Detecting Hazardously Misleading Information on Safety-Critical Displays

Commercial-Off-The-Shelf (COTS) Graphic Processor Units (GPU) are widely used in cockpit display systems. However, COTS GPUs were not initially designed for safety-critical airborne applications and did not follow the RTCA DO-254 design process guidelines. Both FAA Position Paper CAST-29 and EASA Certification Memorandum CM-SWCEH-001 concerned the possibility of displaying hazardously misleading information due to using COTS GPUs. Furthermore, as the cell size of the DRAM memory used on the GPU board becomes much smaller, the impact of Single Event Upsets (SEU) and Multiple Bit Upsets (MBU) becomes more significant at flight altitudes. If a display system level Functional Hazard Assessment (FHA) cannot conclude that all required safety objectives have been achieved, architectural mitigation, such as an integrity monitoring system, should be implemented. This paper discussed the challenges and design goals for implementing a display monitoring system. A patent-pending object-based integrity verification method is reviewed. This integrity verification method utilizes a monochrome object ID code image to track each safety-critical graphic object on the display. It monitors the color, shape and position of each graphic object and verifies overlapping priorities between multiple graphic objects on the screen. Since this method can pinpoint a failed graphic object on the screen, it can provide a proper warning level and suggest necessary corrective actions to the pilot. This method can also prevent false, unnecessary and annoying alarms caused by failures of the monitoring system. This integrity verification method does not require a full-featured GPU and can be implemented in a FPGA to reduce certification efforts and development costs.