F ’ A U L U Y SYSTEM

Ellis F. Hitt, Projects Manager

Battelle, 505 King Avenue
Columbus, Ohio 43201

Summarv
. .
for Awe-
.
This paper discusses the fault tolerant
Svstem
An avionics display system (ADS) must continue
requirements of avionics display systems, and to provide flight critical (crucial) information in the

-
an open architecture based upon industry and presence of faults (both hardware, software, and
DoD standards which permits implementing crew). The ADS must fail operational, fail safe,
these requirements. The fault tolerant and meet the flight critical reliability requirement
requirements include the classes of hardware that the probability of failure must be per
and software faults. Within each class, the flight hour.
requirements are broken down into fault types
the system must tolerate. The designers of both
hardware and software must develop an Classes of hardware faults which must be
integrated approach to implementing fault

-
detection, damage assessment, fault isolation, detected include processor faults, sensor faults,
data transmission faults, output device faults,
and recovery for the fault types. Active matrix
(AM) liquid crystal displays (LCDs) used with high and actuator faults‘ . Each of these fault classes
performance graphics and video processors can be further decomposed into lower level
provide the capability needed to achieve these faults.
fault tolerant designs. Battelle is developing
avionics display systems using AM-LCD and
advanced display processor technologies for A software fault is a design defect which is
programs such as the F-16A/B Radar Electro- directly or indirectly caused by a human mistake
Optical (REO) display set replacement. and can occur in every phase of the software life-
cycle.2 Classes of software faults which must be
detected include incorrect specification,
incorrect algorithms, incorrect logic, coding, and
Aircraft displays have undergone an evolution other mistakes including compiler faults.
from dedicated single function electro- Software fault tolerance is the ability of a system
mechanical instruments such as the horizontal to provide uninterruptible operation in the
situation indicator (HSI), attitude director presence of software faults through multiple
indicator (ADI), altimeter, and engine implementations (i.e., redundancy) of a given
instruments to cathode ray tube (CRT) displays functional process.
whose imagery is generated by dedicated
(graphics only in some cases) programmable to I m d e m e n ~ of
n Fault
display processors whose source code is Tolerance
assembly language. The next step in this Fault detection is required at
evolution is the replacement of the CRT with three levels to assure: (1) correct operation of
color flat panel displays and the dedicated each functional processing unit, (2) valid
programmabledisplay processors with higher transmission of data between digital
performance graphics and video processors subsystems, (3) data validity, prior to use in
programmed using higher order languages such computation and after conversion of digital
as Adam and C. Video, graphics, video with output data to the form required for display to
graphics overlaid, or multiple sources of video the crew, or output to actuators or sensors using
and graphics can be displayed in windows on a the result of the process. Software faults are
single display. The new higher performance manifested as errors. The capability to detect
graphics processors and software also provide errors is the crux of any fault-tolerant technique.
the capability to eliminate dedicated control
panels with their equivalent functions Ramage Ass-. Since it is doubtful that
implemented in pilot selectable (through bezel any error detection technique will occur
mounted switches, or new pilot vehicle interface concurrently with the encountering of a software
(PVI) devices) pull down or pop-up menus. fault, an assessment of the extent of the
damage (i.e., changes in state information) must

393
CH3030-4/91/OOOO-0393 $1.OO 1991 IEEE
take place prior to attempting error recovery. computer industry's growth resulted in various
Often, damage assessment assumptions are a standards being developed for both backplane
part of the design of the fault-tolerant software buses as well as video interfaces with displays.
system. Many of these standards have been adopted by
professional societies such as the Institute of
Fault.Fault isolation attempts to Electrical and Electronic Engineers (IEEE) or by
eradicate the source of the fault, and return the national standard organizations such as the
system to full capability and prevent that fault National Television Standards Committee
from creating further errors. (NTSC).

m.
Error recovery returns the system The IEEE-1296backplane standard (Multibus II)
is used for all interfaces between modules. As
from an erroneous to a correct state. This
should occur with m crew intervention. shown in Figure 1, the use of the Message
Passing Coprocessor integrated circuit provides
. .
vto#
. the interface between the local bus on the
Avionics displays have typically been proprietary module and the backplane bus. This permits the
designs with little flexibility in the display use of dissimilar graphics processors for the
software for addition of enhanced capability Common Graphics Modules, and the
required to perform new missions. The personal
NODE NODE

Corn uter Computer Corn uter

!E7 Sensor

NODE
Ext. BUS 16-Bit 64-Bit
Computer Module Computer
I
-1 I

I Sensor 1 I Antenna I
lbase 1 MPC = Message Passing Coprocessor
CGM = Common Graphics Module
PVI = Pilot Vehicle Interface
DSP = Digital Signal Processor
MCI - Memory Card Interface
VIM = Video Interface Module
SlOC = Smart Input Output Controller
Figure 1. Open System Architecture

394
 microprocessors used in Processor Modules. (TFT) active matrix liquid crystal display (AM-
This architecture also permits replacement of a LCD), with fully color capability, is becoming the
single module with a higher performance display of choice for avionics applications
module as technology continues to advance. involving multifunction-muttipurpose displays
Two approaches are possible for implementation (MF-MPDs). Full color capability is defined to
of the fault tolerant software. Even though the mean that the AM-LCD has a Red, Green, Blue
software design is derived from a common (RGB) pixel group arranged in a pattern such as a
software requirements specification, dissimilar triad (delta), horizontal stripe, or vertical stripe.
software for each processor can be achieved One arrangement has R,G,G,B (twogreen
provided that independent software pixels) arranged in a quad as one solution for
development teams are used. Another night vision goggle compatibility. Many AM-
approach provides software fault tolerance by LCDs are available as commercialoff-the-shelf
using common avionics reusable software products whose primary markets are laptops and
modules (whose dependability has been automotive applications. The AM-LCDs being
established through formal analyses, testing, developed for the automotive market must
and simulation) which are compiled with different operate in environments approaching that of
compilers. aircraft. The AM-LCDs are also being used in
portable TV applications including integration
New Teem with an 8 mm Video Cassette Recorder (VCR).

DisDlavs An AM-LCD does not have the catastrophic

Flat panel displays are on the verge of replacing failure modes of a cathode ray tube (CRT)
not only Cathode Ray Tube (CRT) displays, and display. The display can have individual
when connected to graphics processors which transistors in the matrix fail and operate with rile
generate symbology representing the current degradation whereas failure of the cathode in a
aircraft state, electromechanicaldisplays. Most CRT will resutt in failure of the display even when
flat panel displays in laptop computers have inputs signals are present.
been a monochrome (single color) liquid crystal
display (LCD). This display was initially reflective, Color flat panel display technologies and their
but is predominately backlit today. While there characteristics are presented in Table 1.
are various types of LCD, the thin-film transistor

,
I VENDOR Hitachi Sharp
Sharp Sharp Sharp 01s
MODEL NO. TM16DOlHC LQ323YO9 LQ424YO1 LQ6NCO1 LO1OD011 5ATI-D
I

Display Format (H) 640 384 48 0 720 640 648

' Display Format (V)
Total Screen Pixels
200
384,000
240
276,480
240 240
345,600
48 0
518,400
648
921,600 419,904
Color Groups (dots) 128,000 92,160 115,200 172,800 307,200 139,968
Screen Size (Diagonal) 6.3 inches 3 inches 4 inches 5.7 inches 10.4 inches 5.66 "
Screen Dimension (H) mm 128 61.8 82.1 113.8 211.2 101.6
Screen Dimension (H) in. 5.03936 2.433066 3.232277 4.480306 8.314944 4
Screen Dimension (V) mm 96 45.6 63.4 87.6 158.4 101.6
Screen Dimension (V) in. 3.77952 1.795272 2.496058 3.448812 6.236208 4
Active Screen Area (sq.mrn) 12,288 2,818 5,205 9,969 33,454 10,323
Dot Pitch (W) x (H) (serial) 0.2 x 0.48 .161 x .190 .171 x .264 .158 x .365 .33 x .33 .157 x

Dot Configuration B A G Rows R,G,B Delta R,G,B Delta R,G,B Delta

Stri
Resolution (DPI) (H)
Resolution (DPI) (V)
Resolution (CGPI)
Outline W (mm)
127
53

187
158
134

94.2
149
96

122
1-
161
70

149.4
108 x 81

395
 interfaces 1/2 the update rate) if one channel fails. The
output of each channel is fed to a video cross
Display controller chip sets available provide the point switch which permits the crew to prioritize
Computer Graphics Adapter (CGA), Extended the information displayed and hence restore full
Graphics Adapter (EGA), and Video Graphics capability in terms of update rate for the most
Adapter (VGA) interfaces. These interfaces important information. If the crew commands
provide the capability to generate 4, 8, and 16 through the pilot vehicle interface (PVI) a shift of
colors. More sophisticated chip sets provide up information from one display surface to another,
to 4,096 colors in the color palette. the ADS CGM and Video Interface Module (VIM)
instantaneously switch the graphics and video to
The AM-LCD requires input of DC power and the appropriate display and window (if selected)
either NTSC composite video (RS-170 or RS- on that display. Multiple CGMs can be inserted
343),analog RGB, or digital RGB drive signals. into the backplane as shown in Figure 1. Two
Some of the available AM-LCDs permit input of CGMs can generate symbology for 4 displays.
both composite video and analog RGB (CGA,
EGA, or VGA dependent on the controller Pilot Vehicle Interfax
used). The backlight is typically powered from Bezel mounted switches and a keyboard have
an inverter and is either a cold or hot cathode haen used with CRT based MF-MPDs. All pilot
fluorescent. selectable items were presented as fixed menus
on dedicated displays. The industry is now
experimenting with pull-down and pop-up
Battelle uses the Standard Electronic Module menus in place of the continuously displayed
(SEM) Format E for the package of each of the menu. Furthermore, new input devices
modules designed to provide each of the including derivatives of the personal computer
functions of the Avionics Display System (ADS). "mouse" such as trackballs, touch-screens, and
A CGM contains two graphics channels per touch-pads are being evaluated by the avionics
module. Each channel contains a graphics industry and end users such as USAF. It is vitally
processor and floating point coprocessor. Each important that the PVI hardware and software be
channel can drive a single AM-LCD with multiple fault tolerant. This requires the pilot workload be
windows of graphics and video at a 30 Hz update kept to a minimum and display menus and pages
rate for fully anti-aliased cockpit displays with a be free of any possible misinterpretationby the
60 Hz refresh rate. A "heart beat" signal from pilot. The paths between pages must be
each channel provides the status feedback intuitively obvious and natural. The pilot must
which permits a single channel of the CGM to not be required to retrace a hierarchical path into
continue to drive two AM-LCD with all a menu with many levels of indenture in order to
information needed with no crew intervention (at select another function. Simultaneous multiple

396
windows may permit these easy moves between Video signal sources can be either 525 line
functions similar to that possible with dedicated NTSC RS-170 or 875 line NTSC RS-343. RS-
control panels, but without the disadvantage of 170 is a one-channelcomposite signal of 525
having to locate the coned panel and a particular interlaced lines of video per frame at 30 frames
switch on a dedicated panel. Figure 2 depicts a per second (fps). The interlaced frame is made
two menu pop-up display with the left menu up of two separate but overlapping fields, with
providing function selection and the right each field containing alternating lines of the
indicating the available functions selectable by image. Each field is displayed at 60 Hz. Two
the pilot previously on a navigation control interlaced fields are required to make up one
panel. image. If the display has fewer lines of pixels
than the input video source, an underscan
technique can be used which compresses the
NTSC image so that it can fi the entire number
of lines onto the number of actual lines present
on the display. This is done with many CRT
displays that receive inputs of 875 lines for
display on a 525 line display. Most AM-LCDs
also require the use of underscanning as shown
by examinationof Table 1. The VIM also accepts
NAV DATA DlSP inputs of an external synchronization signal for
implementation of genlock. Without genlocking,
interference patterns may occur when mixing
STEERSELECT video signals from external sources with video
signals from the CGM.
I NAVUPDATE I Compression algoriihms can be used to store
video information in memory or on a storage
medium such as hard or optical discs.
Decompression algorithms can be used to
Figure 2. Pop-up Menus convert the compressed data to permit its full
fidelity display.
In addition to changing the crew input devices . .
f GraDhlcs/VideoTe-
and the crew's interaction with the display, the
new technologies provide the capability to add Avionics
Duringthe next 20 years, the majonty of aircraft
color to the output of monochrome (shades of which will be in operation are flying today. While
gray) sensors such as radar and forward looking
new aircraft such as the F-22,Light Helicopter
infrared (FLIR). These capabilities can result in
(LH), and the Boeing 777 plan to use Active
quicker target acquisition and identification.
Matrix Liquid Crystal Display (AMLCD)
technology, the application of the new display
Onboard databases can be used to store maps,
technologies to existing aircraft will ensure their
approach plates, digital terrain elevation data, ability to remain cost effective, integrate with
cultural features, etc. and libraries which can be
new Air Traffic Control (ATC) technologies, and
used by the graphics processors to generate provide compatible displays as crews upgrade
moving maps, and synthetic three-dimensional from older aircraft to new aircraft. Retrofitof new
(3D) scenes which appear to move relative to the display technology requires interfacing this
aircraft. technology with existing sensors and wire
harnesses.
Analog video can be converted to digital using Battelle is developing fault tolerant advanced
high speed analog to digital (ND) converters, display systems to replace CRT and electro-
Digital video can be multiple lines of RGB. Digital mechanical displays wherever they are used.
video generated by a graphics processor can be USAF recently selected Battelle under the
converted to analog video using high speed Design Engineering Program to replace the F-
digital to analog (D/A) converters whose output 16NB Radar Electro-Optical (REO) display set
can in turn be converted to NTSC composite with this advanced display system technology.
video or NTSC RGB signals. The improved REO display set incorporates the
new technologies discussed in this paper.

397
Table 2 provides a comparison of the existing
REO display set and the new REO display set.

F-l6A/R RFO-D
FO New RFO D i
Radar or Weapon Station Radar & W e w n Station Video: MultiDle Video
Video Only & Graphics sburces; MultifunctknMenus for
Pilot Selection
Performance Monochrome Fixed Format Color, Programmable, Drive 2 Displays per
Drive 1-2 Displays with same CGM With Different Pilot Selectable
Radar or Weapon Station Symbology & Video. Eliminates some
Video Dedicated Panels. NVWANVIS Compatible
152 hours 10,000 hours
Weiaht 32.8 Ibs 15 Ibs
Technoloav 1970 1991: Multi-processing 32-Bit Micro-

Q2St -$50K (CRT alone is $5K) -

processors
$25K (LCD is $500)

The technologies developed for personal

computer applications applied to aircraft displays
and display processors can provide the
capability to retrofit existing aircraft and assure
their ability to perform their missions in the more
complex operational environment that is
expected for the next two decades.

References
lHitt, Ellis F. and Eldredge, Don, "Fault,
Detection, Isolation, and Recovery Techniques
for Fault Tolerant Digital Avionics", 5th Digital
Avionics Systems Conference.

2Hitt, Ellis F. and Webb, Jeffrey J., "A Fault-

Tolerant Software Strategy for Digital Systems",
AIAA-84-2646-CP, 6th Digital Avionics Systems
Conference.

398