DE102015200292A1 - Method and device for driving a display device and display system - Google Patents

Abstract

The invention relates to a method (200) for controlling a display device on which security-critical content and non-secure content can be displayed. The method comprises a step of processing read image data. In this case, safety-critical image data and safety-critical image data are separated from one another and / or independently processed to produce safety-critical display elements and safety-critical display elements. Here, the safety-critical display elements are generated so that the safety-critical display elements are displayed graphically superimposed in a state displayed by means of the display device safety-critical display elements.

Description

State of the art

The present invention relates to a method for driving a display device, to a corresponding device, to a display system with such a device and to a corresponding computer program, in particular for displaying safety-critical and safety-critical image contents, for example with regard to Standard ISO 26262 in the field of transport.

In particular, automotive display devices, such as fully programmable instrument clusters, should be able to display status and warning messages in a secure manner. For example, to ensure display and non-display of graphical content, related functionality should meet the requirements of the ISO 26262 ASIL B suffice.

The DE 10 2004 032 807 A1 describes an apparatus and method for increasing the system security of vehicle instrument displays and vehicle control devices.

Disclosure of the invention

Against this background, a method for driving a display device, a device using this method, a display system and finally a corresponding computer program according to the main claims are presented with the approach presented here. Advantageous embodiments emerge from the respective subclaims and the following description.

According to embodiments of the present invention, in particular safety-critical display elements, such as error messages, status messages and the like, processed separately from a safety-critical display logic, calculated and drawn in a separate layer on safety-critical display elements. In this case, for example, security procedures for safety-critical software according to ISO 26262 be combined with the approach to map graphical data on superimposed optical planes or depth levels or graphic layers, so as to enable safety-critical information can always be displayed or hidden visible. Thus, in particular, a secure display and non-display of security content according to ISO 26262 be realized, for example, for so-called instrument clusters in vehicles or other environments with display-based displays, by means of which safety-related information can be displayed.

Safety-critical display elements, such as error messages, status messages and the like, can therefore be processed separately from another display logic, calculated and drawn in a separate layer on safety-critical display elements. Such a separation can enable ASIL (ASA = Automotive Safety Integrity Level) and a safe representation and possibly non-representation of the safety-critical display elements, without Überdeckungs- or displacement risk for the safety-critical display elements.

The Standard ISO 26262 , are defined in the safety-related ASIL specifications, for example, provides two approaches to the separation of safety-relevant from no or only limited safety-critical elements in an overall system. A first approach concerns Freedom of Interference, whereby safety-relevant parts of non-safety-critical parts, which are adequately protected by so-called QM measures (QM corresponds to an absence of safety requirements), are separated. A second approach represents a decomposition of components classified according to security requirement level ASIL-A or ASIL-B into an ASIL-A share or ASIL-B share and into QM elements. By a combination of the two approaches, it can be made possible according to embodiments of the present invention in particular that almost all the software of a product remain in the QM part and thus can be created efficiently. Such a small amount of the remaining safety-critical portion of the software may allow it to be qualified and certified to ASIL-B.

Advantageously, according to embodiments of the present invention can thus be achieved in particular in a cost-effective and secure way to be able to represent safety-related messages reliably graphically in the foreground of a display. In particular, for display devices in the automotive sector, such as fully programmable instrument cluster, safety-critical status and warning messages can be displayed in a secure manner. In order to realize a representation and non-representation of graphical content, for example, an associated functionality should meet the requirements of ISO 26262 ASIL B suffice. While in particular usual so-called graphic stacks as well as various additional libraries of third can be regarded as too complex to after ISO 26262 can be qualified according to embodiments of the present invention, for example ISO 26262-09 , an ASIL level with a ISO 26262 Compliant decomposition of safety requirements and non-reaction can be achieved. In this case, for example, a graphics stack can be left at the security requirement level QM, which does not mean ASIL classification, and an independent, ISO 26262 compliant, secure render path that can achieve a required ASIL level for the display of critical content. The backlash freedom of components at an ASIL level with respect to QM-level components can be achieved, in particular, by preventing unsafe elements from being spatially, e.g. B. on memory areas, nor in time, z. For example, in terms of CPU time, interfere with secure elements.

A method for driving a display device, on which security-critical content and non-secure content can be displayed, is presented, the method comprising the following step:
Processing of image data read in which safety-critical image data and non-critical image data are separated and / or processed independently to produce safety-critical display elements and safety-critical display elements, the safety-critical display elements are generated so that the safety-critical display elements in a state indicated by the display device safety-critical Display elements are displayed overlaid graphically.

The display device may be arranged in particular in a vehicle, such as a road-bound motor vehicle or the like. Safety-critical contents, image data and display elements can relate to safety functions, safety-relevant functions and additionally or alternatively safety-relevant functions of a system to which the display device is connected and in which the method can be executed, for example safety functions of a vehicle, in particular related to malfunctions or the like. In this case, safety-critical can correspond to a classification into a safety requirement level. Security-critical contents, image data and display elements can relate to safety-relevant or irrelevant functions of a system to which the display device is connected and in which the method can be executed, for example entertainment functions of a vehicle or the like. A display element has image data. In other words, a display element may or may not be generated using image data. The image data may include raw image data, sensor data, and the like. Thus, a display element may represent displayable image data. The safety-critical display elements can display safety-critical display elements graphically superimposed by the safety-critical display elements are displayed in a foreground of a display. The method may also include a step of reading image data and additionally or alternatively a step of outputting display elements to an interface to the display device. In this case, the safety-critical image data and the non-safety-critical image data can be separated from one another and additionally or alternatively independently read. Furthermore, the safety-critical display elements and the safety-critical display elements can be separated from each other and output separately or alternatively independently.

According to one embodiment, in the step of processing, the safety-critical image data and the safety-critical image data as well as the safety-critical display elements and the safety-critical display elements temporally, spatially and additionally or alternatively with respect to resources separated from each other and processed separately or alternatively independently. Time-separated processing may represent different processor times, processing times, or the like. Spatially separate processing may involve different memory areas, memory devices, processors, or the like. Resource-separate processing may refer to different hardware and, additionally or alternatively, different software. Such an embodiment offers the advantage that separate treatment of safety-critical and non-safety-critical contents can be achieved in a variety and reliable manner in order to inexpensively meet or comply with an intended safety requirement level for the safety-critical contents.

Also, in the step of processing, the safety-critical display elements can be generated in such a way that the safety-critical display elements are displayed in the state indicated by the display device in a graphically overlapping graphic plane in every other graphic plane. Alternatively, in the step of processing, the safety-critical display elements can be generated in such a way that the safety-critical display elements graphically replace safety-critical display elements in the state displayed by means of the display device. Thus, in this case, a plurality of so-called hardware layers, which can correspond to separate memory areas, or an overwriting of non-safety-critical display elements with safety-critical display elements can be used. Such an embodiment offers the advantage that one spatially and / or temporally independent or separate processing of ASIL-related and ASIL-free content can be achieved easily and reliably.

Furthermore, in the step of processing, the safety-critical image data and the safety-critical image data as well as the safety-critical display elements and the safety-critical display elements can be managed in separate and additionally or alternatively mutually secured memory areas, address spaces and / or process spaces. Such an embodiment offers the advantage that a particularly reliable, in particular spatially separate processing of image data and display elements can be realized depending on the security relevance. Also, an intended security requirement level for the security-critical content can be maintained particularly reliable.

In this case, in the step of processing an impermissible memory access to the separate and additionally or alternatively secured from each other memory areas, address spaces and additionally or alternatively process spaces can be detected and additionally or alternatively prevented. For this purpose, a memory management unit can be used in the step of processing to detect such an illegal memory access. Such an embodiment offers the advantage that memory protection can be reliably implemented for a secure separation of data of different security requirement levels. As a result, a relevant security requirement level for the security-critical content can be maintained even more reliably.

According to one embodiment, in the step of processing, at least one processing resource may be checked to determine whether a proper state or a faulty state of the at least one processing resource exists. The at least one processing resource may be a hardware resource or a software resource. In particular, a processing resource may represent a program code, program data, a data bus, or the like. Such an embodiment offers the advantage that a safety requirement level required for the safety-critical contents can be reliably maintained due to the protection of processing resources.

Furthermore, in the step of the processing, register values which represent the safety-critical image data and additionally or alternatively the safety-critical display elements can be compared with reference register values stored in a protected memory area. In this case, in the event of a deviation, an error treatment can be carried out. The error handling can be performed if a deviation of the register values from the reference register values is detected. Such an embodiment offers the advantage that a safety requirement level valid for the safety-critical contents can also be maintained particularly reliably by the monitoring of registers.

Also, in the step of processing during a translation time, the safety-critical image data can be combined and secured to a library. Here reference backup data can be generated and stored in the library. During a runtime, backup data can be calculated and compared with the reference backup data. In this case, in the event of a deviation, an error treatment can be carried out. The error handling can be performed when a deviation of the backup data from the reference backup data is detected. Such an embodiment offers the advantage that the security-critical contents can be secured and thus a security requirement level for the same can be reliably maintained.

The approach presented here also creates a device that is designed to perform the steps of a variant of a method presented here in appropriate facilities to drive or implement. Also by this embodiment of the invention in the form of a device, the object underlying the invention can be solved quickly and efficiently. Thus, the device can be designed to control a display device on which safety-critical content and non-secure content can be displayed.

In the present case, a device can be understood to mean an electrical device which processes image data signals and outputs control and / or data signals in dependence thereon. The device may have an interface, which may be formed in hardware and / or software. In the case of a hardware-based embodiment, the interfaces can be part of a so-called system ASIC, for example, which contains a wide variety of functions of the device. However, it is also possible that the interfaces are their own integrated circuits or at least partially consist of discrete components. In a software training, the interfaces may be software modules that are present, for example, on a microcontroller in addition to other software modules.

Also presented is a display system for displaying safety-critical content and non-secure content, the display system having the following features:
a display device, on which safety-critical content and non-secure content can be displayed; and
an embodiment of the above-mentioned device, which is connectable or connectable to the display device with data transmission capability, wherein the device is designed to provide the display device with safety-critical display elements and non-safety-critical display elements for display.

In connection with the display system, an embodiment of the above-mentioned device can be advantageously used to drive the display device. Thus, the display system may include a device for driving a display device, on the safety-critical content and non-secure content can be displayed. The display system may be usable in an overall overall system, for example a vehicle or the like, and additionally or alternatively be arranged. The device can have at least one interface to a superordinate overall system in which the display system can be used and additionally or alternatively arranged, and at least one interface to the display device and additionally or alternatively a control device upstream of the display device.

Also of advantage is a computer program product or computer program with program code which can be stored on a machine-readable carrier or storage medium such as a semiconductor memory, a hard disk memory or an optical memory and for carrying out, implementing and / or controlling the steps of the method according to one of the embodiments described above is used, especially when the program product or program is executed on a computer or a device.

Embodiments of the present invention relate, for example, to display-based or pixel-based displays. Different displays can dynamically share a display area or display, with vehicle status indicators, alerts, on-board computers, navigation, error displays, instruments, videos, etc. displayed. Between ads, dynamic state changes of displacing content can occur. Individual content may have dynamic animation such as translation, rotation, and scaling, as well as changes in transparency and color values. Irrespective of a particular rendering technique, for example scene graphs, code generation or hand coding, a resulting human-machine interface application or HMI application can have complex software. A design of an advertisement can be dependent on market developments, whereby requirements can change. In order to obtain an ASIL classification for such displays, it can be prevented that, for example, only one of the following three approaches can be selected. A first approach may be that ASIL-related error messages or status indicators, such as a gear indicator, ESP, failure of ASIL subsystems, are part of a display. In the event of an error, an error detection can take place. For this purpose, a screen monitoring can be carried out, wherein the display system or the pixel output can be checked by a monitoring system. However, according to embodiments of the present invention, it may be achieved that, in response to error detection, a remedy is performed instead of a so-called safestate, typically turning off the display. The latter would lead to display-only systems that, for example, a vehicle should not be moved from its own drive. It can thus be bypassed a field failure. Also, a complexity of state changes with regard to temporal requirements can be taken into account. Hereby it can be prevented that a response delay, which can occur, for example, due to system load caused by complex animations and user interaction, such that a display does not cope in a time expected by the monitoring system, leads to an error case. Also, with a high frequency of change due to market driven, more frequent changes in the display, a monitoring system can be more easily adaptable to a state of development, or adjustment efforts can be reduced. It also makes it easier to monitor animations from secure ads so that surveillance tolerance can be compromised and compliance with security requirements can be made easier. A second approach, which states that ASIL can be implemented in a software stack instead of a display display, turns on warning LEDs and turns off a display in the event of a fault, can be bypassed in accordance with embodiments of the present invention, as this would involve a number Status messages and / or error messages physically limited, as LEDs can not displace, which can also be avoided by ASIL-compliant LEDs resulting additional costs. Finally, a third approach, the fulfillment of z. B. ASIL-B requirements for a complete display system demands and software would not be economically feasible to be circumvented according to embodiments of the present invention.

The approach presented here will be explained in more detail below with reference to the accompanying drawings. Show it:

1 a schematic representation of a display system with a device according to an embodiment of the present invention;

2 a flowchart of a method according to an embodiment of the present invention;

3A to 3D schematic representation of displays according to an embodiment of the present invention;

4 a schematic representation of a generation of the combined display 3C respectively. 3D ;

5 a context diagram of a man-machine interface according to an embodiment of the present invention;

6 an overview of address spaces for a man-machine interface according to an embodiment of the present invention;

7 a schematic representation of a display system according to an embodiment of the present invention; and

8th a schematic representation of a display system according to another embodiment of the present invention.

In the following description of favorable embodiments of the present invention, the same or similar reference numerals are used for the elements shown in the various figures and similar acting, with a repeated description of these elements is omitted.

1 shows a schematic representation of a display system 100 with a device according to an embodiment of the present invention. The display system 100 is designed to enable or effect an advertisement of critical content A and non-critical content B. Here is the display system 100 in particular in a vehicle, such as a road-bound motor vehicle, usable and / or installable. The safety-critical contents A represent here by way of example a warning symbol or a warning indication of a safety-critical condition. The safety-critical contents B exemplarily represent a tachometer display and a tachometer display in a round instrument visualization.

According to the in 1 illustrated embodiment of the present invention, the display system 100 a display device 110 and a drive device 120 or device for driving the display device 110 on. On the display device 110 the safety-critical contents A and the non-safety-critical contents B can be displayed. Thus, the indicator is 110 designed to display the safety-critical content A and the non-critical content B. In particular, the display device 110 designed to display the safety-critical content A and / or the non-secure content B in a period of time or in different time periods. At the display device 110 it is, for example, a so-called instrument cluster of a motor vehicle, in particular a passenger car, truck or other commercial vehicle.

The drive device 120 is designed to read in or receive safety-critical image data C and non-critical image data D. Furthermore, the drive device 120 designed to generate and / or output safety-critical display elements E and safety-critical display elements F using the safety-critical image data C and the safety-critical image data D.

The drive device 120 is data transferable with the display device 110 connected. Furthermore, the drive device 120 trained to the display device 110 to provide the safety-critical display elements E and the safety-critical display elements F for display. Here is the indicator 110 designed to display the safety-critical contents A using the safety-critical display elements E and / or to display the non-safety-critical contents B using the safety-critical display elements F.

The drive device 120 has a processing device 130 on. The processing device 130 is configured to process the read-in image data C and D. In this case, the processing device 130 designed to separate the safety-critical image data C and the safety-critical image data D from each other and / or from each other independently. The processing device 130 is hereby designed to generate the safety-critical display elements E using the safety-critical image data C. Also, the processing device 130 designed to generate the safety-critical display elements F using the safety-critical image data D. Specifically, the processing device 130 formed to generate the safety-critical display elements E so that the safety-critical display elements E in one by means of the display device 110 displayed state the safety-critical Display elements F are superimposed graphically.

It should be noted that the drive device 120 is designed to read or receive the safety-critical image data C and / or the safety-critical image data D in a time interval or in different time periods. Furthermore, the drive device 120 in particular designed to provide the safety-critical display elements E and the safety-critical display elements F in a time period or in different time periods. Thus, in a period of time, the safety-critical contents A can be displayed using the safety-critical image data C and the safety-critical display elements E and / or the non-safety-critical contents B using the safety-critical image data D and the safety-critical display elements F. Which of the contents A and / or B are displayed, for example, depends on which of the image data C and / or D are present.

According to an embodiment, the drive device 120 a part of the display device 110 or a display controller of the same. Here is a separate presentation go 1 for illustrative purposes only.

2 shows a flowchart of a method 200 according to an embodiment of the present invention. In the process 200 It is a method for controlling a display device on which safety-critical content and non-secure content can be displayed. Thus, the procedure 200 executable to drive such a display device. The procedure 200 is off in conjunction with a display system like the display system 1 executable. In particular, the method 200 in conjunction with a drive device such as the drive from 1 executable.

The procedure 200 has a step 210 processing of read-in image data. Safety-critical image data and safety-critical image data are separated from one another or processed independently of one another in order to generate safety-critical display elements and safety-critical display elements. The safety-critical display elements are in this step 210 the processing generates so that the safety-critical display elements in a state displayed by means of the display device safety-critical display elements are displayed graphically superimposed.

According to one embodiment, the safety-critical image data and the safety-critical image data as well as the safety-critical display elements and the safety-critical display elements in step 210 processing time, space and / or resources separately or independently processed.

Further, the method has 200 according to one embodiment, a step 220 of reading image data. Optionally, the safety-critical image data and the safety-critical image data are read from each other separately or independently. Also, the procedure assigns 200 additionally or alternatively a step 230 outputting display elements to an interface to the display device. Here, optionally, the safety-critical display elements and the safety-critical display elements can be output separately or independently.

3A shows a schematic representation of security-critical content B in a first graphics layer 301 according to an embodiment of the present invention. The non-secure contents B are, for example, the non-secure content 1 , The security-critical contents B are made using the drive device 1 displayed on a display device, such as the in 1 displayed display device. Specifically, the non-critical content B represents a symbolic visualization of round instruments of a vehicle. The non-safety-critical contents B correspond, for example, to a so-called QM level outside a classification according to ASIL (Automotive Safety Integrity Level) or Standard ISO 26262 ,

3B shows a schematic representation of safety-critical content A in a second graphics layer 302 according to an embodiment of the present invention. The safety-critical contents A are, for example, the safety-critical contents 1 , The safety-critical contents A are made using the drive device 1 displayed on a display device, such as the in 1 displayed display device. Specifically, the safety-critical contents A represent a warning symbol or a symbolic visualization of a warning message for a driver of a vehicle. The safety-critical contents A correspond, for example, to a safety requirement class according to a classification according to ASIL (Automotive Safety Integrity Level) or Standard ISO 26262 , in particular the class ASIL B.

Thus show 3A and 3B two separate calculated displays or graphic layers 301 and 302 , The first graphic level represents this 301 a background and represents the second level of graphics 302 a foreground.

3C shows a schematic representation of a combined display 303 according to an embodiment of the present invention. The combined display 303 has the in 3A illustrated first graphic plane 301 in the background and in 3B illustrated second graphic plane 302 in the foreground. Exactly illustrated 3C a structure or a layering of the graphic layers 301 and 302 , where the graphic layers 301 and 302 shown spaced apart for purposes of illustration.

3D shows a schematic representation of the combined display 303 out 3C in a way of presentation, like the combined display 303 is displayed to a viewer. Here is the second graphics layer 302 the first graphics layer 301 superimposed graphically or optically.

With reference to the above figures, the driving device is 120 formed independently of a drawing method used to graphically place the safety-critical content A or a secure portion of the display or presentation on or on the non-critical content B or a general share. For example, a regular HMI (HMI = Human Machine Interface) HMI may be configured to calculate and animate non-secure contents B or displays for the background. An ASIL HMI can be designed to enable safety-critical contents A or a display for the foreground. With particular reference also to the process 200 out 2 can according to an embodiment in step 210 processing the safety-critical display elements E are generated so that the safety-critical display elements E in the means of the display device 110 displayed state in any other graphics layer 301 graphically overlapping graphics layer 302 are displayed. In this case, so-called hardware layers can be used, which are separate memory areas which are interpreted by a display controller superimposed levels. These layers can cover underlying levels or make them visible through partial transparency. The contents of a layer can graphically have both 2D or 3D appearance. In this case, it may be possible for the safety-critical display elements E or ASIL information to be present in the uppermost graphics plane facing the viewer 302 be stored so that they can not be obscured by other image information. With regard to ASIL, a spatial separation of contents A and B can thus be realized. Alternatively, in step 210 processing the safety-critical display elements E are generated so that the safety-critical display elements E in the means of the display device 110 displayed state critically non-critical display elements F graphically replace or cover. On systems without a hardware layer, drawing can be done in two steps: First, a calculation of the safety-critical display elements F or picture elements, followed by the result data being used as additional input of an ASIL part and safety-critical display elements E being added. Such an approach enables the overall concept to be used also for display systems with less powerful hardware.

4 shows a schematic representation of a generation of the combined display 303 out 3C respectively. 3D by means of the display system 100 , The combined display 303 has the in 3A illustrated first graphic plane 301 in the background and in 3B illustrated second graphic plane 302 in the foreground. Here is the combined display 303 in the 3C visualized. The first graphics layer 301 thus includes the non-secure content that by means of the display system 100 can be displayed using the safety-critical display elements F. The second level of graphics 302 includes the safety-critical content that is generated by the display system 100 can be displayed using the safety-critical display elements E. In other words, shows 4 more particularly, in particular, an abstract representation of involved software layers in the display system 100 for the realization of a secure display by ASIL measures according to ISO 26262 ,

In the display system 100 In this case software facilities are executable. A first group of software devices includes static data facilities 401 , dynamic data 402 , a code 403 and an ad 404 , Using the first group of software devices, the security-critical display elements F can be generated. A second group 405 of software devices that is separate from the first group of software devices, represents protection mechanisms according to ISO 26262 , The second group 405 includes facilities for qualified static data 406 , secured dynamic data 407 , a qualified code 408 and a safe ad 409 , Using the second group 405 of software devices, the safety-critical display elements E can be generated.

5 shows a context diagram 500 a human-machine interface (HMI) or an HMI Contextual diagram according to an embodiment of the present invention. In other words, shows 5 an overview of software modules of a display system such as the display system 1 , Here are a safe HMI address space 501 and a regular HMI address space or QM HMI address space 502 shown. The secure HMI address space 501 and the QM HMI address space 502 are separated from each other here, in particular in the sense of a so-called software separation. This is the secure HMI address space 501 used for safety-critical image data, display elements or content, with the QM HMI address space 502 is used for non-critical image data, display elements or content. The secure HMI address space 501 and the QM HMI address space 502 allow separate processing of safety-critical image data, display elements or content relating to the non-critical image data, display elements or content.

6 shows an overview 600 address spaces for a man-machine interface according to an embodiment of the present invention. Shown here are a regular address space 601 or regular virtual address space (VAS) for the human-machine interface (HMI) and a secure address space 602 or secure virtual address space (VAS) for the man-machine interface (HMI). Also shown is a kernel 603 on which the regular address space 601 and the secure address space 602 based. In other words, shows 6 an overview or implementation of a so-called software stack or software stack or a software concept for a secure man-machine interface.

The following is with reference to the 1 to 6 Also embodiments of the present invention in terms of protection (Freedom of Interference) security critical received by other display logic. Such hedging can be realized by a combination of several methods. In this case, a first method relates to memory protection, a second method relates to protection of program code and program data or variables, a third method relates to monitoring of registers, and a fourth method relates to protection of image data. These merely exemplary four methods are discussed in more detail below.

In the first method a memory protection is realized. In this case, according to an embodiment in execution of the method 200 in step 210 the processing of the safety-critical image data C and the non-critical image data D and the safety-critical display elements E and the safety-critical display elements F in separate and / or mutually secured memory areas, address spaces and / or process spaces 501 and 502 respectively. 601 . 602 and 603 to get managed. Optionally, in this case also in step 210 the processing an illegal memory access to the separate and / or mutually secured memory areas, address spaces and / or process spaces 501 and 502 respectively. 601 . 602 and 603 be recognized and / or prevented. In order to realize a secure separation of safety-relevant from other display logic, the data C and D or display elements E and F for the respective displays in separate and mutually secured memory areas 501 and 502 respectively. 601 . 602 and 603 to get managed. For example, three separate memory areas 601 . 602 and 603 used as it is in 6 is shown. It may be used by an operating system provided mechanisms for memory protection, such as separate process spaces, Virtual Address Space, etc., and may be extended by additional security mechanisms. As additional security mechanisms can be a recognition of inadmissible memory access, thus a memory of the security-relevant address space 501 . 602 is not corrupted by any other address space, by using a memory management unit (MMU), optionally, the MMU can detect invalid memory accesses to separate address spaces, cyclic monitoring of the MMU to determine if the MMU is active or inactive, a cyclic test as to whether an MMU table is consistent or modified, a cyclic invalidation and write-back of memories, for example Level 1 and Level 2 cache memory, a secure storage of variables by cyclic redundancy check (CRC) and Redundancy within the secure address space 501 . 602 and / or the like can be used.

In the second method, a safeguard of processing resources or program code and program data or variables is realized. It can according to an embodiment in the execution of the method 200 in step 210 at least one processing resource is checked to determine whether a proper state or a faulty state of the at least one processing resource exists. At startup, an application or software when loading z. B. be verified by means of CRC. After the software has started, a RAM test (RAM = Random Access Memory) can be performed before data is displayed in order to ensure the correct functioning of a data and address bus or to detect hardware errors. In addition to this at runtime Invariable portion of the software, such as a source code, constant data, etc., cyclically checked and compared with a reference value, eg. Via CRC. In the case of a deviation, a so-called safe state or safe state can be assumed.

In the third method, monitoring of registers is realized. In this case, according to an embodiment in execution of the method 200 in step 210 the processing register values which represent the safety-critical image data C and / or the safety-critical display elements E are compared with stored in a protected memory area reference register values, wherein in the event of a deviation, an error handling can be performed. After a system start, a display controller can be initialized. Initialized values should not change over a runtime of the system. Reference register values for the safety-relevant graphics level 302 or graphic layers can be kept in a protected memory area, whereby a combination with the above-mentioned second method is possible. Register values of the display controller set at system start can be cyclically read and compared with the reference values. In the case of a deviation, an error handling can be carried out, for. 3 times, taking a safe state, etc. Regardless of a result of the comparison, the reference values may be rewritten in the display controller to avoid a possible readback error.

In the fourth method, a backup of image data is realized. In this case, according to an embodiment in execution of the method 200 in step 210 processing during a compile time, the safety-critical image data C are merged and secured, reference backup data is generated and stored in the library, and during a runtime, backup data is computed and compared against the reference backup data, with error handling in the event of a deviation can be executed. The image data C for the secure display, such as icons and textures, can be combined at the compile time or compile time to a library (asset library). Contents of the library can be used in your production z. B. be secured via CRC. In this case, such backup data can be stored as reference values in the library. The library can be transferred to a target system, e.g. Example, by storing the library in a flash memory of a combination instrument of a vehicle. The backup data can be recalculated at runtime, eg. B. in a secure area of the target system, optionally in combination with one of the above methods. These data calculated at runtime can be compared with the reference values stored in the library. In the case of a deviation, an error handling can be carried out, for. Repeating three times, taking the safe state, etc.

7 shows a schematic representation of a display system 100 according to an embodiment of the present invention. The display system 100 here is the in 1 illustrated display system similar or corresponds to the same. The display system 100 has a display device 110 or display and a drive device 120 on, which is a first processor 721 and a second processor 722 having. By a dividing line are in 7 the first processor 721 and the second processor 722 symbolically or for illustrative reasons divided into a hardware section HW and a software section SW.

The first processor 721 has a microcontroller or microcontroller unit in the hardware section HW 740 on. The microcontroller unit 740 comprises according to the in 7 illustrated embodiment of the present invention, a central processing unit 741 or central processing unit (CPU = Central Processing Unit), a CAN bus device 742 (CAN = Controller Area Network), a LIN bus device 743 (LIN = Local Interconnect Network) and a random access memory or RAM (Random Access Memory) and a read only memory or ROM (Read Only Memory). In the software section SW, the first processor points 721 for example, an operating system 751 , Software services and drivers 752 as well as applications or applications 753 on.

The second processor 722 has a system on a chip in the hardware section HW 760 (SOC = System On Chip). The system on a chip or chip system 760 comprises according to the in 7 illustrated embodiment of the present invention, at least one further central unit 761 or central processing unit, at least one graphics processing unit 762 (GPU = Graphics Processing Unit) and a display control unit 763 or display control. In the software section SW, the second processor points 722 for example, another operating system 771 , other software services and drivers 772 , an HMI application 772 or HMI application, a safety stack 774 or safety stack and a safe HMI device 775 on.

The microcontroller unit 740 of the first processor 721 and the system on a chip or chip system 760 of the second processor 722 are connected to one another in a way that enables data transmission. Also, the microcontroller unit 740 of the first processor 721 Data transmission capable connected to vehicle networks X, for example via a CAN bus and / or via a LIN bus. The system on a chip or chip system 760 of the second processor 722 is data transferable connected to an out-of-process random access memory (RAM) and a processor-external read-only memory (ROM). Furthermore, the system is on a chip or chip system 760 of the second processor 722 data transferable with the display device 110 connected.

8th shows a schematic representation of a display system 100 according to another embodiment of the present invention. The display system 100 here is the in 1 illustrated display system similar or corresponds to the same. Specifically, the display system is the same 100 the display system 7 except that in 8th illustrated display system 100 a display device 110 or display and a drive device 120 comprising only one processor 820 having. Through a dividing line is also in 8th the processor 820 symbolically or for illustrative reasons divided into a hardware section HW and a software section SW.

The processor 820 has a microcontroller or microcontroller unit in the hardware section HW 840 on. The microcontroller unit 840 comprises according to the in 8th illustrated embodiment of the present invention, a central processing unit 841 or central processing unit (CPU = Central Processing Unit), a CAN bus device 842 (CAN = Controller Area Network), a LIN bus device 843 (LIN = Local Interconnect Network), a graphics processing unit 844 (GPU = Graphics Processing Unit) and a display control unit 845 or display control. In the software section SW, the processor points 820 for example, an operating system 851 , Software services and drivers 852 , Applications or applications 853 , an HMI application 854 or HMI application, a safety stack 855 or safety stack and a safe HMI device 856 on.

The microcontroller unit 840 of the processor 820 is data transferable connected to vehicle networks X, for example via a CAN bus and / or via a LIN bus. Also, the microcontroller unit 840 data transfer capable with an out-of-process Random Access Memory (RAM) and a processor-external read-only memory or ROM (Read Only Memory) connected. Further, the microcontroller unit 840 data transferable with the display device 110 connected.

With reference to the 1 to 8th An embodiment of the present invention is summarized below and in other words. A display system 100 For motor vehicles this includes a microcontroller with interfaces to the vehicle, connected to a graphics controller including a connected frame buffer, which supports a display in multiple levels or graphic layers (Graphics Layers), connected to a display device 110 or graphic display in the vehicle, eg. As a TFT LCD, and a means for particularly secure display display content display by separating processing safety-critical or secured display content A and security-uncritical or unsecured display content B. This is a display of the secured content A in the top level graphics 302 realized that can not be obscured by other graphic layers. Here is also an optional partial or holistic transparency of this graphic layer 302 Usable to make other or non-critical content B fully visible if the secured content A only a sub-area below the top level graphics 302 claim. Also, one or more of the above methods are applicable here, memory protection or processing of the secured contents A in a memory area that is protected, the protection of program code, the monitoring of the registers and / or the protection of the image data.

The embodiments described and shown in the figures are chosen only by way of example. Different embodiments may be combined together or in relation to individual features. Also, an embodiment can be supplemented by features of another embodiment.

Furthermore, the method steps presented here can be repeated as well as executed in a sequence other than that described.

If an exemplary embodiment comprises a "and / or" link between a first feature and a second feature, then this is to be read so that the embodiment according to one embodiment, both the first feature and the second feature and according to another embodiment either only first feature or only the second feature.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102004032807 A1 [0003]

Cited non-patent literature

• Standard ISO 26262 [0001]
• ISO 26262 ASIL B [0002]
• ISO 26262 [0005]
• ISO 26262 [0005]
• Standard ISO 26262 [0007]
• ISO 26262 ASIL B [0008]
• ISO 26262 [0008]
• ISO 26262-09 [0008]
• ISO 26262 [0008]
• ISO 26262 [0008]
• Standard ISO 26262 [0045]
• Standard ISO 26262 [0046]
• ISO 26262 [0051]
• ISO 26262 [0052]

Claims (12)

Procedure ( 200 ) for driving a display device ( 110 ) on which security-critical content (A) and non-secure content (B) can be displayed, the process ( 200 ) comprises the following step: processing ( 210 ) of imported image data (C, D), wherein safety-critical image data (C) and non-critical image data (D) separated from each other and / or independently processed to produce safety-critical display elements (E) and safety-critical display elements (F), the safety-critical Display elements (E) are generated so that the safety-critical display elements (E) in one by means of the display device ( 110 ) displayed safety-critical display elements (F) graphically superimposed. Procedure ( 200 ) according to claim 1, characterized in that in step ( 210 ) processing the safety-critical image data (C) and the safety-critical image data (D) and the safety-critical display elements (E) and the safety-critical display elements (F) temporally, spatially and / or resources are separated from each other and / or processed independently. Procedure ( 200 ) according to one of the preceding claims, characterized in that in step ( 210 ) of processing the safety-critical display elements (E) are generated so that the safety-critical display elements (E) in the means of the display device ( 110 ) state in any other graphics layer ( 301 ) graphically overlapping graphics layer ( 302 ) or that the safety-critical display elements (E) in the display device ( 110 ) replace safety-critical display elements (F) graphically. Procedure ( 200 ) according to one of the preceding claims, characterized in that in step ( 210 ) of processing the safety-critical image data (C) and the non-critical image data (D) and the safety-critical display elements (E) and the safety-critical display elements (F) in separate and / or mutually secured memory areas, address spaces and / or process spaces ( 501 . 502 ; 601 . 602 . 603 ) to get managed. Procedure ( 200 ) according to claim 4, characterized in that in step ( 210 ) of the processing an illegal memory access to the separate and / or mutually secured memory areas, address spaces and / or process spaces ( 501 . 502 ; 601 . 602 . 603 ) is detected and / or prevented. Procedure ( 200 ) according to one of the preceding claims, characterized in that in step ( 210 ) of processing at least one processing resource is checked to see whether a proper state or a faulty state of the at least one processing resource exists. Procedure ( 200 ) according to one of the preceding claims, characterized in that in step ( 210 ) of the processing, register values which represent the safety-critical image data (C) and / or the safety-critical display elements (E) are compared with reference register values stored in a protected memory area, an error treatment being carried out in the event of a deviation. Procedure ( 200 ) according to one of the preceding claims, characterized in that in step ( 210 ) of processing during a translation time, the safety-critical image data (C) are assembled and secured to a library, wherein reference backup data are generated and stored in the library, during a runtime calculated backup data and compared with the reference backup data, in the case a deviation an error handling is performed. Contraption ( 120 ), which is designed to handle all the steps of a process ( 200 ) for driving a display device ( 110 ) to implement, implement and / or to control according to one of the preceding claims. Display system ( 100 ) for displaying safety-critical content (A) and non-secure content (B), wherein the display system ( 100 ) has the following features: a display device ( 110 ), on which safety-critical content (A) and non-safety-critical content (B) can be displayed; and a device ( 120 ) according to claim 9, which is capable of data transfer with the display device ( 110 ) is connectable or connected, the device ( 120 ) is adapted to the display device ( 110 ) to provide safety-critical display elements (E) and safety-critical display elements (F) for display. Computer program adapted to perform all steps of a procedure ( 200 ) to implement, implement and / or to control according to one of the preceding claims. Machine-readable storage medium with a computer program stored thereon according to claim 11.

Images