I talked to one of the devs a whule ago: the safety critical part of the display is rendered by a completely separate renderer which is kept as simple as possib

I talked to one of the devs a whule ago: the safety critical part of the display is rendered by a completely separate renderer which is kept as simple as possible. Most of the application specific code for it is generated automatically and a lot of the typical dynamic behaviour (dynamic memory allocation etc.) is strictly forbidden so that the result follows the requirements of safety standards.