A non-similar dual-redundancy atmospheric data processing system and processing method for civil aircraft

Abstract

The present invention proposes a non-similar dual-redundancy atmospheric data processing system and processing method for civil aircraft, which adopts redundancy design to ensure its safety and reliability, as well as the fault tolerance requirements of fault operation. Aiming at the performance requirements and technical indicators of the atmospheric data computer, the redundant parallel non-similar dual-redundancy CPU working mode architecture is adopted to effectively suppress the possible common mode failures of software and hardware to ensure the reliability and safety requirements of the atmospheric data computer, and the fault tree is used to evaluate and analyze its safety.

Description

Technical Field

[0001] The invention belongs to the technical field of aerospace atmospheric data acquisition and processing, and in particular, relates to a non-similar dual-redundancy atmospheric data processing system and a processing method for a civil passenger aircraft. Background Art

[0002] The atmospheric data computer of a civil aircraft uses the principle of measuring air pressure to measure the aircraft's altitude, speed and other parameters in real time. It is an important system that affects aircraft flight safety and realizes autonomous navigation. Its safety assurance level is DAL A (the highest). The current safety index of a certain type of aircraft is: the failure rate of losing the airspeed / altitude signal output by a single ADC should not be greater than 2e-5 / hr. The average failure rate of commonly used devices is roughly 10 -6 ~10 -5 , single redundancy design cannot meet this safety index. Summary of the invention

[0003] In view of the above defects and needs of the prior art, the present invention proposes a non-similar dual-redundancy atmospheric data processing system and processing method for civil aircraft, which adopts redundancy design to ensure its safety and reliability, as well as the fault tolerance requirements of fault operation. In view of the performance requirements and technical indicators of the atmospheric data computer, a redundant parallel non-similar dual-redundancy CPU working mode architecture is adopted to effectively suppress possible common mode failures of software and hardware to ensure the reliability and safety requirements of the atmospheric data computer, and a fault tree is used to evaluate and analyze its safety.

[0004] The specific implementation contents of the present invention are as follows:

[0005] The present invention proposes a non-similar dual-redundancy atmospheric data processing system for civil aircraft, which collects atmospheric data, processes the atmospheric data and transmits it to a host computer; the processing system includes a pressure sensor group, a central processing unit A, and a central processing unit B;

[0006] The pressure sensor group includes a static pressure sensor and a total pressure sensor;

[0007] The central processing unit A and the central processing unit B both include a CPU module, an A / D conversion module, a bridge, an F / D conversion module, a bus interface, a discrete quantity interface, and a memory;

[0008] The CPU module is connected to the A / D conversion module, the F / D conversion module, the bus interface, the discrete quantity interface, and the memory respectively; the bridge module is connected to the A / D conversion module; the pressure sensor group is connected to the F / D conversion module and the bridge module;

[0009] The central processing unit A and the central processing unit B are connected to the host computer through a bus interface to output the processed atmospheric data;

[0010] The central processing unit A and the central processing unit B are connected via a bus interface;

[0011] The bus interface includes an ARINC429 bus interface and an RS-422 bus interface.

[0012] In order to better implement the present invention, further, the central processing unit A and the central processing unit B are connected for data exchange via a cross channel data link (Cross Channel Data Link, CCDL), and the cross channel data link is constructed by an RS-422 bus.

[0013] In order to better implement the present invention, further, the central processing unit A is a main redundancy platform, and the central processing unit B is a secondary redundancy platform.

[0014] In order to better implement the present invention, further, the CPU module of the central processing unit A adopts the DSP processor TMS320F28335PGFA.

[0015] In order to better implement the present invention, further, the CPU module of the central processing unit B adopts the ARM processor STM32H7A3LIH6Q.

[0016] In order to better implement the present invention, further, it also includes a power supply group, which is connected to the central processing unit A, the central processing unit B, and the pressure sensor group.

[0017] The present invention also proposes a non-similar dual-redundancy atmospheric data processing method for a civil aircraft, which is based on the above-mentioned non-similar dual-redundancy atmospheric data processing system for a civil aircraft, and is characterized in that a central processing unit A and a central processing unit B are used in parallel to perform F / D conversion of pressure signals, total temperature resistance collection, and external bus signal collection, and atmospheric data correction and voting are performed on the collected signals, and the corrected and voted atmospheric data are output to a host computer for use.

[0018] In order to better implement the present invention, further, in the process of data processing, the central processing unit A is used as the main redundancy platform, and the central processing unit B is used as the secondary redundancy platform. The data processing flow of the two platforms is as follows:

[0019] First, data exchange between central processing unit A and central processing unit B is performed;

[0020] Then, the working status of the central processing unit A is determined, and the following processing is performed:

[0021] If the working state of the central processing unit A is normal, the working state of the central processing unit B is further determined; if the working state of the central processing unit B fails, the central processing unit A is used to output the atmospheric data, and the data of the central processing unit B is set to an unavailable state; if the working state of the central processing unit B is normal, the difference between the atmospheric data processed by the central processing unit A and the central processing unit B is calculated; a difference threshold is set, and if the difference is within the difference threshold range, the data processed by the central processing unit A and the central processing unit B are averaged and output through the central processing unit A; if the difference is outside the difference threshold range, the central processing unit A is used to output the atmospheric data, and the data of the central processing unit B is set to an unavailable state;

[0022] If the working state of the central processing unit A fails, the working state of the central processing unit B is further determined; if the working state of the central processing unit B fails, the feedback system fails; if the working state of the central processing unit B is normal, the central processing unit B is used to output the atmospheric data, and the data of the central processing unit A is set to an unavailable state.

[0023] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0024] The present invention adopts redundancy design to ensure its safety and reliability, as well as the fault tolerance requirements of fault operation. Aiming at the performance requirements and technical indicators of the atmospheric data computer, the redundant parallel non-similar dual-redundancy CPU working mode architecture is adopted to effectively suppress the possible common mode failures of software and hardware to ensure the reliability and safety requirements of the atmospheric data computer, and the fault tree is used to evaluate and analyze its safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a schematic diagram of the architecture of the system of the present invention;

[0026] Figure 2 This is a schematic diagram of the dual-platform working logic flow of the present invention;

[0027] Figure 3 It is a schematic diagram of calculating the failure probability of each component of the system of the present invention and the system of the present invention. DETAILED DESCRIPTION

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. It should be understood that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and therefore should not be regarded as limiting the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technical personnel in this field without making creative work are within the scope of protection of the present invention.

[0029] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "disposed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0030] Embodiment 1:

[0031] This embodiment proposes a non-similar dual-redundancy atmospheric data processing system for civil aircraft, which collects atmospheric data, processes the atmospheric data, and transmits it to a host computer; Figure 1 As shown, the processing system includes a pressure sensor group, a central processing unit A, and a central processing unit B;

[0032] The pressure sensor group includes a static pressure sensor and a total pressure sensor;

[0033] The central processing unit A and the central processing unit B both include a CPU module, an A / D conversion module, a bridge, an F / D conversion module, a bus interface, a discrete quantity interface, and a memory;

[0034] The CPU module is connected to the A / D conversion module, the F / D conversion module, the bus interface, the discrete quantity interface, and the memory respectively; the bridge module is connected to the A / D conversion module; the pressure sensor group is connected to the F / D conversion module and the bridge module;

[0035] The central processing unit A and the central processing unit B are connected to the host computer through a bus interface to output the processed atmospheric data;

[0036] The central processing unit A and the central processing unit B are connected via a bus interface;

[0037] The bus interface includes an ARINC429 bus interface and an RS-422 bus interface.

[0038] In order to better implement the present invention, further, the central processing unit A and the central processing unit B are connected for data exchange via a cross channel data link (Cross Channel Data Link, CCDL), and the cross channel data link is constructed by an RS-422 bus.

[0039] In order to better implement the present invention, further, the central processing unit A is a main redundancy platform, and the central processing unit B is a secondary redundancy platform.

[0040] In order to better implement the present invention, further, the CPU module of the central processing unit A adopts the DSP processor TMS320F28335PGFA.

[0041] In order to better implement the present invention, further, the CPU module of the central processing unit B adopts the ARM processor STM32H7A3LIH6Q.

[0042] In order to better implement the present invention, further, it also includes a power supply group, which is connected to the central processing unit A, the central processing unit B, and the pressure sensor group.

[0043] Working principle: The function of the atmospheric data computer is to sense the total pressure and static pressure of the airflow in which the aircraft is located through the pitot tube, and at the same time collect the total temperature resistance signal output by the total temperature sensor, as well as the flap position, angle of attack, air pressure binding, wheel load and other signals provided by other systems. According to the aircraft configuration, the corresponding static pressure source error correction curve is selected to perform static pressure source error correction on the static pressure, perform total temperature error correction on the total temperature, and vote on the total pressure, static pressure and total temperature. After completing the solution of all atmospheric parameters, it is provided to the aircraft and other systems through the ARINC 429 bus.

[0044] Aiming at the requirements of civil aircraft for reliability and safety indicators, the present invention adopts a dual CPU platform (A platform, B platform) design mode. The dual platforms work in parallel at the same time at every moment, and it is a voting type system. The results after calculation and cross-comparison monitoring are voted and output according to the prescribed voting rules.

[0045] The two platforms use different types of processors to form two non-similar hardware channels. Platform A is TI's DSP processor TMS320F28335PGFA (or domestic devices of the same quality), and platform B is ST's ARM processor STM32H7A3LIH6Q (or domestic devices of the same quality). Platforms A and B use dual-redundancy synchronous operation mode, in which platform A is the main redundancy platform and platform B is the secondary redundancy working platform. After the atmospheric data computer is working, the two platforms synchronously execute programs with the same functions, including atmospheric parameter collection, correction, voting, solution and output. Platforms A and B are each an independent workshop replaceable unit (SRU), including functional circuit modules such as CPU, storage, ARINC429 bus interface, RS-422 bus interface, A / D conversion, discrete input and output, bridge, power conversion, F / D conversion, etc. The atmospheric data computer is a line replaceable unit (LRU), which is composed of a pressure sensor combination, a central processing unit combination (platform A), a central processing unit combination (platform B), a power supply combination, etc. In terms of redundancy management, the A and B platforms exchange data through the Cross Channel Data Link (CCDL), which is implemented by the RS-422 bus. The RS-422 bus realizes data communication between the two platforms, and the transmitted data includes atmospheric parameters, self-test data and fault status.

[0046] Embodiment 2:

[0047] This embodiment also proposes a method for processing non-similar dual-redundant atmospheric data of a civil aircraft, such as Figure 2 As shown, based on the above-mentioned non-similar dual-redundancy atmospheric data processing system for civil aircraft, a central processing unit A and a central processing unit B dual-platform redundant parallel F / D conversion of pressure signals, total temperature resistance acquisition, and external bus signal acquisition are performed, and atmospheric data correction and voting are performed on the collected signals, and the corrected and voted atmospheric data are output to the host computer for use.

[0048] Furthermore, in the process of data processing, the central processing unit A is used as the main redundancy platform, and the central processing unit B is used as the secondary redundancy platform. The data processing flow of the two platforms is as follows:

[0049] First, data exchange between central processing unit A and central processing unit B is performed;

[0050] Then, the working status of the central processing unit A is determined, and the following processing is performed:

[0051] If the working state of the central processing unit A is normal, the working state of the central processing unit B is further determined; if the working state of the central processing unit B fails, the central processing unit A is used to output the atmospheric data, and the data of the central processing unit B is set to an unavailable state; if the working state of the central processing unit B is normal, the difference between the atmospheric data processed by the central processing unit A and the central processing unit B is calculated; a difference threshold is set, and if the difference is within the difference threshold range, the data processed by the central processing unit A and the central processing unit B are averaged and output through the central processing unit A; if the difference is outside the difference threshold range, the central processing unit A is used to output the atmospheric data, and the data of the central processing unit B is set to an unavailable state;

[0052] If the working state of the central processing unit A fails, the working state of the central processing unit B is further determined; if the working state of the central processing unit B fails, the feedback system fails; if the working state of the central processing unit B is normal, the central processing unit B is used to output the atmospheric data, and the data of the central processing unit A is set to an unavailable state.

[0053] Working principle: Both platforms are designed with two working modes: normal working mode and maintenance working mode, which perform power-on self-test, periodic self-test and commanded self-test. The maintenance working mode includes data loading, data downloading and commanded self-test sub-modes. Fault detection, location and isolation are performed through self-test to ensure the correct operation of each functional module.

[0054] The non-similar dual-redundancy backup logic design of A and B platforms is based on the BIT results of each platform. The redundancy data processing logic principle is that the A platform data is the main atmospheric data, and the B platform data is the secondary redundant working platform data. If there is a fault, the status bit is 1, and the normal working status bit is 0, as shown in Table 1.

[0055] Table 1 Redundancy data processing logic

[0056]

[0057] According to the redundancy data processing logic in Table 1, the A and B platform data are voted on, and the atmospheric parameters and status judgment are performed on the voted data. After being marked (mean, A platform, B platform), they are output to other systems on the aircraft to facilitate the use of the airborne system and subsequent infield maintenance.

[0058] Embodiment 3:

[0059] This embodiment provides the calculation of the failure probability of the system of the present invention:

[0060] The atmospheric data computer is designed to be non-similar so that the failures between the various redundancies are also independent, thereby achieving the purpose of avoiding common mode failures and improving computer safety and reliability. According to ARP4761 "Guidelines and Methods for Safety Assessment Process of Airborne Systems and Equipment of Civil Aircraft", there are many methods and models for analyzing the safety of computer systems, such as fault tree model (FTA), Markov model (MA), dependency diagram (DD), etc. The present invention adopts FTA analysis method, takes "failure of airspeed / altitude signal of atmospheric data computer" as the top event, and conducts top-down fault analysis.

[0061] like Figure 3 As shown in the figure, after FTA modeling, it can be identified that the static pressure sensor combination failure X1, the full pressure sensor combination failure X2, the power supply combination failure X3, the F / D function failure X4, the bus output failure X5, the shaping circuit X6, the reset circuit failure X7, the clock circuit failure X8, the storage circuit failure X9, and the CPU minimum system failure X10 are independent fault tree bottom events. When any branch fails, the probability of the atmospheric data computer airspeed / altitude signal failure event is:

[0062]

[0063] The Fault Reporting, Analysis and Corrective Action (FRACAS) database is used to count and record the occurrence of errors, and the failure rate of each event is calculated in combination with the reliability prediction data, as shown in Table 2.

[0064] Table 2 Minimum cut set failure rate

[0065] Minimum Cut Set Xi <![CDATA[Failure rate λ (10 -6 / h)]]> Minimum Cut Set Xi <![CDATA[Failure rate λ (10 -6 / h)]]> X1 3.30 X6 0.347 X2 3.30 X7 21.3 X3 3.00 X8 43.1 X4 0.046 X9 31.9 X5 0.0793 X10 0.653

[0066] According to formula (1), the probability of the occurrence of the "airspeed / altitude signal failure of the atmospheric data computer" event can be calculated to be 9.68e-6 / hr, which meets the usage requirements.

[0067] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A non-similar dual-redundancy atmospheric data processing method for a civil aircraft, implemented based on a non-similar dual-redundancy atmospheric data processing system for a civil aircraft, characterized in that: The central processing unit A and the central processing unit B dual platform are used for parallel redundant F / D conversion of pressure signals, total temperature resistance acquisition, external bus signal acquisition, and atmospheric data correction and voting of the collected signals, and the atmospheric data after correction and voting are output to the host computer for use; In the process of data processing, the central processing unit A is the main redundancy platform, and the central processing unit B is the secondary redundancy platform. The data processing flow of the two platforms is as follows: First, data exchange between central processing unit A and central processing unit B is performed; Then, the working status of the central processing unit A is determined, and the following processing is performed: If the working state of the central processing unit A is normal, the working state of the central processing unit B is further determined; if the working state of the central processing unit B is faulty, the central processing unit A is used to output the atmospheric data, and the data of the central processing unit B is set to an unavailable state; if the working state of the central processing unit B is normal, the difference between the atmospheric data processed by the central processing unit A and the central processing unit B is calculated; A difference threshold is set. If the difference is within the difference threshold, the data processed by central processing unit A and central processing unit B are averaged and output through central processing unit A; if the difference is outside the difference threshold, central processing unit A is used to output atmospheric data, and the data of central processing unit B is set to an unavailable state. If the working state of the central processing unit A fails, the working state of the central processing unit B is further determined; if the working state of the central processing unit B fails, the feedback system fails; if the working state of the central processing unit B is normal, the central processing unit B is used to output the atmospheric data, and the data of the central processing unit A is set to an unavailable state; The non-similar dual-redundancy atmospheric data processing system for civil aircraft collects atmospheric data, processes the atmospheric data, and transmits it to the host computer; it is characterized in that the processing system includes a pressure sensor group, a central processing unit A, and a central processing unit B; The pressure sensor group includes a static pressure sensor and a total pressure sensor; The central processing unit A and the central processing unit B both include a CPU module, an A / D conversion module, a bridge, an F / D conversion module, a bus interface, a discrete quantity interface, and a memory; The CPU module is connected to the A / D conversion module, the F / D conversion module, the bus interface, the discrete quantity interface, and the memory respectively; the bridge module is connected to the A / D conversion module; the pressure sensor group is connected to the F / D conversion module and the bridge module; The central processing unit A and the central processing unit B are connected to the host computer through a bus interface to output the processed atmospheric data; The central processing unit A and the central processing unit B are connected via a bus interface; The bus interface includes an ARINC429 bus interface and an RS-422 bus interface; The central processing unit A and the central processing unit B are also connected to each other through a cross channel data link (Cross Channel Data Link, CCDL), and the cross channel data link is constructed by an RS-422 bus; The central processing unit A is the main redundancy platform, and the central processing unit B is the secondary redundancy platform; The CPU module of the central processing unit A adopts the DSP processor TMS320F28335PGFA; The CPU module of the central processing unit B adopts ARM processor STM32H7A3LIH6Q; The non-similar dual-redundancy air data processing system for civil passenger aircraft further comprises a power supply group, which is connected to the central processing unit A, the central processing unit B, and the pressure sensor group.

Images