EP2833349B1 - Method and device for representing a safety-relevant state - Google Patents

Description

The invention generally relates to the field of safety technology. In particular, the invention relates to a method and a device for reliably displaying a safety-relevant state with a display, in particular with a TFT screen.

In generic methods and devices, a computer, taking account of state information, creates an image data stream which contains representation values, in particular color values. These serve to drive the individual pixels of the display, i. to display an image, and are forwarded to the display in the image stream.

Due to the complexity of the computer typically used for graphics generation, these are to be classified as unsafe in the signal-technical sense.

Therefore, in generic methods, the image data stream is supplied to a test unit for performing a computational safety test. This relates to a surveillance area, which comprises at least a plurality of pixels, usually a plurality of pixels, of the respective image to be displayed.

A generic method and a corresponding device are, for example, from the international patent application WO 2012/003872 A1 or European patents EP 2 353 089 B1 and EP 2 273 369 B1 previously known. In this approach, the computational security check is performed by deterministic calculation of a check code taking into account the representation values of all pixels within the monitoring area, ie by a data reduction of all image data concerning the monitoring area to a considerably reduced check code in the data volume. Based on this check code, an inference is made to a possible input variable and its comparison with the actual input variable, which can represent a state information, for example. Related methods are also out EP 2 254 039 B1 or off DE 3 411 015 C2 known.

A significant advantage of these approaches is the fact that with a standard commercial computer, which usually does not meet the requirements for a safety certification, yet a safe representation are guaranteed. These methods reliably detect any even slight deviation of the image data from the target image data. However, a data reduction approach using check code generation is not ideal for every application.

Further methods for checking pixel-formatted display data for display on a display device in a vehicle are, for example, from the published patent applications EP 2 439 722 A1 and WO 2009/050106 A1 previously known.

Another method, namely the signaling technically safe display traffic information, is in EP 0 584 895 A2 disclosed. In this case, in a checking routine, the stored color value of a selected pixel of a symbol to be checked is read out and compared with the date for the relevant element. at Inequality of the color value and the comparison value, an error message is generated. In order to check a selected symbol, a selected pixel, for example the vertex of a symbol known in its coordinates, is supplied from the memory to a comparator. Only if the operating state represented by the color value of this single pixel exactly matches the actual operating state does the comparator provide a positive comparison result. On the one hand, this type of check has the disadvantage that certain fault modes can not be detected and, on the other hand, that imperceptible, only minor faults generate an error message that is in principle unnecessary.

The US 2007/0046680 A1 discloses an aircraft display system with improved availability of information. The graphic is redundantly generated on two channels. The check, for example on the basis of checksums, can trigger a reaction for the purpose of tolerance to short-term interference pulses only if the same error is detected over several image repetition cycles.

In many applications, the user of a human-machine interface (HMI) even without complex representation, as required for example in a tachometer, a safety-related condition is to be signaled in a simple manner. Thus, for example, by a control lamp depending on their luminous color, such as green or red, an operating state signaled and easily monitored by the user. In known systems with such control lights, the correct function of the lamp is checked by a measurement of the lamp current to ensure safety.

Since even in safety-critical applications increasingly displays such as TFT screens are to be used, it is desirable to the function of such control or to integrate warning lights into the picture displayed on the display.
Although the above-mentioned approaches with data reduction are fundamentally suitable for the safety-related functional test of the display of corresponding status information, they are relatively complicated to implement. In addition, the data reduction by Prüfcodebildung requires identity between the target image and the actual image, so that slight imperceptible to the user errors, such as individual pixel errors or EMC-related so-called bit dumpers, lead to a really unnecessary error case.
As an alternative to the approaches mentioned above, it would be conceivable to use a solution in which a second image structure is generated independently or redundantly and the first image is compared pixel by pixel with the redundant image. Such an approach is for example from the EP0856792B1 known. However, this approach requires a considerably larger amount of hardware, since both redundant, ie doubled computational compilation of the image data stream, as well as a double full storage of the image data required for image construction is required.
It is therefore an object of the present invention to propose a method and a device which enable the safety-relevant reliable representation of a safety-relevant state in a particularly simple manner and at the same time allow a certain tolerance with respect to negligible display errors.
This object is achieved by a method according to claim 1 and by an apparatus according to claim 10. The method is characterized by a method according to the preamble According to the invention, claim 1 is characterized in that firstly a reference value which is valid for all pixels of the monitoring area is determined, for example by the test unit or a secure control computer, and that the test unit stores this reference value. Furthermore, the invention is characterized in that the test unit, based on the image data stream, computationally determines a result variable and, for this purpose, subjects each pixel to a selection of pixels of the monitoring area of a test sequence. The selection of the pixels for the test sequence comprises at least every other pixel of the monitored monitoring area and consists in the simplest case of all pixels of the surveillance area. In the test sequence, the test unit according to the invention performs a comparison operation between at least one display value of the respective pixel, ie the pixel currently being examined in the test sequence, and the predetermined, stored reference value and forms a comparison result from this comparison operation. Furthermore, the test unit takes into account the respective comparison result to the current pixel, in order to be able to computationally determine the result variable. This consideration can be made in particular by incrementally increasing or decreasing the result variables depending on the respective comparison result. If necessary, the test sequence can extend over more than one image frame (English frame) or screen refresh. Finally, the invention provides that, after the test sequence has been performed, the result variable that has been computationally determined from the individual comparison results generated by image-wise comparison with a threshold value. This comparison is made by the test unit itself or externally after output of the result variables by the test unit and is used to form either a positive or negative result of the safety test. This overall result can then be used to trigger a safety-related Reaction, for example, to issue a warning signal or to a safety shutdown of the display, are used.

The device according to the invention is therefore characterized in that it comprises a test unit in which a reference value valid for all pixels of the monitoring area is stored and the test unit is designed to carry out a test sequence starting from the image data stream, such that the test unit successively for each Pixels of a selection comprising at least every second of the pixels of the monitoring area a comparison operation between at least one representation value, in particular a color value, performs the currently considered in the sequence pixel and the stored reference value and forms a comparison result. Furthermore, the test unit takes into account the respective comparison result for the purpose of computational determination of the result variables, for example by incrementally increasing or decreasing them. After the test sequence, in particular after each individual or after a sequence of test sequences, the test unit can output the result variable or even compare it with a threshold value. Based on this, externally or through the test unit, the formation of a positive or negative result of the safety test can take place.

According to the invention, the threshold value for the result variable is determined such that a positive result of the safety check is already established when a predetermined proportion of the selection of pixels taken for the test sequence meets the comparison criterion of the comparison operation and this proportion is less than 100%.

This approach makes it possible to exclude individual pixel errors as a safety-relevant error criterion. For example, EMC-induced changes in the image data stream can lead to insignificant changes in the individual Lead image, which the viewer can not recognize, are excluded in a simple manner. A positive test result can be formed, for example, if instead of 100% of the pixels, 90% of the pixels have a desired color value.

The solution according to the invention is particularly easy to implement in the case of a digital image data stream, but in principle can also be used in an analog-controlled display. The monitoring area can be specified variable to the test unit or can be stored in this fixed. As used herein, the term "surveillance area" means contiguous sets of individual pixels with respect to the image to be displayed, and includes any geometric shapes in the image to be displayed, in particular, but not limited to, polygonal or elliptical areas, including rectangular or circular areas. Suitably, all pixels of the predetermined monitoring range of the test sequence according to the invention are subjected. However, it is also possible to make a selection with a smaller number of pixels, but subject at least every other pixel to the comparison operation and consideration in the result variable.

An essential feature of the solution according to the invention is the fact that a plurality of pixels or pixels of the monitored area to be tested are compared with at least one of their display values for driving the display with one or only a few predetermined reference values. As a result, the reliable representation of a safety-relevant state in a multiplicity of applications can be checked and ensured in a particularly simple manner and with a particularly low expenditure on hardware.

For example, it can be reliably detected if a certain area is sufficiently in a particular color is shown. This ensures, for example, that a warning message to be displayed is actually displayed. In contrast to this assurance of minimal staining, the solution according to the invention also makes possible the complementary approach of recognizing maximum staining. It can thus be ensured, for example, that in the monitoring area a certain area proportion in the color green is only displayed if the status information corresponds to a safe operating state.

The comparison operation according to the invention can be implemented in different ways. Particularly simple is an identity comparison of a digital representation value with a digital reference value which has the same word length as the representation value. However, the comparison operation may also be performed as an inequality comparison. In particular, when it is to be checked whether the representation values for the individual pixels lie within a certain tolerance range, the comparison operation can be performed as a comparison, depending on whether the reference value represents an upper or lower limit value, that is currently in the test sequence considered representation value is smaller, less than / equal to, greater than / equal to, or greater than the reference value. Tolerance comparison is also technically easy to implement in other ways. In particular, for example, only a portion of the bits of the representation value that is of higher significance in the bit value may be compared to a reference value of lesser word length for identity. Due to the restriction to the higher-order bits, a tolerance for slight deviations, for example in the case of different color values of a hue, can be realized in a simple manner. Apart from the inequality comparison, which optionally uses upper and lower reference values, typically only one reference value is needed for the entire selection of items to be checked Pixels from the surveillance area.

The test unit or the method can provide parallel or simultaneous execution of several test sequences relating to several separate or partially overlapping monitoring areas.

The test sequence can be repeated individually for each screen layout or screen refresh. However, in order to reduce the required computing power and / or to introduce a temporal test tolerance, the test sequence can also extend over more than one image structure and preferably has a repetition rate in the range of human detectable, typically less than 30 Hz. The repetition rate of the test sequence can be expedient for a surveillance area, the 1 / n fraction of the refresh rate f.

In a preferred embodiment of the method or the device, the representation of an image comprises a color area whose color is determined by the computer depending on the state information. In particular, the color surface can symbolize a control or warning light or represent the background of a security-relevant, dynamically variable display, such as a tachometer.

In particular, in cases where the number of pixels does not or only slightly changes the variable information, as in a typical analog tachometer display, and in the color space security check, it is useful to provide that the threshold value for the result variable is determined as proposed according to the invention (see above).

In a computationally simple determination of the threshold, it is provided that the test sequence is the stepwise Increase or decrease a pixel counter. Thus, the threshold value for forming the result of the security check can be determined as a function of the pixel counter, for example as a percentage of the tested total number of pixels. The threshold value therefore does not have to be specified separately, but is automatically determined by the test sequence, depending on the size of the monitoring area and the selection made for the pixels to be tested.

In an expedient embodiment, it can furthermore be provided that the reference value valid for all pixels of the monitored area to be checked and / or the monitored area to be tested itself are also determined by the test unit. This is preferably done as a function of the status information which is supplied to the test unit for the determination of the reference value and / or the monitoring area.

In a design which is expedient for many applications, in particular for warnings, it is provided that the color values for the primary colors of a color space, in particular of an RGB color space with 8-bit word widths per color value, are used as display values in the image data stream. In the test sequence, at least one color value, preferably all color values, are then subjected as representation value to each pixel of the comparison operation according to the invention.

For comparison of color values, the comparison operation in the test sequence can be carried out in particular as a tolerance comparison, for example, if the actual pixel under consideration in all or one of its color values, in absolute or relative terms, is more than a certain percentage of a target color value as the reference value different.

Thus, instead of performing a bitwise identity comparison of the total display values for driving the pixel, the color-by-color comparison operation may be performed by considering the individual color values. This type of comparison operation allows e.g. Also, consideration of different color settings by the performing computer, for example, depending on user preferences and still recognizes the desired hues. The test sequence according to the invention can extend over each individual image structure. To reduce the computing power or energy saving, it may be provided, for example, that the test sequence only extends over regularly intermittent image structures in the sense of a sampling. In certain applications, a safety-related check is already ensured if, for example, every second image buildup is correct. Accordingly, it is sufficient in these cases not to examine the image directly but at regular intervals to examine it.

An intermittent execution of the test sequence also allows the verification of a flashing display area. For this purpose, a further test sequence is preferably provided, which extends in comparison to the abovementioned intermittent image structures on this alternately intermittent image structures and performs a comparison operation with a further, additionally stored reference value.

In an expedient embodiment, the state information is determined by a signal-technically secure control computer and, on the one hand, supplied to the computer, which generates the image data stream, and, on the other hand, to the test unit.

For retrofitting existing systems, it is particularly appropriate to run the test unit as a separate module separate from the display and separate from the computer. For safety reasons, it is expedient if the test unit for connection to the image data line, in particular parallel to the display, has a read-only input, and thus can not change the image data stream.

The test unit is conveniently implemented using an FPGA or ASIC. These can be readily configured or programmed to perform a method with the features described above.

The test unit expediently has, in addition to an input for the status information and the input for connection to the image data line, also an output for outputting the result of the safety test. This output can be connected, for example, to the fail-safe control computer for the purpose of initiating a safety-related reaction.

Finally, the invention also relates to a test unit for use in a device according to one of the embodiments described above, and finally also to the use of the device according to the invention in a vehicle, in particular in a rail vehicle.

FIG.1

eine schematische Darstellung einer Ausführungsform einer erfindungsgemäßen Vorrichtung z.B. für ein Schienenfahrzeug;

FIG.2

eine schematische Darstellung einer möglichen Digitalschaltung zur Durchführung der Prüfsequenz gemäß dem erfindungsgemäßen Verfahren;

FIG.3

eine schematische Darstellung einer zweiten Ausführungsform einer erfindungsgemäßen Vorrichtung z.B. für ein Schienenfahrzeug.

Further details, advantages and features of the invention can be taken from the following part of the description in which preferred embodiments of the method and apparatus for implementing it are explained in more detail with reference to 2 drawings. Show it:

FIG.1

a schematic representation of an embodiment of a device according to the invention, for example for a rail vehicle;

FIG.2

a schematic representation of a possible digital circuit for performing the test sequence according to the method of the invention;

FIG.3

a schematic representation of a second embodiment of a device according to the invention, for example for a rail vehicle.

The same and corresponding components are provided with the same reference numerals.

FIG. 1 shows the basic structure of a safety device 2 for carrying out the method according to the invention, for example in the cab of the railcar of a train.

The safety device 2, which is designated as a whole by 2, consists essentially of a commercially available PC 4, which generates image data as a representative computer and hereby activates a display consisting of a TFT panel or TFT display 6. The TFT display is connected via an image data line 8, e.g. of the LVDS type, connected to the PC 4 for driving the individual pixels via a sequential image data stream, such that line by line and ultimately page by page, an image is constructed and displayed by the TFT display 6. Furthermore, the safety device 2 comprises a test unit 10, which consists of microprocessors and, inter alia, an FPGA 12.

In the illustrated example, state information which characterizes a safety-relevant system state is supplied to the PC 4 and the test unit 10 via the data connection designated by the reference numeral 14. This value is taken into account within the PC 4 when creating the image data. These image data are supplied as a serial image data stream via the image data line 8 to the TFT display 6.

Among other things, safety-relevant information, eg a speedometer similar to a tachometer, is displayed on a demarcated portion of the PC TFT displays 6 shown, which is to be monitored as a monitoring area 16 safety. The displayed image including the security-relevant information in the monitoring area 16 is "pre-rendered" and thus predefined. In order to inform the user about a safety-relevant, critical state, the monitoring area hatched with a background in a warning color, for example in red, yellow or orange can be deposited. The corresponding background should be displayed when the status information via the data connection 14, in particular from a signal-technically secure control computer 20, signals a critical condition (eg immediate stop with a red background, stop at the next possible opportunity with an orange background or maintenance required with a yellow background).

The invention now makes it possible in a simple, reliable and efficient manner to check such monitoring areas 16 as to whether the state to be displayed is actually displayed correctly.

The image data stream fed via the LVDS image data line 8 to the TFT display 6 is tapped without change by the FPGA 12 of the test unit 10 via the read-back line 18 and a read-only input. The FPGA 12 subjects the image data to the surveillance area 16 of a security audit.

For this purpose, the RGB color values, ie in each case 24 bits to each of the selected pixels or pixels of the monitoring area, are successively read in pixel by pixel from the read-back line into a FIFO memory, eg a simple shift register 22 with no feedback with a width of 24 bits. The contents of the shift register are compared with a reference color value stored in a register 24 contained in the FPGA. If all bits to the respective RGB color value, or as with the circuit in FIG.2 testable in the sense of a tolerance comparison, the higher-order ones Bit are identical to the reference color value, a success counter 26 is increased by one value. At the same time, a pixel counter (not shown) can be increased for each pixel tested or selected within the monitoring area 16.

Upon completion of a test sequence, e.g. After a complete screen refresh, it is then checked how high the proportion of those pixels of the monitoring area 16 is that is actually displayed with the color corresponding to the state information.

If a predefinable threshold, which may also correspond to a proportion of the pixels, e.g. a proportion between 80% and 99%, the test unit 10 generates an output signal, e.g. to the secure control computer 20 which indicates the result of the security check, i. whether or not the color area is displayed correctly enough. For this purpose, the count of the success counter 26 is read out as the result variable after each test sequence.

For example, it can be ascertained for the monitoring area 16 whether a colored deposit of the tachometer does not have an exact color but a certain hue without requiring and checking an exact pixel-by-pixel match. This is in principle equal to the activation of a warning lamp whose display is monitored by current measurement.

FIG.2 shows a circuit that can easily exclude single pixel error as a safety-related error criterion. This is done in two stages, first by a tolerance comparison, which for each of the three RGB color values in the shift register 22 only the four most significant bits (Engl. Most significant bits) with a 4bit wide Compare reference value that is unchanged or fixed in register 24 for all pixels of the monitoring area 16. In a second step, it is checked whether the result variable determined as counter result by the counter 26 represents a sufficient, predetermined proportion of the pixels in the monitoring area 16, eg 85% if about 10% of the pixels do not serve as background, but to display other information, eg to show the speedometer in FIG.1 , At the same time, the variable presentation of information, which has no actual background, can be included without affecting the result of the safety check.

FIG.3 shows an embodiment in which the color display to be tested takes place instead of by the PC 4 or in addition to the PC 4, by another, code-based test module 30 in the pixel data line. This code-based test module 30 may have a structure according to EP2353089B1 respectively. EP2273369B1 or according to EP2254039B1 exhibit. A test unit 10 according to the present invention is connected downstream of the test module 30 and, according to the present invention, checks whether a safety-relevant display by the code-based test unit 30 is carried out correctly.

The safety check by the test unit 10 takes place at the same time to display an image on the display 16. This is achieved with little effort by serial processing of the data stream from the image data line 8 in a test sequence according to the invention. For this purpose, the computing power of commercially available FPGA is sufficient. The test unit 10 can also use other suitable processor-like components instead of an FPGA 12, e.g. use an ASIC.

To reduce the clock rate, the comparison operation instead of a purely serial processing can also be realized multi-channel, ie with several parallel-fed individual shift registers correspondingly smaller bit width.

Based on the teaching EP2353089B1 For example, the test unit 12 can generate an output signal for the purpose of initiating a safety-related reaction, in particular for switching off the display or output of a warning signal, as a function of the test result.

The monitoring area 16 is in the picture shown after FIG.1 suitably rectangular, but may have any geometry and does not have to consist of contiguous pixels. As a display 6, any type of technical device can be used in the security device 2 and within the scope of the invention with which any information can be represented visually detectable by controlling individual pixels (English pixel).

LIST OF REFERENCE NUMBERS

Fig.1-3

2

safety device

4

PC

6

TFT display

8th

LVDS image data line

10

test unit

12

FPGA

14

data line

16

monitoring area

20

higher level security computer

22

Shift register (FIFO memory)

24

register

26

success counter

30

code-based test unit

Claims (14)

1. A method for representing a safety-relevant state by means of a display (6), comprising:

   creating an image data stream by a processor (4) taking into account a status information, wherein the image data stream contains representation values, in particular color values;

   forwarding the image data stream (8) to the display (6) for representing an image by driving pixels on the basis of the representation values; and

   supplying of the image data stream to a test unit (10) for performing a computational safety test of a monitoring region (16), which comprises a contiguous set with a plurality of individual pixels of an image to be represented;

   CHARACTERIZED IN THAT

   a reference value valid for all pixels of said monitoring region (16) is determined and the test unit (10) stores this reference value (24);

   said test unit (10) in a test sequence computationally determines a result variable starting from the image data stream and for this purpose, successively and respectively for each pixel of a selection of pixels of the monitoring region (16), wherein said selection comprises at least every second pixel of the monitoring region to be tested,

   - performs a comparison operation between at least one representation value of the respective pixel and said stored reference value to form a comparison result; and

   - in order to determine said result variable, the respective comparison result for each pixel of the selection is taken into account, in particular by incrementally increasing or decreasing said result variable;

   and, after said test sequence has been carried out, comparing said result variable, which the test unit has computationally determined as a function of the comparison results, with a threshold value, preferably by means of said test unit (10),

   so as to form either a positive or negative result of the safety test, wherein said threshold value for said result variable is determined such that a positive result of the safety test is ascertained when a predetermined proportion of said selection of pixels satisfies the comparison criterion and this proportion is less than 100%.
2. The method according to claim 1, CHARACTERIZED IN THAT said comparison operation is carried out in form of

   - an identity comparison of the digital representation value with a digital reference value of identical word length;

   - a comparison of inequalities, in particular as a less than comparison, a less than or equal comparison, greater than or equal comparison or greater than comparison; or in form of

   - a tolerance comparison, in particular of a part of the bits of the representation value which is of a higher value in terms of bit value, with a reference value of shorter word length.
3. The method according to claim 1 or 2, CHARACTERIZED IN THAT said test sequence extends over more than one image frame and preferably has a repetition frequency of f/n, where f is the frame rate of the display (6) and n is an integer > 1.
4. The method according to any one of the preceding claims, CHARACTERIZED IN THAT representing of an image comprises a color area whose color is determined by the processor (4) depending on said status information, said color area in particular symbolizing a control or warning light or representing the background of a dynamically changing safety-relevant display (6).
5. The method according to any one of the preceding claims, in particular according to claim 4, CHARACTERIZED IN THAT said test sequence comprises the incremental increase or decrease of a pixel counter (26) and said threshold value used for forming the result of the safety test is determined as a function of the pixel counter.
6. The method according to any one of the preceding claims, CHARACTERIZED BY supplying said status information (14) to said test unit (10) and determining said reference value valid for all pixels of said monitoring region and/or said monitoring region by the testing unit (10) as a function of the status information.
7. The method according to any one of the preceding claims, CHARACTERIZED IN THAT color values are used as representation values for the basic colors of a color space, in particular an RGB color space with 8-bit word length per color value respectively, and in said test sequence at least one color value, preferably all color values, are subjected as a representation values for each pixel to said comparison operation, in particular to a comparison operation that is executed as a tolerance comparison.
8. The method according to any one of the preceding claims, in particular according to claim 3, CHARACTERIZED IN THAT said test sequence extends over regularly intermittent image frames, and preferably in that another test sequence extends over alternately intermittent image frames and performs a comparison operation with another stored reference value.
9. The method according to any one of the preceding claims, CHARACTERIZED BY supplying one or more pieces of status information (14) from a control processor (20), that is safe in terms of signaling-technology, to said processor (4) which generates the image data stream and to the test unit (10).
10. A device for representing a safety-relevant state, comprising:

    a display (6), in particular a TFT display;

    a processor (4) for computer-aided creation of an image data stream taking into account a status information, wherein the image data stream contains representation values, in particular color values, and for forwarding the image data stream (8) to the display (6) for displaying an image by driving the pixels on the basis of the representation values;

    as well as

    a test unit (10) to which the image data stream is supplied for carrying out a computational safety test of a monitoring region (16), which comprises a contiguous set including a plurality of individual pixels in the image to be represented;

    CHARACTERIZED IN THAT

    a reference value (24) valid for all pixels of said monitoring region is stored in said test unit (10);

    said test unit (10) is configured in order to computationally determine, in a test sequence, starting from the image data stream a result variable and for this purpose, successively and respectively for each pixel of a selection of pixels of said monitoring region (16), wherein said selection comprises at least every second pixel of the monitoring region to be tested,

    - to perform a comparison operation between at least one representation value of the respective pixel and said stored reference value to form a comparison result; and

    - in order to determine said result variable, to take into account said respective comparison result for each pixel of the selection, in particular by incrementally increasing or decreasing said result variable;

    and configured in order to, after said test sequence has been carried out, either output said result variable which the test unit (10) has computationally determined as a function of the comparison results, or to compare the latter with a threshold value, so as to form either a positive or negative result of the safety test, wherein said threshold value for said result variable is determined in such a way that a positive result of the safety test is ascertained when a predetermined proportion of said selection of pixels satisfies the comparison criterion and this proportion is less than 100%.
11. The device according to claim 10, CHARACTERIZED IN THAT said test unit (10) is configured as a separate module distinct from said display (6) and distinct from said processor (4), and has a read-only input (18), which can be connected in parallel to an image data line (8) that connects said display to said processor.
12. The device according to claim 10 or 11, CHARACTERIZED IN THAT said test unit comprises an FPGA (12) or ASIC configured to perform the method according to the characterizing features of one of claims 1 to 9.
13. The device according to any one of claims 10 to 12, CHARACTERIZED IN THAT said test unit (10) has an input (14) for status information and an output for outputting the result of the safety test.
14. A vehicle, in particular a railway vehicle, comprising a device according to any one of claims 10 to 13.

Images