FI91335C - Method and apparatus for input of information into signal-technically safe counter devices - Google Patents

Abstract

For simpler and more flexible input of information into computer systems with secure signalling via input devices with secure signalling, in which, for verification, displays with secure signalling and command-enabling keys with secure signalling are operated, according to the invention it is proposed that the input device is divided into a part with secure signalling and a part without secure signalling which is connected in series before it, that all information passes through the insecure part, whether input via it or processed into commands, and that all information and commands are automatically tested in the part with secure signalling for secure signalling relevance. If they are not relevant to security, they are passed directly to a control logic unit of the system, and the additional command security procedure is only required if they are relevant to security. A particular advantage is that modifications of the input and output processes can be implemented while minimising the part with secure signalling, using modifiable devices with insecure structure, without requiring additional testing. <IMAGE>

Description

i 91335

A method and apparatus for inputting data into signal-technically secure calculators

The invention relates to a method for inputting data in signal-technically secure computing devices, as further defined in the preamble of claim 1.

In safety-related equipment (eg setting devices, power plants, military equipment), it must be provided at the control stations that the mi-10 cannot enter these inputs uncontrollably from the point of view of the system and that the user can only provide information from the point of view of safety.

However, in addition to safety-relevant baits 15, there are also non-safety-relevant baits, in which case these baits are significantly more common. Much of such data concerns, for example, the pre-acquisition of data for complex systems.

Several procedures are known for electronic setting devices with signal-safe calculators (computers) (e.g. ETR 34 (1985), No. 11, pp. 789-796). The user interface is common to all signal-safe calculators, in which the method according to the publication "Pflichtenheft flir Fernsteuerzentralen bei der DB" is used to verify inputs relevant to safety. In this case, a signal-safe printer (command button) and a signal-safe color graphics display (color monitor) must be available.

30 The signal-proof calculators used to process the inputs are constructed either in two channels or in accordance with the principle of two out of three.

Both the calculators and the programs running on them must, according to the regulations, be constantly checked for the safety of their sig-35 signals, and the input and output environment connected to the calculator 2 may also have to be subjected to a non-interference check. These inspections are not only very expensive and time-consuming, but also prevent the transition to more modern equipment and methods and the introduction of such use between human-machine communication.

This is the case, for example, with the production of larger amounts of data - such as those which occur, for example, when preparing input data for complex systems (e.g. 10 semi-automatic train track settings or word processing interconnection) kåytånnollistå.

It is an object of the invention to provide a method by which this inspection work can be reduced and which makes it possible to implement a modified type of input and output method with associated equipment and accessories without the need for an additional check for signal-to-technical safety. Connected to.

This problem is solved by a method of the type already mentioned, according to the characterizing part of claim 1. Preferred embodiments of the device for carrying out the method according to the invention are set out in the subclaims.

By means of a schematic exemplary embodiment, the invention will be further illustrated in the following.

The figure shows the feeder for the electronic applicator-30. It has a signal-safe calculator 1 connected via the bus connection 2 to the actual interlocking device logic 3. A signal-safe display 4, a signal-safe command button 5 and an uncertain calculator 6 are connected to the calculator 1. This uncertain calculator 6 - input devices 91335 3, for example a keyboard and a display 8.

By means of the feeding device 7, the user provides all information only to the uncertain part of the feeding device. In this case, he checks the legality of the display 8 avul-5 la and concludes the case with the decision function. The information or also the processed commands are then plotted in a signal-safe part, i.e. in a signal-safe calculator 1. Here the command is checked for safety-relevant relevance and, when it is not safety-relevant, is passed directly to the applicator device 3. If on the other hand, the command is relevant from the point of view of security, so the calculator 1 is transferred to the command verification method and the command is only passed to the safety-related hardware 15 after a possible backup operation. The safety work includes information, including the display of any additional information that may be required, on a signal-technically secure display 4 (not necessarily color graphics), indicating that this is a safety-relevant input. Only after the use of the technically certain key 5 of the signal-20 (including the release) is the command further passed to the interlocking device 3. The uncertain calculator 6 can also be used with its peripheral devices to present or disclose uncertain information from the interlocking device. For such 25 area monitoring displays as well as protocol and fault notifications, no signal-safe devices are necessary.

For example, a non-variable display can also be considered a signal-technically secure display for the method described herein when the acquisition, transmission, processing and presentation of information are independent of the information displayed on display 8. The user checks the uniformity of the contents of screens 4 and 8.

In a particularly preferred embodiment, the insecure part of the input device 35 can be implemented with a personal computer (PC).

In a special form, it is also possible to connect several users with several insecure calculators 6, e.g. their personal computers, to a signal-insecure 5 calculator 1 in such a way that only one secure calculator 1 is required for several service points. Only one security-relevant input is controlled. user action.

The invention achieves the possibility of using insecure personal computers (PCs) in addition to minimizing the costs of signal verification. These PCs are inexpensive, simple to program, and have a more comprehensive range of peripherals than the high-end, secure calculators. Due to the direct suitability of programs that can be run on a personal computer, for example from simulations or commercial software packages, shorter development and commissioning times as well as higher user comfort are achieved.

Claims (3)

1. A method for entering information into signal-technically safe counters via signal-technically secure input devices, in which signal-technically safe displays and signal-technically safe instruction keys are used, characterized in that the input device is divided into a signal-technically secure part and a forward this coupled, signal-non-secure part, that all information is fed through the non-secure part or passes through the processed as instructions, and that all information and instructions are automatically tested in the signal-safe part for signal-technical relevance, whereby , when they are not security relevant, a direct forwarding to the steel logic of the device follows and only when they are security relevant, an additional instruction security procedure is required. Apparatus for realizing the method according to claim 1, characterized in that the signal technically safe part consists of a sucker counter (1), a signal technical sucker instruction key (5) and optionally a signal technical sucker image cutter (4), and The signal technically non-secure part is connected to the secure counter possibly through the non-secure counter (6) and its input / output environment (7, 8). 3. Device according to claim 2, characterized in that the safe counter (1) is connected via a bus connection to the non-safe counter (6), which in turn uses non-secure displays (8) and can be controlled via the input device ( 7) and an interface (9) for external instructions.