METHOD AND SYSTEM FOR GENERATING AN OUTPUT IMAGE REPRESENTATIVE OF A STATUS OF A RAILWAY TRANSPORTATION PLANT

Abstract

 Described is a method for generating an output image representing a status of a railway transportation plant comprising a step of preparing a graphical data structure. The preparation includes the steps of: providing a reference image (3) for the plant, including symbols (30); a scan of a reference image (3) for identifying the symbols (30); a generation of the graphical data structure including a plurality of graphical data records (4), as a function of the symbols (30). The method comprises a step of: preparing management instructions, loading instructions for managing the graphical data structure in a calculation terminal (2); receiving, at the calculation terminal (2) a temporal succession of sets of input data (100), each set representing an updated status of the plant; generating, by a processing unit (200) of the calculation terminal (2), the output image, on the basis of the plurality of graphical data records (4) and on the set of input data (100) corresponding to the updated status of the plant, according to the management instructions.

Description

[0001] This invention relates to a method and a system for generating an output image representative of the status of a railway transportation plant or parts of it, that is to say, railway bodies such as signals, points, track circuits, level crossings and others.

[0002] In particular, the invention relates to the sector of generating an output image intended to be displayed on a display device (luminous panel) to be used by a railway operator. In this sector, it is important that the generation of the output image representative of the status of the transportation plant occurs in a safe manner, that is to say, such as to guarantee the correctness and the integrity of the image content, in such a way that the actions of the operators are performed in a safe manner and consistent with the status of the plant.

[0003] In this sector, there are prior art systems for providing an image representative of the status of a railway transportation plant. An example of such systems is described in patent EP3438828B1, which describes a system for displaying an image on a commercial off the shelf (COTS) device; however, such a system does not describe the way in which the image is generated, and therefore, when reading that document, an expert in the trade would consider that the system uses operating systems and/or graphics libraries which are commercial and uncertified for safety critical sectors. In effect, the images generated by these graphics libraries constitute an obstacle to reaching certain safety levels, as required in the safety critical sectors such as the railway sector.

[0004] Patent document EP0970869 describes a system wherein two processing units (indicated as BAM1 and BAM2) each create an image on the basis of icons present on two separate memories (SPC1 and SPC2); the two images are then voted on by a module (AZM), which, after checking that the two images are identical, provides a final image towards a monitor (GK). Such a system is not sufficiently safe, since it potentially allows two identical but incorrect images to be displayed.

[0005] Other examples of systems for generating an image representative of a status of a railway transportation plant are described in patent documents GB2323955A and EP2852869B1; however, not even these documents provide a solution which is able to satisfy the needs of the market.

[0006] The aim of the invention is to provide a method and a system for generating an output image representative of a status of a railway transportation plant which overcome the above-mentioned drawbacks of the prior art.

[0007] In particular, the aim of the invention is to provide a method and a system for generating an output image representative of a status of a railway transportation plant by constructing a graphics library conforming to the safety requirements of the railway sector.

[0008] A further aim of the invention is to provide a method and a system for generating an output image representative of a status of a railway transportation plant by constructing a graphics library which can be implemented in a secure terminal, that is to say, a terminal made with hardware and/or software architectures compliant with CENELEC EN50126, EN50128 and EN50129 standards.

[0009] Said aim is fully achieved by the method and system for generating an output image representative of a status of a railway transportation plant according to the invention as characterised in the appended claims.

[0010] The method comprises a step of preparing a graphical data structure. According to an example, the method comprises a step of preparing instructions for managing the corresponding output image, the management instructions being compliant with predetermined safety integrity requirements. The preparation of the graphical data structure may be performed, according to an example, by a configuration terminal, for example a commercial terminal. According to an example, the graphical data structure is generated starting from a reference image. For example, the reference image may be generated by a drawing tool, in a previous step, which is not relevant for describing the invention. The preparation of the graphical data structure preferably includes a step of providing a reference image. For example, the preparation of the graphical data structure may include a step wherein a reference image is provided to the configuration terminal. In general, the railway transportation plant includes a plurality of railway bodies, such as, for example, tracks, signals, points, level crossings and others; the railway bodies of the plurality of railway bodies may be positioned according to a configuration, that is to say, the plurality of railway bodies is positioned according to the configuration of the railway transportation plant. Therefore, the reference image includes symbols positioned according to the configuration of the railway transportation plant. In other words, each symbol of the symbols of the reference image represents a corresponding railway body of the plurality of railway bodies of the railway transportation plant.

[0011] The symbols may belong, for example, to a plurality of predetermined symbols. Each predetermined symbol may be representative of the aspect of a type of railway body.

[0012] The preparation step may include a scan of the reference image to identify the symbols included therein. According to an example, the preparation step includes a scan of a reference image to identify the symbols included therein.

[0013] Preferably, the graphical data structure includes a plurality of graphical data records. According to an example embodiment, the graphical data records may be tuples. For this purpose, the preparation step includes generating the graphical data structure including a plurality of graphical records. The graphical data records may be generated as a function of the symbols identified. For example, the graphical data records may be generated as a function of an arrangement of the symbols identified inside the reference image.

[0014] The method may comprise a step of checking the correctness of the graphical data structure, to guarantee a predetermined level of safety integrity. According to an example, the method may comprise a step of preparing instructions for managing the output image. The instructions for managing the output image may meet predetermined safety integrity requirements.

[0015] For example, the step of providing a reference image may be performed by a first channel of a configuration terminal (that is to say, a first channel or a configuration terminal may run a first drawing software to provide a reference image).

[0016] The step of scanning the reference image and/or the step of generating the graphical data structure may be performed by a first channel of a configuration terminal (that is to say, a first channel or a configuration terminal may run a first drawing software to scan the reference image and/or to generate the graphical data structure).

[0017] In particular, the step of checking the correctness of the graphical data structure may comprise a first control step. Preferably, in the first control step, a configuration terminal checks that the plurality of records of the graphical data structure complies with a plurality of predetermined representation rules; the predetermined representation rules may be representative of drawing rules relating to graphical representations in the railway sector. The predetermined representation rules (that is, the drawing rules) may include one or more of the following conditions: a relative position between the symbols, an overlapping of the symbols and/or a relative arrangement between the symbols and others.

[0018] The step of checking the correctness of the graphical data structure may comprise a second control step. The second control step may be performed in response to a positive outcome of the first control step.

[0019] Preferably, the method comprises a (further) step of providing a further reference image, through a second channel of a configuration terminal (that is to say, a second channel or a configuration terminal may run a second drawing software to provide a further reference image). In particular, the second channel is independent of the first channel.

[0020] The method may comprise a (further) step of scanning the further reference image and/or a (further) step of generating a graphical data structure through a second channel of a configuration terminal (that is to say, through a second channel or a configuration terminal which execute a second drawing software for scanning the further reference image and/or for generating the graphical data structure).

[0021] In the second checking step, the reference image is compared with the further reference image. Said comparison may be performed byte-to-byte or by generating a signature and a further signature, respectively starting from the reference image and from the further reference image and a comparison between the signature and the further signature. For example, in response to a positive outcome of the second control step, the management instructions and the graphical data structure may be loaded in the calculation terminal.

[0022] The method comprises a step of loading the graphical data structure to a calculation terminal. For example, the method may comprise a step of loading management instructions. According to a preferred example, the calculation terminal forms a safe component, that is to say, the calculation terminal is a component which complies with CENELEC EN50126, EN50128 and EN50129 standards, that is to say, the calculation terminal may comprise one or more hardware and/or software modules made in accordance with CENELEC EN50126, EN50128 and EN50129 standards. The method comprises a step of receiving input data at a calculation terminal. According to an example, the method comprises a step of receiving input data, sent by a command and control platform, that is to say, a safe core. Preferably, the method comprises a step of receiving sets of input data, for example the sets of input data may be positioned in temporal succession, in such a way that each set of input data is representative of an updated status of the railway transportation plant.

[0023] According to a preferred example, the method comprises a step of receiving a temporal succession of sets of input data, from a command and control platform, each set of input data being representative of an updated status of the railway transportation plant.

[0024] Preferably, each input data of a set of input data indicates the status of a railway body, such as, for example, a track, a signal, points, a level crossing; in this way, a set of input data indicates the status of the railway transportation plant, that is to say, of the railway bodies included in the railway transportation plant, at a predetermined moment, and the temporal succession of sets of input data indicates, in temporal succession, the status of the railway bodies included in the railway transportation plant. Since, preferably, each input data of a set of input data indicates the status of a railway body and a corresponding railway body is associated with each symbol of the reference image, then each input data indicates the status of a symbol; therefore, a set of input data indicates the status of one or more symbols included in the reference image.

[0025] The method includes a step of generating the output image. Preferably, the method includes a step of generating the output image, by a processing unit of the calculation terminal. According to an example, the method includes a step of generating the output image on the basis of the plurality of graphical data records. According to an example, the method includes a step of generating the output image on the basis of the set of input data. Preferably, by means of a processing unit of the calculation terminal, accordantly with each updated status of the railway transportation plant, the method comprises a step of generating the output image, on the basis of the plurality of graphical data records and on the set of input data corresponding to the updated status of the railway transportation plant. For example, the generating step may be performed according to the management instructions.

[0026] In particular, the management instructions form a non-commercial graphics library. For this reason, the output image is formed without using a commercial graphics library, that is to say, a third-party graphics library. In effect, by preparing the graphical data structure, drawing information is provided to the calculation terminal, that is to say, the information from which the output image is subsequently made.

[0027] The term "commercial", referring to graphics libraries, means that the graphics library may not comply with the requirements of CENELEC 50128 (to obtain certification for a certain level of SIL safety). A commercial graphics library can be available free of charge or upon payment of a license. Thus, the term "non-commercial graphics library" means a graphics library which has a certification (for example, a certification for a certain level of SIL safety) and/or whose source code is possessed and the term "commercial graphics library" means a graphics library which does not have safety certifications and/or the source code is unavailable.

[0028] It should be noted that the management instructions are prepared by a configuration terminal, whilst the generation of the output image is performed by a calculation terminal, preferably separate from the configuration terminal.

[0029] Preferably, the steps of providing the reference image, scanning the reference image and generating the graphical data structure are performed by the configuration terminal.

[0030] It should be noted that the invention, since it does not require a template of preformed icons for forming the output image, could also be used for generating any type of image in contexts other than railway contexts. According to an example, the reference image includes a plurality of pixels. According to an example, each graphical data record of the plurality of graphical data records includes position information. The position information may include an index representing a position of a pixel inside the reference image. In other words, the method may comprise a step of associating, to each graphical data record of the plurality of graphical data records, a position information, representing a position of a pixel inside the reference image; thus, in this case, the number of graphical data records is equal to the number of pixels of the reference image. For example, the reference image may include a plurality of pixels, positioned according to a matrix of m-rows and n-columns; The position information may include an index, representing the position of a pixel inside the pixel matrix. For example, for this purpose, the index may include a first index, indicating the column in which the pixel is located, and a second index, indicating the row in which the pixel is located; in this way, the first index and the second index uniquely represent the position of the pixel inside the reference image.

[0031] According to an example embodiment, the reference image comprises a plurality of pixels and each graphical data record includes information of the colouring information of a pixel of the plurality of pixels. For example, the output image may include a plurality of pixels, corresponding to the plurality of pixels of the reference image, and the colouring information may be used by the processing unit to derive a colouring information to be assigned to a pixel of the plurality of pixels of the output image. In other words, the method may comprise a step of associating, to each graphical data record of the plurality of graphical data records, colouring information for a pixel of the plurality of pixels of the output image. The colouring information can include one or more objects from the following list:

• symbol information, representing the one or more symbols to which the corresponding pixel belongs,
• overlapping information, representing a possible overlapping of more than one symbol in the corresponding pixel,
• transparency information, representing a transparency of the pixel (that is to say, of the transparency which the pixel must have in the output image); the transparency information is derived on the basis of the intensity of the colouring information of the corresponding pixel inside the symbol to which it belongs,
• default colouring information, representing a predetermined colouring information associated with the symbol to which the corresponding pixel belongs.

[0032] For this reason, the overlapping information indicates a possible overlapping of two or more symbols in a same pixel, for example the overlapping information for a pixel may include a positive value, in the case of overlapping between two or more symbols, or a negative value, in the case of non-overlapping. The symbol information may include a symbol value, for example a numerical value, which uniquely identifies the symbol to which the pixel belongs; in the case of a positive value of the overlapping information, the symbol information may include two or more symbol values, that is, two or more numerical values, which identify the two or more symbols to which the pixel belongs. The transparency information, for example, indicates, on the basis of the intensity of colouring information of the corresponding pixel inside the symbol to which it belongs, the transparency value of the pixel. For example, the transparency information may include a percentage transparency value. The default colouring information indicates the predetermined colouring information associated with the symbol to which the corresponding pixel belongs. Preferably, the default colouring information indicates a colouring information of the symbol to which the pixel belongs if an input data of the temporal succession of sets of input data does not include, that is to say, does not indicate, the status of said symbol.

[0033] According to an embodiment, the reference image includes a plurality of pixels and the position information may include a plurality of indices. Preferably, for one or more data records of the plurality of data records, the position information may include a plurality of indices. The plurality of indices may represent a position of a corresponding group of pixels inside the reference image. For example, for one or more data records of the plurality of graphical data records, the position information may include a plurality of indices, the plurality of indices representing a position of a corresponding group of pixels inside the reference image, in which the pixels of the group of pixels share the same colouring information. For example, a graphical data record includes a plurality of indices; each index of the plurality of indices indicates the position, inside the pixel matrix, of the pixels of a group of pixels, the pixels of the group of pixels sharing the same colouring information. According to another example, a graphical data record includes a plurality of indices, each index of the plurality of indices can indicate one or more data records, the one or more data records including the same colouring information for a group of pixels. In other words, the method may comprise a step of identifying a group of graphical data records, the group of graphical data records including the same colouring information for a corresponding group of pixels of the plurality of pixels of the reference image. The method may comprise a step of grouping together the group of graphical data records into a same graphical data record, the same graphical data record including the colouring information of the group of pixels and including position information relative to the position of each pixel of the group of pixels; In this case, the number of graphical data records is less than the number of pixels of the reference image.

[0034] The generation of the output image may include, for one or more graphical data records of the plurality of graphical data records, a derivation of an RGB value. Preferably, for each graphical data record of the plurality of graphical data records, the method includes a step of deriving an RGB value. For example, the RGB value may be derived on the basis of a set of input data. For example, the RGB value may be derived on the basis of the respective colouring information. The output image may comprise a plurality of pixels and the method may include a step of selecting a pixel of the output image, on the basis of the respective position information. The output image may comprise a plurality of pixels and the method may comprise the application of the derived RGB value to the selected pixel of the output image.

[0035] According to an example embodiment, the reference image may include a plurality of pixels and the method may include a step of selecting a group of pixels, the pixels of the group of pixels sharing the same colouring information. The method may include a step of deriving an RGB value on the basis of a set of input data. The method may include a step of deriving an RGB value on the basis of the respective colouring information. The output image may include a plurality of pixels and the method may comprise the application of the derived RGB value to the selected group of pixels of the output image. Preferably, the generation of each output image includes deriving an RGB value, on the basis of a set of input data and respective colouring information, for each graphical data record of the plurality of graphical data records; a selection of one or more pixels of the output image, based on the respective position information; an application of the derived RGB value to the one or more selected pixels of the output image.

[0036] According to an example embodiment, the image comprises a plurality of pixels and the colouring information includes overlapping information, representing an overlapping between a first symbol and a second symbol in the corresponding pixel. For example, the reference image comprises a plurality of pixels and, for a graphical data record of the plurality of graphical data records, the colouring information includes overlapping information, representing an overlapping between a first symbol and a second symbol in the corresponding pixel. The generation of each output image may include, for a graphical data record, a derivation of a first RGB value and a second RGB value on the basis of the colouring information of the graphical data record and the input data relevant to the first and the second symbol, respectively. The method may include a step of deriving a combined RGB value, on the basis of a first RGB value and a second RGB value and a predetermined algorithm. The method may include a step of applying a combined RGB value to one or more selected pixels of the output image.

[0037] According to an example embodiment, the reference image includes a plurality of pixels and the scanning includes a derivation of a sub-set of pixels of the plurality of pixels. For example, the pixels of the sub-set of pixels may belong to the symbols identified and represent the symbols. For example, the sub-set of pixels of the plurality of pixels may constitute a set of useful pixels, that is to say, the method may comprise a step of preparing a graphical data structure, the graphical data including a plurality of graphical data records, the preparation including a step of scanning the reference image to identify the symbols included therein, that is to say, the set of useful pixels.

[0038] According to an example, the position information of the plurality of graphical data records may exclusively relate to the sub-set of pixels, that is to say, the useful set of pixels of the reference image. For example, the position information may include an index representing a position of a pixel of the sub-set of pixels inside the reference image. According to an example, the colouring information of the plurality of graphical data records may exclusively relate to the sub-set of pixels, that is to say, the useful set of pixels of the reference image. Therefore, the method may comprise a step of generating the output image, accordantly with each updated status of the railway transportation plant, on the basis of the plurality of graphical data records for that sub-set of pixels and on the basis of the set of input data corresponding to the updated status of the railway transportation plant. For example, the colouring information of the plurality of data records may relate exclusively to the sub-set of pixels, that is to say, the useful set of pixels; in this way, the processing unit may derive the RGB value exclusively for that sub-set of pixels. In other words, the method may comprise a step of generating each output image, the generation including a step of deriving an RGB value, on the basis of a set of input data and respective colouring information for each graphical data record of the plurality of graphical data records, relating to the sub-set of pixels, a step of selecting one or more pixels of the output image, corresponding to one or more pixels of the sub-set of pixels of the reference image, on the basis of the respective position information, a step of applying the derived RGB value to the one or more pixels of the sub-set of selected pixels of the output image.

[0039] According to an example embodiment, the processing unit includes a first processor and a second processor and the method may comprise a step wherein the temporal succession of sets of input data is loaded on both the first processor and the second processor. The method may comprise a step wherein the graphical data structure is loaded on both the first processor and the second processor. The method may comprise a step wherein the first processor generates the succession of output images and the second processor generates a further succession of output images; In this way, for each output image generated by the first processor, a corresponding further output image is generated by the second processor starting from the same set of input data. The method further comprises a step of checking consistency between each output image and the corresponding further output image.

[0040] According to an example embodiment, the calculation terminal includes a two-way communication channel between the first processor and the second processor. The method may also comprise a step of processing, by the first processor and the second processor, in a parallel fashion, an output image and a corresponding further output image, generated starting from the same set of input data, to derive, respectively, a signature and a further signature. According to an example, the signature and the further signature are derived by applying a same function which uniquely identifies the output image and the further output image, respectively; for example, the function may be a HASH function. The method may comprise a step of sharing, through the two-way communication channel, the signature and the further signature between the first processor and the second processor. The method may comprise a step of checking, by the first processor and the second processor, a consistency between the signature and the corresponding further signature. Depending on said check, the method may comprise a step of transmitting the output image (that is to say, the image is provided at the output), by the processing unit. According to an example embodiment, the method further comprises a step, by the first processor and the second processor for processing the signature and the further signature to generate, respectively, a check signal and a further check signal. According to an example, the check signal and the further check signal represent a consistency between the signature and the further signature, ascertained by the first and the second processor, respectively. The check signal and the further check signal may represent a positive outcome of the check of the consistency between the signature and the corresponding further signature, or a negative outcome of the check. The method may also include a step of transmitting, by the first processor and the second processor, the check signal and the further check signal to a watchdog circuit. The method may comprise, in the case of a negative outcome of the consistency check, a step of inhibiting the transmission of the output image, by the watchdog circuit.

[0041] According to an embodiment, the method comprises a step for receiving, at a processing unit of a calculation terminal, by a command and control platform of a temporal succession of sets of input data, each set of input data representing an updated status of the railway transportation plant; the method may comprise a step of accessing, by the processing unit, a memory including a graphical data structure, the graphical data structure including a plurality of graphical data records and a plurality of predetermined symbols, wherein the plurality of graphical data records represent the symbols included in a reference image of the railway transportation plant and represent the position of the symbols inside the reference image; the method may comprise a step, by the processing unit, accordantly with each updated status of the railway transportation plant, for generating the output image, on the basis of the plurality of graphical data records and on the set of input data corresponding to the updated status of the railway transportation plant. According to an example, the graphical data structure conforms to a predetermined level of safety integrity. The memory may include instructions for managing the output image complying with predetermined safety integrity requirements. In that case, the method may comprise a step of generating the output image, by the processing unit, accordantly with each updated status of the railway transportation plant according to the management instructions.

[0042] The invention also provides a system for generating an output image representing a status of a railway transportation plant.

[0043] The system comprises a calculation terminal. According to an example, the calculation terminal constitutes a safe component, that is to say, the calculation terminal is a component which complies with CENELEC EN50126, EN50128 and EN50129 standards, that is to say, the calculation terminal comprises one or more hardware and/or software modules made in accordance with CENELEC EN50126, EN50128 and EN50129 standards. The calculation terminal includes a processing unit. The calculation terminal, that is to say, a processing unit of the calculation terminal, may be programmed to receive input data. The calculation terminal, that is to say, a processing unit of the calculation terminal, may be programmed to receive input data, sent by a command and control platform. Preferably, the processing unit is programmed for receiving, by a command and control platform, a temporal succession of sets of input data, each set of input data representing an updated status of the railway transportation plant. Preferably, each input data of a set of input data indicates the status of a railway body, such as, for example, a track, a signal, points, a level crossing; in this way, a set of input data indicates the status of the railway transportation plant, that is to say, of the railway bodies included in the railway transportation plant, at a predetermined moment, and the temporal succession of sets of input data indicates, in temporal succession, the status of the railway bodies included in the railway transportation plant.

[0044] The calculation terminal may include a memory. A graphical data structure may be loaded inside the memory. According to an example, a configuration terminal, for example a commercial terminal, may be programmed to generate the graphical data structure. The graphical data structure is obtained (generated) starting from a reference image. According to an example, the graphical data structure conforms to a predetermined level of safety integrity. The memory may comprise instructions for managing the output image. The management instructions may comply with predetermined safety integrity requirements. Preferably, the railway transportation plant includes a plurality of railway bodies, such as, for example, tracks, signals, points, level crossings and others; the railway bodies of the plurality of railway bodies may be positioned according to a configuration, that is to say, the plurality of railway bodies is positioned according to the configuration of the railway transportation plant. Therefore, the reference image includes symbols positioned according to the configuration of the railway transportation plant. In other words, each symbol of the symbols of the reference image represents a corresponding railway body of the plurality of railway bodies of the railway transportation plant. The symbols may belong, for example, to a plurality of predetermined symbols. Each predetermined symbol may be representative of the aspect of a type of railway body. Since, preferably, each input data of a set of input data indicates the status of a railway body and a corresponding railway body is associated with each symbol of the reference image, then each input data indicates the status of a symbol; therefore, a set of input data indicates the status of one or more symbols included in the reference image.

[0045] Preferably, the graphical data structure includes a plurality of graphical data records. The graphical data records may represent the symbols included in the reference image. The graphical data records may represent the position of the symbols included in the reference image. The processing unit may be programmed for executing the management instructions. The processing unit may be programmed for generating the output image. Preferably, the processing unit is programmed for generating the output image, on the basis of the input data, corresponding to the updated status of the plant. The processing unit is programmed for generating the output image on the basis of the plurality of graphical data records. According to an example, the processing unit is programmed for generating the output image on the basis of the plurality of graphical data records, according to the management instructions.

[0046] According to an example, the system comprises a calculation terminal, the calculation terminal is a component compliant with predetermined safety integrity requirements and includes a processing unit, programmed to receive, from a command and control platform, a temporal succession of sets of input data, each set of input data representing an updated status of the railway transportation plant. Preferably, the terminal includes a memory, in which a graphical data structure is loaded, the graphical data structure including a plurality of graphical data records, in which the graphical data records represent the symbols included in a reference image of the railway transportation plant and represent the position of the symbols inside the reference image; the memory may comprise instructions for managing the output image, the management instructions may comply with predetermined safety integrity requirements. Preferably, the processing unit is further programmed for executing the management instructions and for generating the output image, accordantly with each updated status of the plant, on the basis of the plurality of graphical data records and on the set of input data corresponding to the updated status of the railway transportation plant.

[0047] For example, the system may comprise a configuration terminal and the configuration terminal may comprise a first channel. The configuration terminal, that is to say, the first channel, may be programmed to run a first drawing software, for example to provide a reference image. The configuration terminal, that is to say, the first channel, may be programmed to run a first drawing software, for example for scanning the reference image for identifying the symbols contained inside the reference image and/or for generating a graphical data structure representing the symbols contained inside the image.

[0048] According to an example, the configuration terminal may be programmed to check a correctness of the graphical data structure. In particular, the configuration terminal may be programmed to perform a first control. In the first control, the configuration terminal is programmed to check that the plurality of records of the graphical data structure complies with a plurality of predetermined representation rules. The predetermined representation rules may be representative of drawing rules relating to graphical representations in the railway sector. The predetermined representation rules may include one or more of the following conditions: a relative position between the symbols, an overlapping of the symbols and/or a relative arrangement between the symbols and others.

[0049] According to an example, the configuration terminal may be programmed to perform a second control, for example in response to a positive outcome of the first control.

[0050] For example, the configuration terminal may comprise a second channel. The configuration terminal, that is to say, the second channel may be programmed to run a second drawing software, for example providing a further reference image. The configuration terminal, that is to say, the second channel may be programmed to run a second drawing software for scanning the further reference image for identifying the symbols contained inside the further reference image and/or for generating the graphical data structure representing the symbols contained inside the further reference image.

[0051] The configuration terminal may be programmed to compare the reference image with the further reference image.

[0052] In response to a positive outcome of the second control, the management instructions and the graphical data structure may be loaded in the calculation terminal. In other words, in response to a positive outcome of the second control, the configuration terminal may be configured for loading the management instructions and the graphical data structure in the calculation terminal.

[0053] According to an example, the reference image includes a plurality of pixels. According to an example, each graphical data record of the plurality of graphical data records includes position information. According to a preferred example, the position information comprises an index representing a position of a pixel inside the reference image; thus, in this case, the number of graphical data records is equal to the number of pixels of the reference image. For example, the reference image may include a plurality of pixels, positioned according to a matrix of m-rows and n-columns; The position information may include an index, representing the position of a pixel inside the pixel matrix. For example, for this purpose, the index may include a first index, indicating the column in which the pixel is located, and a second index, indicating the row in which the pixel is located; in this way, the first index and the second index uniquely represent the position of the pixel inside the reference image.

[0054] According to an example embodiment, the reference image comprises a plurality of pixels and each graphical data record includes information of the colouring information of a pixel of the plurality of pixels. For example, the output image may include a plurality of pixels, corresponding to the plurality of pixels of the reference image, and the colouring information may be used by the processing unit to derive a colouring information to be assigned to a pixel of the plurality of pixels of the output image. In other words, the processing unit may be programmed to derive a colouring information to be assigned to a pixel of the plurality of pixels of the output image.

[0055] The colouring information can include one or more objects from the following list:

• symbol information, representing the one or more symbols to which the corresponding pixel belongs,
• overlapping information, representing a possible overlapping of more than one symbol in the corresponding pixel,

• transparency information, relating to the transparency of the corresponding pixel,
• default colouring information, representing a predetermined colouring information associated with the symbol to which the corresponding pixel belongs.

[0056] For this reason, the overlapping information indicates a possible overlapping of two or more symbols in a same pixel, for example the overlapping information for a pixel may include a positive value, in the case of overlapping between two or more symbols, or a negative value, in the case of non-overlapping. The symbol information may include a symbol value, for example a numerical value, which uniquely identifies the symbol to which the pixel belongs; in the case of a positive value of the overlapping information, the symbol information may include two or more symbol values, that is, two or more numerical values, which identify the two or more symbols to which the pixel belongs. The transparency information, for example, indicates, on the basis of the intensity of colouring information of the corresponding pixel inside the symbol to which it belongs, the transparency value of the pixel. For example, the transparency information may include a percentage transparency value. The default colouring information indicates the predetermined colouring information associated with the symbol to which the corresponding pixel belongs. Preferably, the default colouring information indicates a colouring information of the symbol to which the pixel belongs if an input data of the temporal succession of sets of input data does not include, that is to say, does not indicate, the status of said symbol.

[0057] According to an embodiment, the reference image includes a plurality of pixels and the position information may include a plurality of indices. Preferably, for one or more data records of the plurality of data records, the position information may include a plurality of indices. The plurality of indices may represent a position of a corresponding group of pixels inside the reference image. For example, for one or more data records of the plurality of graphical data records, the position information may include a plurality of indices, the plurality of indices representing a position of a corresponding group of pixels inside the reference image, in which the pixels of the group of pixels share the same colouring information. For example, a graphical data record includes a plurality of indices; each index of the plurality of indices indicates the position, inside the pixel matrix, of the pixels of a group of pixels, the pixels of the group of pixels sharing the same colouring information. According to another example, a graphical data record includes a plurality of indices, each index of the plurality of indices can indicate one or more data records, the one or more data records including the same colouring information for a group of pixels. In other words, the processing unit may be programmed to identify a group of graphical data records, the group of graphical data records including the same colouring information for a corresponding group of pixels of the plurality of pixels of the reference image. The processing unit may be programmed to group together the group of graphical data records in a same graphical data record, the same graphical data record including the colouring information of the group of pixels and including position information relative to the position of each pixel of the group of pixels; In this case, the number of graphical data records is less than the number of pixels of the reference image.

[0058] According to an example, the processing unit is programmed to derive an RGB value, on the basis of a set of input data. The processing unit may be programmed to derive an RGB value on the basis of colouring information. The processing unit may be programmed to derive an RGB value for each graphical data record of the plurality of graphical data records. The output image may comprise a plurality of pixels and the processing unit may be programmed for selecting one or more pixels of the output image. The output image may comprise a plurality of pixels and the processing unit may be programmed for selecting one or more pixels of the output image, on the basis of the respective position information. The processing unit may be programmed to apply a derived RGB value. The output image may comprise a plurality of pixels and the processing unit may be programmed for applying a derived RGB value to the one or more selected pixels of the output image. According to an example, the processing unit is programmed to derive an RGB value, on the basis of a set of input data and the respective colouring information, for each graphical data record of the plurality of graphical data records; the processing unit may be programmed to derive an RGB value, on the basis of a set of input data and the respective colouring information, for each graphical data record of the plurality of graphical data records; the processing unit may be programmed to select one or more pixels of the output image, on the basis of the respective position information and to apply the derived RGB value to the one or more selected pixels of the output image.

[0059] According to an example embodiment, the image comprises a plurality of pixels and the colouring information includes overlapping information, representing an overlapping between a first symbol and a second symbol in the corresponding pixel. For example, the reference image comprises a plurality of pixels and, for a graphical data record of the plurality of graphical data records, the colouring information includes overlapping information, representing an overlapping between a first symbol and a second symbol in the corresponding pixel. The processing unit may be programmed to generate each output image and to derive, for a graphical data record, a first value RGB and a second value RGB on the basis of the colouring information of the graphical data record and the input data relevant to the first and the second symbol, respectively. The processing unit may be programmed to derive a combined RGB value, on the basis of a first RGB value and a second RGB value and a predetermined algorithm. The processing unit may be programmed to apply a combined RGB value with one or more selected pixels of the output image.

[0060] According to an example embodiment, the reference image includes a plurality of pixels and the processing unit is programmed to derive a sub-set of pixels of the plurality of pixels. For example, the pixels of the sub-set of pixels may belong to the symbols identified and represent the symbols.

[0061] For example, the sub-set of pixels of the plurality of pixels may constitute a set of useful pixels, that is to say, the graphical data may include a plurality of graphical data records, the symbols included in the reference image constitute the set of useful pixels.

[0062] According to an example, the position information of the plurality of graphical data records may exclusively relate to the sub-set of pixels, that is to say, the useful set of pixels of the reference image. For example, the position information may include an index representing a position of a pixel of the sub-set of pixels inside the reference image. According to an example, the colouring information of the plurality of graphical data records may exclusively relate to the sub-set of pixels, that is to say, the useful set of pixels of the reference image. Therefore, the processing unit may be programmed for executing the management instructions and for generating an output image, accordantly with each updated status of the railway transportation plant, on the basis of the plurality of graphical data records for that sub-set of pixels and on the basis of the set of input data corresponding to the updated status of the railway transportation plant. For example, the colouring information of the plurality of data records may relate exclusively to the sub-set of pixels, that is to say, the useful set of pixels; in this way, the processing unit may be programmed for deriving the RGB value exclusively for that sub-set of pixels. In other words, the processing unit may be programmed for generating each output image and deriving an RGB value, on the basis of a set of input data and respective colouring information for each graphical data record of the plurality of graphical data records, relating to the sub-set of pixels; the processing unit may be programmed to select one or more pixels of the output image, corresponding to one or more pixels of the sub-set of pixels of the reference image, on the basis of the respective position information; the processing unit may be programmed for applying the derived RGB value to the one or more pixels of the sub-set of selected pixels of the output image.

[0063] According to an example embodiment, the processing unit includes a first processor and a second processor and both the first and second processors may be programmed to receive the temporal succession of sets of input data. Both the first processor and the second processor are programmed to receive the graphical data structure. The first processor may be programmed to generate the succession of output images and the second processor may be programmed to generate a further succession of output images; In this way, for each output image generated by the first processor, a corresponding further output image is generated by the second processor starting from the same set of input data. The processing unit may be programmed to check a consistency between each output image and the corresponding further output image.

[0064] According to an example embodiment, the calculation terminal includes a two-way communication channel between the first processor and the second processor. The first and the second processor may be programmed for processing, in a parallel fashion, an output image and a corresponding further output image, starting from the same set of input data and for deriving, respectively, a signature and a further signature. According to an example, the signature and the further signature are derived by applying a same function which uniquely identifies the output image and the further output image, respectively; for example, the function may be a HASH function. The processing unit may be programmed to share, through the two-way communication channel, the signature and the further signature between the first processor and the second processor. The processing unit, that is to say, each processor between the first processor and the second processor, may be programmed to check a consistency between the signature and the corresponding further signature. Depending on said check, the processing unit may be programmed to transmit the output image.

[0065] According to an example embodiment, the first processor and the second processor are programmed to process a signature and a further signature to generate, respectively, a check signal and a further check signal, each check signal and further check signal representing a consistency between the signature and the further signature. The check signal and the further check signal may represent a positive outcome of the check of the consistency between the signature and the corresponding further signature, or a negative outcome of the check. The first processor and the second processor may be programmed for transmitting the check signal and the further check signal to a watchdog circuit. The watchdog circuit may be programmed, in the case of a negative outcome of the consistency check, to inhibit the transmission of the output image.

[0066] According to an aspect of the invention, the invention provides a computer program comprising instructions including management instructions for performing the method according to one or more features of the invention, when it is launched on a system according to one or more features of the invention.

[0067] The invention also provides a method for generating an output image representing the status of a railway transportation plant, comprising a step of receiving, at a processing unit of a calculation terminal, from a command and control platform, a temporal succession of sets of input data, each set of input data representing an updated status of the railway transportation plant; the method comprises a step of accessing, by the processing unit, a memory including a graphical data structure, the graphical data structure including a plurality of graphical data records and a plurality of predetermined symbols, wherein the plurality of graphical data records represent the symbols included in a reference image of the railway transportation plant and represent the position of the symbols inside the reference image, the graphical data structure conforming to a predetermined level of safety integrity, the memory including instructions for managing the output image complying with the predetermined safety integrity requirements; the method comprises a step, by the processing unit, accordantly with each updated status of the railway transportation plant, for generating the output image, on the basis of the plurality of graphical data records and on the set of input data corresponding to the updated status of the railway transportation plant and according to the management instructions.

[0068] The invention also provides a computer program comprising instructions including the management instructions for performing the method according to one or more features of the invention, when it is launched on a system according to one or more features of the invention.

[0069] These and other features will become more apparent from the following description of a preferred embodiment, illustrated by way of non-limiting example in the accompanying drawings, in which:

• Figures 1 and 2 illustrate, according to one or more embodiments, the steps of a method for generating an output image representing a status of a railway transportation plant;
• Figure 3 illustrates, according to one or more embodiments, the system according to one or more features of the invention;
• Figure 4 illustrates an example of a reference image;
• Figures 5A, 5B and 6 illustrate, according to one or more embodiments, the system according to one or more features of the invention.

[0070] The method for generating an output image representing a status of a railway transportation plant comprises the steps (indicated in the drawings, by way of example, with the letters A, B, C and D), which can be performed in sequence:

A. Preparing a graphical data structure; the preparation step is performed by a processor of a configuration terminal, for example a commercial terminal.

[0071] Preferably, the preparation includes the following sub-steps (shown in the drawings, by way of example, with the letters A1, A2, A3, A4 and A5), which can be performed in sequence, by a processor of the configuration terminal:

A1. Providing a reference image 3 for the railway transportation plant, the reference image 3 including symbols 30 positioned according to a configuration of the railway transportation plant, the symbols 30 belonging to a plurality of predetermined symbols; in particular, the railway transportation plant includes a plurality of railway bodies, such as, for example, tracks, signals, points, level crossings and others positioned according to the configuration of the railway transportation plant and each symbol of the symbols 30 of the reference image 3 represents a corresponding railway body of the plurality of railway bodies of the railway transportation plant;

A2. Scanning a reference image 3 to identify the symbols 30 included in the reference image; in particular, the reference image 3 includes a plurality of pixels 300 and the scanning includes an derivation of a sub-set of pixels of the plurality of pixels 300, the pixels of the sub-set of pixels belonging to the symbols 30 identified in the reference image 3, the sub-set of pixels constituting a useful set of pixels.

A3. Generating the graphical data structure, the graphical data structure including a plurality of graphical data records 4, as a function of the symbols 30 identified and an arrangement of the symbols 30 identified inside the reference image 3; in particular, the generation includes a step of associating, with each graphical data record of the plurality of graphical data records 4, position information 40 of a pixel of the plurality of pixels 300, that is to say, a pixel of the set of useful pixels of the reference image 3; Preferably, the plurality of pixels 300 is positioned according to a matrix of m-rows and n-columns and the position information includes a first index, representing the row of the matrix in which the pixel is located and a second index, representing the column of the matrix in which the pixel is located;

A4. The generation comprises a step of associating, to each graphical data record of the plurality of graphical data records 4, colouring information 41 of a pixel of the plurality of pixels 300, that is to say, of a pixel of the set of useful pixels of the reference image 3; the colouring information 41 includes the objects of the following list:

• symbol information 400, representing the one or more symbols 30 to which the corresponding pixel belongs,
• overlapping information 401, representing a possible overlapping of more than one symbol 30 in the corresponding pixel,
• transparency information 402, on the basis of the intensity of colouring information of the corresponding pixel inside the symbol 30 to which it belongs,
• default colouring information 403, representing a predetermined colouring information associated with the symbol 30 to which the corresponding pixel belongs.

A5. For one or more graphical data records of the plurality of graphical data records 4, the generation of the graphical data structure includes a step of identifying a group of graphical data records 4', of the plurality of graphical data records 4, the graphical data records of the group of graphical data records 4' sharing the same colouring information for the corresponding group of pixels 300'; according to an example illustrated in Figure 5A, each data record of the group of data records 4' includes position information 40 including a plurality of indices, the indices of which refer to each data record of the group of data records 4', that is, each index relates to each data record of the group of data records and, in this case, the number of data records of the plurality of data records is equal to the number of pixels of the plurality of pixels 300; According to another example, illustrated in Figure 5B, the method comprises a step of grouping together the group of graphical data records 4' in a same graphical data record, the same graphical data record including the colouring information 41 of the group of pixels 300' and including position information 40 relative to the position of each pixel of the group of pixels 300' and, in this example, the number of graphical data records is less than the number of pixels 300. Checking the correctness of the graphical data structure, to guarantee a predetermined level of safety integrity. According to an example, there is a step of preparing instructions for managing the output image, the management instructions being compliant with the predetermined safety integrity requirements.

[0072] Preferably, the method also comprises the following steps:

B. Loading the graphical data structure and management instructions to a calculation terminal 2, the calculation terminal 2 forming a safe component, that is to say, a component in accordance with CENELEC EN50126, EN50128 and EN50129 standards, that is to say, the calculation terminal 2 comprises one or more hardware and/or software modules made in accordance with CENELEC EN50126, EN50128 and EN50129 standards.

C. Receiving, at the calculation terminal 2, sent by a command and control platform 10, a temporal succession of sets of input data 100, each set of input data 100 representing an updated status of the railway transportation plant; that is to say, each input data 100 indicates the status of a railway body included in the railway transportation plant and each input data set 100 indicates the status of the railway bodies included in the plant.

D. Generating, by a processing unit 200 of the calculation terminal 2, a temporal succession of output images, on the basis of the plurality of graphical data records 4, on the basis of the corresponding succession of sets of input data 100 and according to the management instructions; Preferably, the generation of the output image comprises the following sub-steps (indicated in the drawing, by way of example, with the letters D1, D2), which can be performed in sequence, by the processing unit 200 of the calculation terminal 2:

D1. For each graphical data record of the plurality of graphical data records 4, deriving an RGB value, on the basis of a set of input data 100, corresponding to the updated status of the railway transportation plant, and on the basis of the respective colouring information 41 included in said graphical data record;

D2. For said each graphical data record of the plurality of graphical data records 4, selecting one or more pixels of the output image, on the basis of the respective position information 40 included in the graphical data record;

D3. Applying the derived RGB value to the one or more selected pixels of the output image;

D4. For each graphical data record including overlapping information 401, representing an overlapping between a first symbol and a second symbol in the corresponding pixel, deriving a first RGB value and a second RGB value on the basis of the colouring information 41 of the graphical data record and on the basis of a predetermined algorithm, said predetermined algorithm including combination colouring information between a first RGB value and a second RGB value, application of the combined RGB value with the one or more selected pixels of the output image.

D5. Generating, by the processing unit 200, the output image, corresponding to the updated status of the railway transportation plant.

[0073] According to an example embodiment, the processing unit 200 includes a first processor and a second processor. Preferably, the steps A, B, C, and D, including the relative sub-steps, are performed by the first processor to generate the output image and are performed by the second processor to generate a further output image; in particular, the further output image is generated starting from the same set of input data 100 received from the first processor, and, in this way, for each output image generated by the first processor, a corresponding further output image is generated by the second processor. The method may comprise the further steps, for each output image and further output image, of:

E. Processing, by the first processor and the second processor, in a parallel fashion with the output image and the further output image, to derive, respectively, a signature and a further signature, applying to the output image and to the further output image, for example, a HASH function;

F. Sharing, through a two-way communication channel between the first processor and the second processor, the signature and the further signature between the first processor and the second processor;

G. Processing, by both the first processor and the second processor, of the signature and the further signature, to generate, respectively, a check signal and a further check signal, representing a consistency between the signature and the further signature;

H. Transmission, by the first processor and the second processor, respectively, of the check signal and the further check signal to a watchdog circuit;

I. Execution, by the watchdog circuit, of a procedure which prevents the transmission of the output image, in the event of a negative outcome of the consistency check between the signature and the respective further signature.

[0074] The numeral 1 in the drawings denotes a system for generating an output image.

[0075] According to a preferred example, the system 1 comprises a calculation terminal 2, the calculation terminal 2 may constitute a safe component, that is to say, made in accordance with CENELEC EN50126, EN50128 and EN50129 standards, that is to say, the calculation terminal 2 may comprise one or more hardware and/or software modules made in accordance with CENELEC EN50126, EN50128 and EN50129 standards. Preferably, the calculation terminal 2 includes a processing unit 200, programmed for receiving, from a command and control platform 10, a temporal succession of sets of input data 100, each set of input data 100 representing an updated status of the railway transportation plant. In particular, each input data 100 indicates the status of a railway body included in the railway transportation plant and each set of input data 100 indicates the status of the railway bodies included in the plant, such as, for example, tracks, signals, points, level crossings and others.

[0076] Preferably, the calculation terminal 2 includes a memory 201, in which a graphical data structure and management instructions are loaded; For this purpose, the system 1 comprises a configuration terminal, for example a commercial terminal, programmed to process the graphical data structure. In particular, preferably, the graphical data structure includes a plurality of graphical data records 4, wherein the graphical data records 4 represent the symbols 30 included in a reference image 3 of the railway transportation plant and represent the position of the symbols 30 inside the reference image 3. In other words, the reference image 3 includes symbols 30 positioned according to a configuration of the railway transportation plant, the symbols 30 belonging to a plurality of predetermined symbols; in particular, the railway transportation plant includes a plurality of railway bodies, such as, for example, tracks, signals, points, level crossings and others positioned according to the configuration of the railway transportation plant and each symbol of the symbols 30 of the reference image 3 represents a corresponding railway body of the plurality of railway bodies of the railway transportation plant. The configuration terminal is programmed for scanning the reference image 3, for identifying the symbols 30 included therein and, in particular, the configuration terminal is programmed for deriving a sub-set of pixels of a plurality of pixels 300 of the reference image, the pixels of the sub-set of pixels belonging to the symbols 30 identified in the reference image 3, the sub-set of pixels constituting a useful set of pixels. The configuration terminal may be configured to generate the graphical data structure, the graphical data structure including a plurality of graphical data records 4, as a function of the symbols 30 identified and an arrangement of the symbols 30 identified inside the reference image 3. The graphical data structure preferably conforms to a predetermined level of safety integrity.

[0077] In particular, each graphical data record of the plurality of graphical data records 4 is associated with position information 40 of a pixel of the plurality of pixels 300, that is to say, of a pixel of the set of useful pixels of the reference image 3; Preferably, the plurality of pixels 300 is positioned according to a matrix of m-rows and n-columns and the position information 40 includes a first index, representing the row of the matrix in which the pixel is located and a second index, representing the column of the matrix in which the pixel is located.

[0078] Preferably, each graphical data record of the plurality of graphical data records 4 is associated with colouring information 41 of a pixel of the plurality of pixels 300, that is to say, of a pixel of the set of useful pixels of the reference image; the colouring information 41 includes the objects of the following list:

• symbol information 400, representing the one or more symbols 30 to which the corresponding pixel belongs,
• overlapping information 401, representing a possible overlapping of more than one symbol 30 in the corresponding pixel,
• transparency information 402, on the basis of the intensity of colouring information of the corresponding pixel inside the symbol 30 to which it belongs,
• default colouring information 403, representing a predetermined colouring information associated with the symbol 30 to which the corresponding pixel belongs.

[0079] For one or more graphical data records of the plurality of graphical data records 4, the configuration terminal is programmed to identify a group of graphical data records 4', of the plurality of graphical data records 4, the graphical data records of the group of graphical data records 4' sharing the same colouring information 41, for the corresponding group of pixels 300'. According to an example illustrated in Figure 5A, each data record of the group of data records 4' includes position information 40 including a plurality of indices, the indices of which refer to each data record of the group of data records 4', that is, each index indicates each data record of the group of data records and, in this case, the number of data records of the plurality of data records is equal to the number of pixels of the plurality of pixels 300; according to another example, illustrated in Figure 5B, the configuration terminal (commercial terminal) is programmed for grouping together the group of graphical data records 4' into a same graphical data record, the same graphical data record including the colouring information 41 of the group of pixels 300' and including position information 40 relative to the position of each pixel of the group of pixels 300' and, in this example, the number of graphical data records is less than the number of pixels 300.

[0080] The processing unit 200 is, preferably, programmed for executing the management instructions and for generating a temporal succession of output images, on the basis of the plurality of graphical data records 4 and on the basis of the corresponding succession of sets of input data 100. In particular, the processing unit 200 generates the temporal succession of output images on the basis of instructions for managing the output image, wherein the instructions for managing the output image comply with predetermined safety integrity requirements.

[0081] In particular, for each graphical data record of the plurality of graphical data records 4, the processing unit 200 is programmed to derive a RGB value, on the basis of a set of input data 100, corresponding to the updated status of the railway transportation plant, and on the basis of the respective colouring information 41 included in said graphical data record. Preferably, for said each graphical data record of the plurality of graphical data records 4, the processing unit 200 is programmed for selecting one or more pixels of the output image, on the basis of the respective position information 40 included in the graphical data record and for applying the derived RGB value to the one or more selected pixels of the output image. According to an example embodiment, for each graphical data record of the plurality of graphical data records 4 including overlapping information 401, representing an overlapping between a first symbol and a second symbol in the corresponding pixel, the processing unit 200 is programmed to derive a first RGB value and a second RGB value on the basis of the colouring information 41 of said graphical data record and on the basis of the data of a predetermined algorithm, said predetermined algorithm including combination colouring information between a first RGB value and a second RGB value. The processing unit 200 is further configured for applying the RGB value combined with the one or more selected pixels of the output image.

[0082] According to an example embodiment, the processing unit 200 includes a first processor and a second processor. Both the first processor and the second processor are programmed to receive the temporal succession of sets of input data 100 and are programmed, for each graphical data record of the plurality of graphical data records 4, for generating an RGB value and a further RGB value, respectively, on the basis of a set of input data 100 corresponding to the updated status of the railway transportation plant and on the basis of the respective colouring information 41 included in said graphical data record 4. The first processor and the second processor are programmed for selecting one or more pixels of the output image and of a further output image, respectively, on the basis of the respective position information 40 included in said graphical data record and for applying the RGB value and the further RGB value derived to the one or more selected pixels of the output image and of the further output image, respectively.

[0083] According to an example embodiment, for each graphical data record 4 including overlapping information 401, representing an overlapping between a first symbol and a second symbol in the corresponding pixel, the first processor and the second processor are programmed to derive, respectively, a first RGB value and a second RGB value, a further first RGB value and a further second RGB value on the basis of the colouring information 41 of the graphical data record and on the basis of a predetermined algorithm, said predetermined algorithm including combination information between a first RGB value and a second RGB value. The first processor and the second processor are programmed for applying the combined RGB value with the one or more selected pixels of the output image and of the further output image, respectively. In this way, for each output image generated by the first processor, a corresponding further output image is generated by the second processor.

[0084] According to an embodiment, the first processor and the second processor may be programmed for processing, in a parallel fashion, the output image and the further output image for deriving, respectively, a signature and a further signature, applying to the output image and to the further output image, for example, a same HASH function. According to an embodiment, the first processor and the second processor, may be programmed for sharing, through a two-way communication channel between the first processor and the second processor, the signature and the further signature, respectively, between the first processor and the second processor. According to an embodiment, both the first processor and the second processor are programmed to process the signature and the further signature, to generate, respectively, a check signal and a further check signal, representing a consistency between the signature and the further signature. According to an embodiment, the first processor and the second processor are programmed for transmitting, respectively, the check signal and the further checking signal to a watchdog circuit. The watchdog circuit may be programmed to perform a procedure that prevents transmission of the output image, in the event of a negative outcome of the consistency check between the signature and the respective further signature.

Claims

1. A method for generating an output image representative of a status of a railway transportation plant, through preparation of management instructions for the output image, the management instruction complying with a predetermined safe integrity level, the method comprising the following steps:

- preparation of a graphical data structure, the preparation including:

providing a reference image (3) for the railway transportation plant, the reference image (3) including symbols (30) positioned according to a layout of the railway transportation plant, the symbols (30) belonging to a plurality of predetermined symbols;

scanning the reference image (3) for identifying the symbols (30) included therein;

generating the graphical data structure including a plurality of graphical data records (4), in dependence of the identified symbols (30) and of an arrangement of the identified symbols (30) in the reference image (3);

- checking of the accuracy of the graphical data structure in order to ensure a predetermined safe integrity level;

- loading the management instructions and the graphical data structure in a computer terminal (2), the computer terminal (2) complying with a predetermined safe integrity level;

- receiving at the computer terminal (2), from a command-and-control platform (10), a temporal succession of sets of input data (100), each set of input data being representative of an updated status of the railway transportation plant;

- by a processing unit (200) of the computer terminal (2), responsive to each updated status of the railway transportation plant, generating the output image based on the graphical data structure (4) and on the set of input data (100) corresponding to the updated status of the railway transportation plant, according to the management instructions.

2. The method according to claim 1, wherein the reference image (3) includes a plurality of pixels (300) and wherein each graphical data record of the plurality of graphical data records (4) includes position information (40), the position information (40) including an index representative of a position of a pixel in the reference image (3).

3. The method according to claim 2, wherein the reference image (3) includes a plurality of pixels (300) and the scanning includes deriving a sub-set of pixels from the plurality of pixels, the pixels of the sub-set of pixels belonging to the identified symbols (30) and being representative of the symbols (30).

4. The method according to claim 2 or 3, wherein each graphical data record further includes colouring information (41), the colouring information (41) including one or more items of the following list:

- symbol information (400), representative of an identity of the one or more symbols (30) to which the corresponding pixel belongs,

- overlap information (401), representative of a possible overlap of more than one symbol (30) in the corresponding pixel,

- transparency information (402), based on the colour intensity of the pixel within the symbol (30) to which the pixel belongs,

- default colour information (403), representative of a predetermined colour associated to the symbol (30) to which the corresponding pixel belongs.

5. The method according to claim 4, wherein, for one or more graphical data records of the plurality of graphical data records (4), the position information (40) includes a plurality of indexes representative of a position of a corresponding group of pixels (300') in the reference image (3), wherein the pixels of the group of pixels (300') share the same colouring information (41).

6. The method according to claim 4 or 5, wherein the generation of each output image includes,

deriving an RGB value, based on the set of input data (100) and on the respective colouring information (41) for each graphical data record of the plurality of graphical data records (4);

selecting one or more pixels of the output image, based on the respective position information (40);

applying the derived RGB value to the selected one or more pixels of the output image.

7. The method according to claim 6, wherein, for a graphical data record of the plurality of graphical data record (4), the colouring information (41) include overlap information (401) representative of an overlap of a first symbol and a second symbol in the corresponding pixel, and wherein the generation of each output image includes, for said data record,

deriving a first RGB value and a second RGB value, based on the colouring information (41) of said graphical data record and on the input data (100) pertaining to the first and second symbol, respectively;

deriving a combined RGB value, based on the first and second RGB values and on a predetermined algorithm,

applying the combined RGB value to the selected one or more pixels of the output image.

8. A system (1) for generating an output image representative of a status of a railway transportation plant, the system comprising a computer terminal (2), the computer terminal (2) constituting a safety component and including:

a processing unit (200), programmed for receiving, from a command-and-control platform (10), a temporal succession of sets of input data (100), each set of input data (100) being representative of an updated status of the railway transportation plant;

a memory (201) wherein a graphical data structure is loaded, the graphical data structure including a plurality of graphical data records (4), wherein the graphical data records are representative of the symbols (30) included in a reference image (3) of the railway transportation plant and are representative of the positioning of the symbols (30) in the reference image (3), the graphical data structure complying with a predetermined safe integrity level, the memory (201) comprising management instructions for the output image, the management instructions complying with a predetermined safe integrity level;

the processing unit (200) being further programmed for running the management instructions for the output image and for generating the output image, responsive to each updated status of the railway transportation plant, based on the graphical data structure and on the set of input data (100) corresponding to the updated status of the railway transportation plant, according to the management instructions.

9. The system (1) according to claim 8, wherein the reference image (3) includes a plurality of pixels (300) and wherein each graphical data record of the plurality of graphical data records (4) includes position information (40), the position information (40) including an index representative of a position of a pixel in the reference image (3).

10. The system (1) according to claim 9, wherein each graphical data record further includes colouring information (40), the colouring information (40) including one or more items of the following list:

- symbol information (400), representative of an identity of the one or more symbols (30) to which the corresponding pixel belongs,

- overlap information (401), representative of a possible overlap of more than one symbol (30) in the corresponding pixel,

- transparency information (402), based on the colour intensity of the pixel within the symbol (30) to which the pixel belongs,

- default colour information (403), representative of a predetermined colour associated to the symbol (30) to which the corresponding pixel belongs.

11. The system (1) according to claim 10, wherein, for one or more graphical data records of the plurality of graphical data records (4), the position information (40) includes a plurality of indexes representative of a position of a corresponding group of pixels (300') in the reference image (3), wherein the pixels of the group of pixels (300') share the same colouring information (41).

12. The system (1) according to claim 10 or 11, wherein the processing unit (200) is programmed for

deriving an RGB value, based on the set of input data (100) and on the respective colouring information (41), for each graphical data record of the plurality of graphical data records (4);

selecting one or more pixels of the output image, based on the respective position information (40);

applying the derived RGB value to the selected one or more pixels of the output image.

Drawing