RS63339B2 - Train traffic control system and method for safe displaying a state indication of a route and train control system - Google Patents

Description

[0001] Description

[0002] Background of the present invention

[0003] This invention deals with a railway traffic control system that includes a route and train control system, an operator's workstation with a screen, and a safety status indicator component with a security level of SIL>0, more specifically SIL4, for indicating safety information about the state of elements of the route and train control system on the screen of the operator's workstation. The present invention further relates to a method for securely displaying status indicators of a route and train control system.

[0004] A suitable railway traffic control system is known from [1]

[0005] Route and train management systems are set up for safe route management, and safe movement approvals in railway networks for running trains and for control protection and protection of trains from speeding or outside their end of safe movement approvals. Typical systems for route and train control are for example signaling and safety systems, radio command centers or similar systems.

[0006] Remote control of signal-safety systems and other route and train control systems through traffic management systems is becoming increasingly important. Traffic management systems include a human machine interface for the control of route and train control systems by a human operator. The route and train control system receives commands from the traffic management system related to regular operation as well as related to safety critical operations. Safety-critical operations are carried out by the use of route and train control systems in special operational situations or in the event of disturbances. Compared to regular operations for which the acceptability can be checked at any time by the train control system, safety critical operations are assigned by the operator while bypassing elements of the route and train control system (eg radio command center or signaling safety system). That is safety critical operations are performed by the operator, e.g. security clearance of route, change of security critical point, etc. i.e. the operator can bypass the security setting of the system.

[0007] [0005] To control safety-critical operations, exceptional safety requirements must be met. In some cases, customers require not only safety-critical management of the route and train control system, but also indicators of the safe state of the route and train control system, e.g. in the case of safety-critical operations that bypass the signal-safety system, such as the "schriftlicher Befehl" and the "Ersatzsignal" operation. "Schriftlicher Befehl" is an operator's order to bypass the route and train control system manually, which must be issued to train employees or saved in writing in the case of e.g. operational errors. "Ersatzsignal" is an additional signal, which replaces the order to pass a stop sign. By performing such safety-critical operations, the operator can bypass the system's secure setup. The basis for the operator's decision whether to perform such a critical operation is the state of the route and train control system indicated on the operator's workstation screen. Therefore, it is essential that the status of the route and train control system is displayed accurately. According to operator workstations, which meet the required level of safety integrity (usually SIL2, sometimes even SIL4), they have been developed [1], [2], [3].

[0008] Customers are now demanding more and more integration of additional non-safety functionality or SIL0 functions in operator workstations [4]. Again, this leads to great effort as it has to be ensured that the SIL0 components do not interact ("ruckwirkungsfrei") with the SIL>0 environment of the operator's workstation. However, this still leads to high hardware costs for this dedicated computer and also high costs for software development, integration and testing, because all these components must be developed according to a high level of safety integrity (usually SIL4) according to the EN 50128 standard [5].

[0009] Existing solutions provide only little flexibility and do not meet client requirements. Clients are particularly looking for a web-based user interface that is flexible to work with. Users should be able to not only work for RTCS from the operator's central workstation but also from mobile phones. The web-based user interface is a configurable solution that provides the necessary flexibility.

[0010] A method for secure data transmission is disclosed in [2]. A procedure for verifying correct data transmission is disclosed in [3].

[0011] Document EP 3040862 A1 discloses a railway traffic control system comprising: a route and train control system, an operator's workstation with a display, wherein the operator's workstation comprises at least one basic integrity indicator component, with a security level of SIL0 for marking information with basic integrity on the screen, wherein the operator's workstation is set to generate graphic data on basic integrity information, a component of a safe state indicator with a security level of SIL>0 configured to convert state data concerning the state of elements of the route and train control system into graphical data and thus generate indicative data indicating safety information about the state of the elements of the route and train control system on the screen of the operator's workstation, wherein the component of the basic integrity indicator and the component of the safe state indicator are software components, wherein the component of the safe state indicator is functionally separated from the component of the basic integrity indicator, a secure channel connecting the component of the safe state indicator and the screen for the safe transmission of safety information about state of the elements of the route control system i train.

[0012] The subject of this invention

[0013] The object of this invention is to propose a system for controlling railway traffic, which, on the one hand, realizes the necessary high level of security for indicators of the safe state, and on the other hand, enables a significant reduction in costs and flexibility.

[0015] Description of the present invention

[0016] This case is solved by the railway traffic control system according to patent claim 1 and the process according to patent claim 9.

[0017] According to the present invention, the operator's workstation includes at least one basic integrity indicator component with a security level of SIL0 for marking information with basic integrity on the screen. An indication server is provided that includes a component of the safe state indicator with a security level of SIL>0, more specifically SIL4, for indicating safety information about the state of elements of the route and train control system on the screen of the operator's workstation, the component of the safe state indicator being functionally independent of the operator's workstation. Furthermore, a secure channel connecting the safe state indication server and the display is implemented for the secure transmission of safety information about the state of elements of the route and train control system.

[0018] Basic integrity indicator components and safe state indicator components represent software components, ie. encapsulated software building blocks.

[0019] The basic integrity indicator component means any type of information with basic integrity, such as train delay or weather conditions, of the railway traffic control system on the screen to inform the operator about certain conditions of the railway traffic control system, the controlled route and train control system and their elements with the safety-integrity level SIL0. Elements of the route and train control system can be e.g. field elements (points, signals, track-free detection systems, level crossings, etc.), logical elements (routes, safe movement approvals, line blocking systems, etc.), train elements (train parameters such as speed or train length, etc.) or field-related elements (zones for temporary speed restrictions, work areas of maintenance employees, fields of responsibility of the specific operator, etc.).

[0020] The safety status indicator component generates graphic data (indicative data) in order to indicate the safety status of the railway traffic control system, the controlled route and train control system and their elements with a safety-integrity level of SIL>0, more precisely SIL4, in order to reliably inform the operator about these conditions. Security operations can be executed based on these indicators.

[0021] According to the present invention, the basic integrity indicator component is integrated into the operator's workstation, while the safe state indicator component is functionally independent from the operator's workstation. In other words, the function for generating indicative data on safety information about the state of elements of the route and train control system (status data) is separated outside the operator's workstation, i.e. the secure state indicator component is functionally separate from the basic integrity indicator component and may (or may not) be installed in separate locations. Therefore, without the mutual influence of the SIL0 component of the basic integrity indicator with the component of the safe state indicator, it can be more easily ensured. Since the operator workstation includes only low-security components, the operator workstation can be constructed with basic integrity (specifically SIL0), which is much cheaper compared to the high-security operator workstation known from the prior art. Therefore, the inventive traffic control system allows economically advantageous safe indication of the status of elements of the route and train control system on the screen of the operator's workstation.

[0022] The transfer of safety information about the state of elements of the route and train control system between the safety condition indicator component and the screen is realized by providing a secure channel (communication channel between the indication server and the screen) that transmits graphic indicative data to the screen, and checksum information to the safety condition indicator component. Procedures for ensuring secure communications through this channel are implemented according to relevant standards (eg EN 50159) and the required level of security integrity.

[0023] On the operator's workstation screen, both basic integrity information and safety information, more specifically an indication of the safe state of the route and train control system, are displayed to the operator.

[0024] According to the invention, the safety indicator component is integrated into the route and train control system, i.e. to the sub-center of the railway traffic control system. In this case, no additional computer is needed, which makes this method of realization more effective. Again, an additional function must be integrated into all route and train control systems, which are under the control of the rail traffic control system.

[0025] The safe state indicator component can be integrated into the indication server. The indication server can be part of the route and train control system. This is particularly desirable in the case where there is no overall control center and only one (small) route and train control system needs to be controlled.

[0026] [0021] In an alternative embodiment, the system includes a control center, whereby the indication server is integrated into the control center. This way of realization is preferred in cases where the existing route and train control system (for example from different suppliers) controls, since there is no the need to integrate additional functions into the route and train control system. Well-known control centers, e.g. from DB "Betriebszentrale" or "Steuerzentrale" respectively and manage the tasks of controlling, securing and moving railway operations.

[0027] In a further alternative embodiment, the indication server is integrated in a remote computing center (remote from the screen). This enables the use of thin clients for the operator's workstation (to reduce the amount of power required, noise and space in the control center). A remote computer center can be part of a control center.

[0028] Preferably, the indication server is protected by a process, ie. the necessary level of security integrity is achieved by a process that, on the one hand, integrates the human user (operator) and, on the other hand, is controlled by the component of the route and train control system. A common industrial computer can be used as an indication server.

[0029] Alternatively, the indication server may be a composite security server. i.e. the indication server is a multi-channel server with a 2002 or 2003 architecture. Safety level SIL4 can be achieved with this implementation.

[0030] Preferably, the operator's workstation is integrated into the traffic management system. The traffic management system can include additional functions for managing the train operation, e.g. delay detection, train occupancy conflict detection, (automatic) conflict resolution, management of resources such as maintenance staff along the route, telecommunications integration and video surveillance. By integrating the operator's workstation into the traffic management system, only one set of input devices (mouse, keyboard, etc.) is required to control rail traffic. So that one operator can operate the train at the highest level as well as perform safety critical operations that require safe indication.

[0031] In a highly preferred embodiment, the secure channel is routed through the operator's workstation. In this case, no additional computer is needed to transfer security information. While, according to the prior art, the state data is transmitted and processed in the workstation leading to an overall security integrity of SIL>0 for the workstation itself, this invention uses the workstation only as a "gray channel" provided by a process that leads to additional needs for the security integrity of the workstation itself. This reduces development costs.

[0032] In a highly preferred embodiment, the safe state indicator component is configured to calculate a first checksum of indicative data generated by the safe state indicator component and is further configured to perform a checksum comparison and/or a pixel comparison of the pixmap data.

[0033] The security indicator component is preferably configured to retrieve the read-back component from the operator's workstation browser.

[0034] The present invention also relates to a method for securely displaying safety information on a route and train control system status indicator at a railway traffic control system operator's workstation as previously described, with the stages of patent claim 9.

[0035] Safety information is transmitted from the route and train control system to the indication server. The indication server generates graphical data (indicative data) from the safety information, which is then sent to the operator's workstation screen via a secure channel.

[0036] Graphical information data with basic integrity is, however, generated within the operator's workstation. Graphical information data with basic integrity is then transmitted within the operator's workstation to the display.

[0037] In a highly preferred embodiment, the secure channel is routed through the operator's workstation. In this case, the secure channel is at least partially part of the operator's workstation.

[0038] Preferably, the state data is converted to indicative pixmap data, and the indicative pixmap data is transmitted to the display using a procedure for verifying the correct transfer of pixmap data. The method for verifying the correct transmission of the pixmap data preferably includes: a) modifying at least one property of a fixed number of pixels selected from the indicative pixmap data in the first memory, wherein the selection is made randomly,

[0039] b) transfer of indicative pixmap data that includes modified pixels from the first memory to the second memory,

[0040] c) re-reading modified pixels from another memory, i

[0041] d) comparing the read-back modified pixels and the modified pixels of the first memory to verify the correct transfer of the indicative data from the pixmap, wherein at least one property is modified so that the modification cannot be observed when displaying the modified pixels on the graphics display. The corresponding procedure is described in [3].

[0042] In an extremely preferred variant, the indicative data generated by the safe state component are displayed in the Internet browser of the operator's workstation in order to provide the necessary flexibility.

[0043] In order to verify that the visualization of the indicative data in the browser is indeed what is intended to be displayed, a preferred variant ensures that the displayed indicative data is read again, in particular by generating pixmap data.

[0044] [0036] In an extremely desirable variant, the component of the safe state indicator generates the first checksum of the indicative data, the browser generates the second checksum of the re-read data and transmits the second checksum to the component of the safe state indicator through a secure channel, and the component of the safe state indicator compares the first checksum and the second checksum. Therefore, it can be checked whether the transfer of indicative data to the browser and displaying the transferred indicative data correctly. According to this implementation, the checksum comparison is performed remotely from the operator's workstation to a special security comparison from the SIL0 operator's workstation.

[0045] Alternatively or additionally, the browser transmits the read back data to the secure state indicator component via a secure channel, and the secure state indicator component compares the read back data with the indicative data (pixel comparison).

[0046] To avoid false-positive comparison, algorithms that check only a few pixels (eg according to [3]) or morphological comparison algorithms (eg according to [6]) are used.

[0047] The present invention realizes a method based on a secure graphical indication of the state of the route and train control system in a SIL0 traffic management system. Therefore, safety systems for route and train control, e.g. signal-safety, signaling systems can be controlled from the SIL0 traffic management system.

[0048] The inventive traffic control system enables the execution of safety-critical operations in a safety-critical system with reduced costs, more specifically the execution of safety-critical operations that require a safe display of the state of the route and train control system, e.g. because the route and train control system is bypassed by performing the corresponding critical operation.

[0049] Further advantages can be derived from the description and the attached drawing. The mentioned embodiments should not be interpreted as an exhaustive enumeration, but rather as an example to describe the present invention.

[0051] Drawings

[0052] This invention is shown in the drawing.

[0053] Fig. 1 shows the architecture of the traffic control system according to the state of the art.

[0054] Fig. 2 shows the architecture of a traffic control system not belonging to the invention with an indication server integrated in the control center.

[0055] Fig. 3 shows the architecture of a traffic control system according to the present invention with an indication server integrated into the route and train control system.

[0056] Fig. 4 shows the architecture of the traffic control system according to the present invention, wherein the safe state indicator component is integrated into the route and train control system without an indication server.

[0057] Fig. 5 shows the architecture of a traffic control system not belonging to the present invention with an indication server integrated in a remote computing center.

[0058] Fig. 6 shows the architecture of a traffic control system not belonging to the invention with a safe state integration component configured to detect an error in the transmission and/or display of indicative data and an Internet-based operator workstation.

[0059] FIG. 1 shows the architecture of the traffic control system according to the state of the art. The traffic control system includes the RTCS system for route and train control and the OW' operator's workstation with display D. The OW' operator's workstation includes components of the basic integrity indicator BIC with safety level SIL0 to indicate information on the D display with basic integrity (rail traffic management data). The OW' operator's workstation further includes a component of the SSC safe condition indicator with safety level SIL>0 for processing condition data (safety-relevant information about the conditions of RTCS train and route control system elements). That condition data is transmitted from the RTCS route and train control system to the SSC component of the safe condition indicator of the operator's workstation OW'. The SSC component of the Safe Condition Indicator converts the condition data into graphic data and thereby generates indicative data, which is then displayed on the D screen.

[0060] According to the present invention, the traffic control system includes an OW operator's workstation that does not include any components with a security level of SIL>0, ie. the operator's workstation only includes components with a safety level of SIL0 or less, such as BIC components of the basic integrity indicator. Since the SSC component of the safe state indicator has been replaced from the OW operator's workstation and is functionally independent from the OW operator's workstation, ie. applied in a different way, it can be ensured that there is no interaction between the SIL=0 operator workstation and the SIL>0 component of the safe state indicator.

[0061] Information with basic integrity is transmitted from the RTCS system for route and train control to the OW operator's workstation via channel C1. The safety information (status data) is however transferred to the SSC safety indicator component via a separate channel C2 to be generated according to the graphical indication data. Transmission channel C2 is a derived channel, e.g. performed by a security gateway to avoid manipulation of state data. Indicative data is transmitted from the SSC safe condition indicator component to the D screen from the operator's workstation. In order to avoid falsification of indicative data due to hardware or software malfunctions, data transmission is carried out via the secure C3 channel.

[0062] The SSC component of the safe state indication can be performed by the IS indication server as shown in FIG. 2, Fig. 3 and Fig. 5 (ie, an additional computer is provided to perform the SSC component of the safe state indicator) or a protected partition of the already existing traffic control system computer shown in Fig.4.

[0063] In the first embodiment that does not belong to this invention, shown in FIG.

[0064] 2, the SSC safety indicator component is integrated into a control center CC together with the operator's workstation OW. Non-interference between the OW operator's workstation and the SSC safety indicator component is ensured by providing a separate computer (IS indication server) for executing the SSC safety indicator component.

[0065] Instead of integrating the SSC safety indicator component into the CC control center, it is also possible to integrate the SSC safety indicator component into the RTCS system for route and train control, which is performed by either the indication server (Fig. 3) or the existing computer of the RTCS itself (Fig.

[0066] 4). If several RTCS route and train control systems are managed by a traffic control system, each RTCS route and train control system must be equipped with an appropriate SCC safety indicator component.

[0067] In an example, which does not belong to this invention, which is shown in FIG. 5, the IS indication server with the SSC component of the safe state indicator is integrated into the RZ computer center, which can be located at a distance from the OW operator's workstation.

[0068] FIG. 6 shows the architecture of a traffic control system of the present invention using an Internet-based operator workstation. The operator's workstation includes a browser B and a read-back component R. The SSC component of the safe state indicator is configured to retrieve the read-back R component from the OW operator's workstation. By executing the reread component R, the displayed indicative data is read again (reread data) and transferred to the SSC component of the safe state indicator.

[0069] The following stages describe the implementation of an extremely desirable variant of the inventive method using the traffic control system shown in Fig. 6. The corresponding steps of the procedure are preferably executed any time the operator uses the browser to execute security critical commands. Safety-critical commands can also be executed explicitly on demand, via a dedicated user interaction mechanism (key, dropdown, etc.). The preferred stages of the procedure are as follows:

[0070] 1. The Safe Condition Indicator component has the functionality to convert condition data into graphical indicative data. The secure state indicator component sends this indicative data over a secure channel to the operator's workstation browser. The browser displays this indicative data on the screen. The displayed data is re-read and the browser calculates the first checksum of the re-read data.

[0071] 2. The re-read data (pixmap data) together with the first checksum is sent to the secure state indicator component over a secure channel.

[0074] 1

[0075] 3. The security indicator component then compares the first checksum generated by the browser to the second checksum calculated by the security indicator component. The second checksum is a checksum of the indicative data generated by the safe state indicator component. Thus, it is verified that the indicative data sent to the browser, and the resulting re-read pixmap data sent from the browser over the secure channel, were not corrupted in any way en route.

[0076] 4. The safe state indicator component then performs a checksum comparison and (if applicable, more specifically if the checksum comparison is successful) a pixel comparison between the re-read data sent by the browser and the indicative data that the safe state indicator component itself generates based on the state data. If the comparison is successful, it sends a successful notification to the operator's workstation via a secure channel.

[0077] 5. Based on the response of the safe state indicator component, the critical command initiated by the operator will continue or terminate.

[0078] The inventive solution is based on the idea of moving the SIL>0 component of the SSC safety indicator from the OW operator's workstation and establishing a secure channel C3 (eg by using remote desktop protocols) of enhanced security measures, especially according to EN50159. This secure channel C3 is preferably routed through the OW operator's workstation using a procedure to verify the transmission of correct data. Therefore, this invention realizes a safe graphical indication of the state of elements of the railway control system (eg signal safety, RBC,...) in the workstation of the OW operator, more specifically within the TMS traffic management system that provides (only) a SIL0 environment.

[0080] Cited documents

[0081]

[0082] [1] EP 0443377 A2 (Lorenz)

[0083] [2] EP 2683589 B1 (Siemens)

[0084] [3] EP 2244188 A1 (Thales)

[0085] [4] Antweiler: "Bahn-Betriebsleitsistem ILTIS" Signal & Draht , 87 (1995) 10, Seiten 337 - 340 [5] EN 50128 "Telekommunikationstechnik, Signaltechnik und Datenverarbeitungssisteme" Ausgabe: 2012-03

[0086] [6] Mantere, Timo: "Electronic Imaging & Signal Processing - Image comparison based on morphological transforms" 29 November 2007, SPIE Newsroom. DOI: 10.1117/2.1200711.0926

[0087] List of call signs

[0088]

[0089] BIC component of the basic integrity indicator

[0090] C1 transmission channel for information with basic integrity

[0091] C2 transmission channel for safety relevant information (status data) C3 secure transmission channel for graphic indicative data

[0092] CC control center

[0093] D screen

[0094] IS indication server

[0095] OW operator workstation

[0096] RTCS system for route and train control

[0097] RZ computer center

[0098] The SSC component of the safe state indicator

[0099] TMS traffic management system

Claims (15)

1. Patent claims 1. Railway traffic control system that contains system (RTCS) for route and train control, an operator workstation (OW) with a display (D), wherein the operator workstation (OW) includes at least one basic integrity indicator component (BIC) with a safety level of SIL0 to indicate basic integrity information on the display (D), wherein the operator workstation (OW) is configured to generate graphical data of the basic integrity information, and wherein the operator workstation (OW) includes only components with a safety level of SIL0 or less, and a safety indicator component (SSC) with a safety level of SIL>0, more specifically SIL4, configured to convert route and train control system (RTCS) state data into graphic data and thus generate indicative data indicating safety information about the route and train control system (RTCS) state on the operator's workstation (OW) screen, where the component of the basic integrity indicator and the component of the safe state indicator represent software components, ie. encapsulated software building blocks, wherein a channel (C1) connecting the RTCS to the operator's workstation (OW) is provided to transmit information with basic integrity from the RTCS to the operator's workstation (OW), wherein the component (SSC) of the safe condition indicator is functionally independent of the operator's workstation (OW) and the component (SSC) of the safe condition indicator is functionally separated from the component (BIC) of the basic integrity indicator, wherein the function for generating indicative safety information about the condition of elements of the route and train control system is separated outside the operator's workstation, and in addition to the channel (C1), a safe channel (C3) connecting the safe condition indicator component (SSC) and the display (D) for the safe transmission of safety information about the condition of the elements of the system (RTCS) for route and train control, where the (SSC) component of the safe condition indicator is integrated into the (RTCS) route and train control system. 2. Railway traffic control system according to claim 1, characterized in that the component (SSC) of the safe state indicator is integrated into the server (IS) of the indication. 3. Railway traffic control system according to claim 2, characterized in that the system includes a control center (CC), whereby the indication server (IS) is integrated into the control center. 4. Railway traffic control system according to claim 2 or 3, characterized in that the indication server (IS) is integrated into the remote computer center (RZ). 5. A railway traffic control system according to any one of claims 2 to 4, characterized in that the indication server (IS) is protected by the method. 6. Railway traffic control system according to any one of claims 2 to 4, characterized in that the indication server (IS) is a composite security server. 7. A railway traffic control system according to one of the preceding claims, characterized in that the operator's workstation (OW) is integrated into the traffic management system (TMS). 8. A railway traffic control system according to one of the preceding claims, characterized in that the safe channel (C3) is directed through the operator's workstation (OW). 9. A method for securely displaying safety information about the status of a route and train control system (RTCS) at an operator's workstation (OW) of a railway traffic control system comprising a route and train control system (RTCS), an operator's workstation (OW) with a display (D), wherein the operator's workstation (OW) includes at least one basic integrity indicator component (BIC) with a safety level of SIL0 to indicate basic integrity information on the display (D), the operator's workstation configured to generate graphical data about information with basic integrity; and wherein the operator's workstation (OW) includes only components with a safety level of SIL0 or less, and a safe condition indicator component (SSC) with a safety level of SIL>0, more specifically SIL4, to convert route and train control system (RTCS) state data into graphic data and thereby generate indicative data indicating safety information about the route and train control system (RTCS) state on the operator's workstation (OW) screen, wherein the basic integrity indicator component and the components of the safe state indicator represent software components, ie. encapsulated software building blocks, where a channel (C1) connecting the route and train control system (RTCS) and the operator's workstation (OW) is provided for the transfer of information with basic integrity from the route and train control system (RTCS) to the operator's workstation (OW), whereby the component (SSC) of the safe condition indicator is functionally independent of the operator's workstation (OW), and the component (SSC) of the safe condition indicator is functionally separated from the component (BIC) of the basic integrity indicator, whereby the function for generating indicative data on safety information about the condition of the elements of the route and train control system is separated from the operator's workstation; a railway traffic control system further comprising an additional safe channel (C3) connecting the safety condition indicator component (SSC) and a display (D) for the safe transmission of safety information about the condition of the elements of the route and train control system (RTCS), wherein the safety condition indicator component (SSC) is integrated into the route and train control system (RTCS), whereby that procedure includes generating graphical data about information with basic integrity within the operator's workstation, converting condition data including safety-relevant information into graphical indicative data within a SIL>0 safe condition indicator component (SSC) that is functionally independent of the SIL0 operator workstation (OW) basic integrity indicator component (BIC), and transmission of indicative data to the screen (D) via a secure channel (C3). 10. The method according to claim 9, characterized in that the secure channel is directed through the operator's workstation (OW). 11. The method according to claim 9 or 10, characterized in that the indicative data represents pixmap data and wherein the indicative data is transmitted to the screen (D) using a procedure for verifying the correct transfer of pixmap data. 12. The method according to any one of claims 9 to 11, characterized in that the indicative data are displayed in the Internet browser of the operator's workstation. 13. The method according to claim 12, characterized in that the displayed indicative data is read again. 14. The method according to claim 13, characterized in that that the safety indicator component generates the first control sum of indicative data; 1 which the browser generates a second checksum of the reread data and transmits the second checksum to the secure state indicator component over the secure channel; and which the safe state indicator component compares the first checksum and the second checksum. 15. The method according to claim 13 or 14, characterized in that that the browser transmits the read-back data to the secure state indicator component over a secure channel; and which the safe state indicator component compares the read-back data with the indicative data. 1