pixels of the first and second group. Moreover, said block 17 comprises means capable of deactivating the operation of the device 10 (for example before the application program is launched in the central microprocessor 6, i.e. when the screens are not yet as defined by the application program).
Further embodiments shall now be quickly illustrated.
In figure 3 there is a monitor 1 with an external device 10, which is inserted between the graphic board 5 and the LCD monitor 1.
Figure 4 shows a device 10 connected to the output of the LCD monitor 5, thus capable of intercepting the graphical information 4A transmitted by said LCD monitor controller 5 to the LCD panel controller 3.
Figure 5 shows a device 10 connected to the output of the LCD panel controller 3, capable of intercepting the graphical information 3A transmitted by said LCD panel controller 3 towards the LCD panel 2.
A malfunction situation is illustrated hereafter.
If the microprocessor 6, the graphic board 5 or the monitor 1 fail (or even in the case in which the operating system or the application program go into an infinite loop) so as to block the screen, the monitor 1 is switched off all the same, since variations in the screen between the pixels of the first group are not detected (in this case it is necessary to wait for the maximum value to be exceeded by the counter inside the block 14).
The operation of a device according to the invention is totally independent from the operation of the application program loaded onto the central microprocessor 6, and from the operation of the safety-critical unit in which the computer managed by the central microprocessor 6 operates. Therefore, the degree of safety is increased independently of the application.
A further embodiment of the invention is illustrated in figure 6, in which elements that are structurally or functionally equivalent to the elements of the previous embodiments are attributed the same reference numerals.
Said further embodiment foresees a check through the known technique of calculation of a Cyclic Redundancy Code (CRC). In this case, the CRC is the result of a given calculation carried out on the strings that encode the digital graphical information relative to the constant graphical elements (second group) that is inserted, by the application program (or by additional circuitry), into an additional field of predetermined position and length; said value is then intercepted by the device 10 amongst the digital graphical information 5A. The block 111, which is also able to act as control block of the CRC of the graphical information sent, carries out the format check (similarly to the previous examples), and also recalculates the CRC and compares it with the intercepted CRC. In the case in which the comparison finds a difference between the CRC recalculated by the block 111 and the CRC intercepted amongst the digital graphical information 5A (which can only be due to an error or a malfunction), the block 111 generates an alarm signal 11A in input to an OR gate 20 with the signal 14A, so as to generate the signal 10A and block the switch 15 and open the power supply line 16 of the monitor 1.
The LCD panel 3 of figure 4 could be made, according to a variant to the aforementioned second embodiment, as follows. The LCD panel 3, reached by the aforementioned signal 4A, comprises a latch 21 and a module 22. The latch 21 is a resampler, but it could also be an optical decoupler (or in any case a means capable of separating the electric circuits upstream and downstream), and it provides the module 22 with the signal 21A, which is normally identical to the signal 4A. The visualisation module 22 transports the signal 21A in row-column matrix form (signal 3A), i.e. it performs the same role as the LCD panel 3 in figure 4). When no longer fed with power faced with an alarm event, the latch 21 spontaneously interrupts the flow of data towards the Video Transmitter, avoiding the latter, though not fed with power, being able to operate and transmit, by taking power from the active input signals. In this way, a further advantage is obtained for the invention.
An output signal of the Latch block can be used as sense signal to guarantee that the cutting of the signals has actually been achieved. Such a variant could be made in the same way for the block 1 of figure 3.

Claims

Method of alarm notification in a visualisation system (A), comprising a monitor (1) able to visualise screens comprising graphical elements corresponding to digital graphical information (3A, 4A, 5A) that is transmitted to said monitor (1) by a microprocessor (6),
characterised in that it comprises:
- a step of distinction, in said graphical elements, between a first group of graphical elements that are variable over time and a second group of constant graphical elements;

- a step of reading said digital graphical information;

- a first check that the digital graphical information corresponding to the graphical elements of said first group actually vary over time;

- a second check that the digital graphical information corresponding to the graphical elements of said second group actually remain constant over time;

- a notification of an alarm upon the negative outcome of at least one of said first and second checks.
Method according to claim 1, wherein said alarm notification is carried out through the blanking of said monitor (1).
Method according to claim 1, wherein said alarm notification is sent to the microprocessor (6).
Method according to one of claims 1, 2 or 3, wherein a step of controlling the format of the visualised screens is provided.
Method according to any one of the previous claims, wherein said reading step and said check are cyclically repeated for each screen.
Method according to any one of the previous claims, wherein said first check and second check comprise the comparison between a subgroup of graphical elements of one screen and the relative subgroup of a previous screen, said first check being positive if the digital graphical information corresponding to the graphical elements of said first group actually vary over time, said second check being positive if the digital graphical information corresponding to the graphical elements of said second group actually remain constant over time.
Method according to claim 6, wherein it is provided to count the time passed from an initial value to an end value, said count being taken away from said end value in the case in which a difference is found between at least one graphical element of said first group of the counted screen with a graphical element of a previous screen in the same position, so as to produce a negative outcome of said first check if the counting reaches said end value.
Method according to claim 7, wherein it is provided to count the time passed from an initial value to an end value, said count being taken up to said end value in the case in which a difference is found between at least one graphical element of said second group of the counted screen with a graphical element of a previous screen in the same position, so as to produce a negative outcome of said first check.
Method according to one of claims 7-8, wherein said first and second checks use the same count.
Method according to any one of the previous claims, wherein a step of checking a Cyclic Redundancy Code is provided, provided the transmission of a CRC field between the digital graphical information (5A) relative to the graphical elements of said second group.
Method according to any one of the previous claims, wherein it is provided for there to be electrical decoupling between the signals that transport said digital graphical information (3A, 4A, 5A).
Alarm device (10) for a visualisation system having a monitor (1) able to visualise screens comprising graphical elements corresponding to digital graphical information (3A, 4A, 5A) that is transmitted to said monitor (1) by a microprocessor (6),
said graphical elements being divisible into a first group of graphical elements that are variable over time and a second group of constant graphical elements,
characterised in that it comprises:
alarm means (15) and

electronic circuitry (12, 13, 14) comprising
- means (12) capable of performing a first check that the digital graphical information corresponding to the graphical elements of said first group actually vary over time and

- means (13) capable of performing a second check that the digital graphical information corresponding to the graphical elements of said second group actually remain constant over time,

- means (14) capable of activating said alarm means (15) following the negative outcome of at least one of said first and second checks.
Device according to claim 12, characterised in that it comprises connections to digital information transmission cables (3A, 4A, 5A) arranged downstream of a graphic board (5).
Device according to claim 12, characterised in that it comprises connections to digital information transmission cables arranged downstream of a monitor controller (1).
Device according to claim 12, characterised in that it comprises connections to digital information transmission cables arranged downstream of a panel controller (3).
Device according to any one of claims 12-15, characterised in that said alarm means (15) comprise a switch capable of turning off the power supply to said monitor activated by said electronic circuitry.