Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
  • G06F3/14—Digital output to display device ; Cooperation and interconnection of the display device with other functional units
• • G—PHYSICS
  • G01—MEASURING; TESTING
  • G01C—MEASURING DISTANCES, LEVELS OR BEARINGS; SURVEYING; NAVIGATION; GYROSCOPIC INSTRUMENTS; PHOTOGRAMMETRY OR VIDEOGRAMMETRY
  • G01C23/00—Combined instruments indicating more than one navigational value, e.g. for aircraft; Combined measuring devices for measuring two or more variables of movement, e.g. distance, speed or acceleration
  • G01C23/005—Flight directors
• • G—PHYSICS
  • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
  • G09G—ARRANGEMENTS OR CIRCUITS FOR CONTROL OF INDICATING DEVICES USING STATIC MEANS TO PRESENT VARIABLE INFORMATION
  • G09G2340/00—Aspects of display data processing
  • G09G2340/10—Mixing of images, i.e. displayed pixel being the result of an operation, e.g. adding, on the corresponding input pixels
• • G—PHYSICS
  • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
  • G09G—ARRANGEMENTS OR CIRCUITS FOR CONTROL OF INDICATING DEVICES USING STATIC MEANS TO PRESENT VARIABLE INFORMATION
  • G09G2340/00—Aspects of display data processing
  • G09G2340/14—Solving problems related to the presentation of information to be displayed
• • G—PHYSICS
  • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
  • G09G—ARRANGEMENTS OR CIRCUITS FOR CONTROL OF INDICATING DEVICES USING STATIC MEANS TO PRESENT VARIABLE INFORMATION
  • G09G2352/00—Parallel handling of streams of display data
• • G—PHYSICS
  • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
  • G09G—ARRANGEMENTS OR CIRCUITS FOR CONTROL OF INDICATING DEVICES USING STATIC MEANS TO PRESENT VARIABLE INFORMATION
  • G09G2380/00—Specific applications
  • G09G2380/12—Avionics applications

Definitions

• the present invention relates to a system for processing and displaying data in the context of displaying, on the same screen, active and / or passive information coming from domains whose security or confidence levels are different.
• An example of a high security domain is the system architecture of the flight domain of an aircraft.
• a data processing device For the processing and display of parameters of the flight functions of an aircraft, for example the data of the fuel supply systems, the data of the control circuit breakers of various avionic circuits, these systems are connected to a data processing device.
• display in the form of a console comprising a screen and man-machine interface means such as a keyboard or a means of movement and input on the screen as a wheel pointer or a mouse.
• the display processing device is adapted to receive data from the systems of the flight domain. These data come from embedded systems of the flight domain and according to these data the pilots have actions to perform which transit through the systems of the flight domain.
• the display processing device is able to return the parameters of the actions of the operator such as that position of the pointer and pressing a key displayed on the screen by the systems of the field of flight.
• the flight systems system architecture is a highly secure architecture that is designed so that no intrusion into the networks of this system that can disrupt its operation can be committed.
• the display processing device is switched to the display of the manual page.
• the confirmation window launched by the most secure domain will completely hide the information window displayed by the least secure domain, since it is not possible to segregate the screen or allow both domains to access it simultaneously.
• the problem is that the operator no longer has the information from the less secure domain when he has to confirm the launch of the action.
• the exact description of the action and its context from which flow its acceptance or not to launch the action is described in the information coming from the less secure domain.
• the problem to solve is to keep the display of data from the less secure domain, while the display has been switched to the more secure domain to launch actions.
• the solution proposed by the present invention is based on means making it possible to display by a more secure domain and on the same screen, on the one hand, informative data coming from a less secure domain in the first instance, and on the other hand from the active data of the more secure domain overprinting.
• This active data makes it possible to launch one or more commands in and from the most secure domain.
• the system is always composed of two separate security domains, and a display.
• the display can always be switched manually or automatically in one of the two areas, but the two areas can not under any circumstances use this display simultaneously.
• the less secure domain display a certain amount of information on the screen, and may request the launching of an action that can only be performed by the more secure domain. It is then necessary that the most secure level take the "responsibility" to actually launch the execution of the action.
• the present invention proposes a system for processing and displaying data, characterized in that it comprises processing and display means adapted to display from a more secure domain and on the same screen.
• a display processing device on the one hand informative data from one or more less secure domains and, on the other hand, active data from the more secure domain overprinting.
• the system of the invention comprises selection means adapted to manually or automatically switch the processing and display means in one of the two domains and adapted to prohibit the simultaneous use of the processing and display means by both domains.
• the processing and display means are part of the most secure domain, this domain comprising a control module adapted to receive the data of the less secure domain or domains and to support the display of those data.
• the data of the less secure domain or domains is passive data.
• the system of the invention is such that the most secure domain comprises filtering means adapted to allow the display of active data of the single most secure domain.
• the most secure domain preferably comprises means for defining active zones of the screen and for limiting these active zones to a display area of a control window displayed by this domain.
• the processing and display means are furthermore preferably adapted to prohibit the presence of man-machine interface means in the areas of the screen other than the active zones.
• the system of the invention comprises sequential processing means adapted to first display the information from a first data sending module of the less secure domain or domains, then those from a second module sending more secure domain data.
• the processing and display system comprises a connection between at least a first computer of the less secure domain and a second computer of the more secure domain to allow the passage of a data frame. from the less secure domain to the more secure domain.
• the frame is advantageously of a predefined and reduced format excluding the passage of control data.
• the frame is preferably defined to contain only information representative of the data to be displayed and of a fixed size format.
• the most secure domain comprises in particular means adapted to cause a display of the information contained in the frame only passively.
• FIG. 1A and 1B a schematic representation of a display device of two fields of the prior art
• Figure 2 a schematic representation of an exemplary embodiment of a system of the invention
• FIG. 3 a schematic representation of the steps of displaying information of a less secure domain and of commands to a more secure domain according to the invention
• FIG. 4 a schematic representation of the steps of displaying information of a less secure domain and of commands to a more secure domain according to a variant of the invention.
• two domains are considered: a more secure A domain and a less secure B domain.
• Domain will be called an embedded avionics system whether it is a complex system comprising a set of networked computers, the associated software and protocols and the actuators and sensors of this system or a simple system comprising a single computer and its associated software depending on the level complexity of the functions handled by this system.
• the domain A may be in particular the flight parameter management system, flight controls and control surfaces, the fuel management system or the system comprising all the functions necessary for the flight of the aircraft.
• Domain B may be, for example, the computerized maintenance management system, an unsafe cabin system or the like.
• the invention applies for example to the performance of aircraft maintenance operations for which, from a maintenance manual contained in a maintenance computer, the operator must perform actions on the avionics system of the aircraft.
• a display processing device is also considered comprising a common screen and a common human-machine interface console for the computer networks of the two domains, the two domains being able to access separately (not simultaneously ) to the display processing device.
• Figure 1A shows a solution of the prior art.
• the less secure domain B is schematized by rectangle 1.
• Domain A of high security level is shown schematically by rectangle 2.
• the data 1a, 1b to be displayed from these two domains are sent to a manually or automatically operated switch 3 which directs the information to a display processing device 4 comprising a display 5.
• the avionics calculator is part of the more secure domain A because it allows to act directly on the controls of the aircraft.
• the maintenance computer contains, in particular, the maintenance manual.
• the manual In order for the manual to be updated regularly at a lower cost, it must remain easily modifiable, and therefore in a calculator or the level of security is lower than that of the avionics calculator.
• the maintenance calculator is a less secure domain B calculator.
• the segregation between the avionics computer and the maintenance manual prevents actions by the avionics computer from being initiated directly from the maintenance computer.
• the diagram of FIG. 1B relates to a variant for which a command number can be sent from domain B to domain A through a secure link and for which the display 5 switches automatically from one domain to another .
• the proposed solution represented in FIGS. 2, 3 and 4 is based on the possibility of displaying by the more secure domain A and on the same display or screen 5, on the one hand, informative and passive data coming from one or more domains. B less secure and on the other hand higher security domain A active data.
• the active data are possible actions by the user: Display of zones on which the user can act (buttons, entry areas, checkboxes %), and which allow to launch one or more command from the domain the most secure, and in this same area.
• the data processing and display system of the invention comprises processing and display means adapted to display from the more secure domain A and on the same screen of the display processing device, on the one hand informative data from one or more domains B less secure on an inactive area 11a of the display and, on the other hand, active data of the more secure domain on an active area 11 b of the display.
• a link 10 is established between at least a first computer 1 of the less secure domain and a second computer 2 of the more secure domain to allow the passage of a data frame 9 of the less secure domain. to the more secure domain.
• the frame 9 To avoid accidental corruption of the frame and to easily control the data, the frame 9 must have the simplest possible format and be as small as possible.
• data from domain B should be displayed by domain A only on inactive areas 11a of the screen and domain A should be the sole master of the color configuration. All the data of the frame are predefined: number of colors displayable, size of the frame and exact list of the pixels contained in the frame.
• the informative data is thus sent from one of the less secure domains B to the more secure domain A in a frame 9 whose format is simple comprising only the information representative of the data to be displayed, without configuration parameters or commands.
• the frame is predefined and of fixed size.
• this frame is only intended to be displayed in a passive manner without possible user action, in the manner of a wallpaper.
• transfer means arranged in the most secure domain and for example in a display management computer comprising, according to FIG. 2, a fusion module 6.
• the number of colors displayable by the domain B will be limited and the color range will be further defined by the display management device 12 of the most secure domain according to the function of the color. This makes it possible: to reduce the risks of malicious use making it possible to produce very conspicuous displays thanks to the color scheme of the display, a better comfort of use, since it is necessary that the user can visually see the fact that the information is passive. to limit the volume of the frame exchanged from the less secure domain to the most secure domain, and therefore to be able to use architectures whose connection means between the two domains are potentially low on an embedded system for example.
• the most secure domain preferably comprises means for defining active zones of the screen and for limiting these active zones to a display area of a control window displayed by this domain.
• the processing and display means are furthermore preferably adapted to prohibit the presence of man-machine interface means in the areas of the screen other than the active zones.
• the only link between the two sending modules is preferably a connection means allowing the sending of synchronizations from the less secure domain to the module of the most secure domain.
• the system of the invention advantageously comprises a filtering device controls associated with a firewall and a system for authenticating and verifying the integrity of the data or less secure domains.
• the data fusion for the display is done in a module 6, merging or synchronization whose security level is identical to that of the most secure domain A, and which: can receive the least secure domain B only the predefined display frames, can receive data including frames to display from the most secure domain, can send the merged frames to display to the display,
• the reception or sending of additional data is conceivable, such as: the reception, by the merging module 6, of data for the display processing device, for example configuration data 14 or pointer mouse or ball of the device of display processing from the most secure domain.
• Additional communications are preferably limited, for example: to sending acknowledgments 13 of the data fusion or synchronization module for the display to one or other of the domains.
• the most secure domain manages the displays of the least secure domain during the command selection step to be performed on systems of the most secure domain.
• the most secure domain A is shown on the left of the figure, the screen or display 5 in the middle and the B domain the least secure on the right. According to this example, the separation is carried out on the same display 5 under the control of the computer of the most secure domain of information 104 coming from the less secure domain and information 103 of the more secure domain, without preliminary realization of a common merge of the data.
• the display first displays the information from the module less secure B.
• the least secure domain controller B sends a frame 9 containing the information of the information zone to the most secure domain A calculator.
• the domain A computer receives the frame and sends the display the information of the passive zone 104 to display containing the information from the domain A to the step E4.
• the domain A calculator sends an acknowledgment frame 16 to the domain B calculator.
• step E5 the order number to be made to the computer of the domain A through a secure link 15.
• step E6 the computer of the domain A sends the information of the active zone 103 to the display corresponding to the command C1 to be made.
• the segregation of the data of the passive zone 104 and data of the active zone 103 for the display can be done by software or by hardware.
• the advantage of the hardware solution is that it is more robust over time because it is less sensitive to changes in piracy means and knowledge.
• the residual risk is that the content of the frame 9 is modified in a consistent manner maliciously or accidentally in the domain B during its creation or that a coherent frame is sent by a third party to the domain A.
• FIG. 4 corresponds to an alternative embodiment of the system for which the domain A comprises a synchronization module type calculator or a merge module that will manage the display and the data of the active and passive zones 103, 104:
• step E11 the least secure domain B, rectangle 1, displays information 100 on the screen 5
• step E12 the operator requests the activation of a command C1 which must be carried out by the most secure domain A,
• step E13 the domain B sends to domain A a frame 9 of fixed size representing the list of colors of the pixels to be displayed on the screen as well as the formatting of the information zone,
• step E14 the domain A receives the frame 9 at a synchronization module
• step E15 the calculator of the less secure domain sends the number of the command chosen by the operator through a secure link 15,
• step E16 the computer of the domain A receives the number of the command and sends to its synchronization module the parameters of the active zone of the man-machine interface of the command to be displayed,
• the domain A synchronization module displays on the screen 5 the man-machine interface (HMI) of the control which occupies only a portion 11a of the window, the active zone 103, and displays the pixels described in the pixel frame sent by the domain B in screen portions 11a not occupied by the control's HMI, the information area 104.
• HMI man-machine interface
• the parameters of the information zone 100 at the top of the screen 5 whose display is required by the domain B are sent to the domain A.
• the display 104 of this information area by the Domain A uses different colors and the area A display area on the screen is different.
• the active areas 103 of the screen that is to say the areas where the operator using the pointer or the keyboard of the display processing device can validate an action or make a choice between two actions, are defined by the domain A and limited to the display area 11a of the command window displayed by this domain.
• the other areas of the screen 104 do not contain any active HMI elements.
• the list of colors used for the display of domain B information from domain A should be as small as possible (2 colors being ideal).
• Domain A From the function of each color.
• Domain B must translate its display into a number of colors managed by domain A.
• domain B displays 24 colors, while domain A only accepts 2 colors from domain B (background color, and write color for example), then domain B must translate its command to on-screen display on 2 colors only, these 2 colors corresponding to the two functionalities treated by Domain A.
• the size of the pixel frame is fixed and predefined, its content represents all or part or more of the screen displayed by the domain B.
• the position of the pixels contained in the frame is predefined and known jointly by the two domains.
• the content is actually a list of bits, each set of bits describing one or two pixels depending on whether the screen contains an even or odd number of pixels.
• each set of nb bits, with nb [integer part of (n / 2 + 0.5)] bits makes it possible to describe a pixel.
• nb [integer part of (n / 2 + 0.5)] bits
• the size of the frame is: integer part ([p * nb * 8 + 7] / 8) bytes.
• the frame is precisely defined and the useless data are eliminated either at the emission of the frame or by a filtering device in the processing module of the most secure domain.

Landscapes

• Engineering & Computer Science (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Theoretical Computer Science (AREA)
• Radar, Positioning & Navigation (AREA)
• Remote Sensing (AREA)
• Human Computer Interaction (AREA)
• General Engineering & Computer Science (AREA)
• Aviation & Aerospace Engineering (AREA)
• Controls And Circuits For Display Device (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=39167521

Family Applications (1)

Country Status (4)

Families Citing this family (10)

Family Cites Families (19)

• 2007
  • 2007-08-08 FR FR0756999A patent/FR2919951B1/fr not_active Expired - Fee Related
• 2008
  • 2008-08-05 EP EP08827202A patent/EP2183664A1/de not_active Withdrawn
  • 2008-08-05 US US12/671,682 patent/US8890893B2/en not_active Expired - Fee Related
  • 2008-08-05 WO PCT/FR2008/051462 patent/WO2009022080A1/fr not_active Ceased

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events