A comprehensive alarm level transition method based on risk model

Abstract

The present application belongs to the technical field of aircraft integrated warning, and is a method for transitioning integrated warning levels based on a risk model. By establishing a risk model and calculating the risk model based on a pilot safety risk model and an aircraft risk model, when the aircraft encounters a risk, the risk level is accurately assessed by combining the cockpit temperature, pressure and oxygen content, and classifying and grading the onboard equipment and applying different weights to each of them. For risks with a higher assessment, emergency operations are used to directly replace the pilot's operations, and for smaller risk levels, the pilot is informed to perform relevant operations. No matter what kind of risk the aircraft encounters, the aircraft can make the most correct decision, whether to return, make an emergency landing or continue flying, reducing the risk of deformation of the operation caused by the pilot's need to make risk judgments, which can greatly improve the safety performance of the aircraft and reduce the occurrence of aviation disasters.

Description

Technical Field

[0001] The present application belongs to the technical field of aircraft integrated warning technology, and in particular relates to an integrated warning level transition method based on a risk model. Background Art

[0002] On modern aircraft, the number of electrical, mechanical or hydraulic (or any other type) systems is much greater than in earlier aircraft, and aircraft systems have become more complex and advanced, with increasing demands for fault management and health monitoring. As the number of warning mechanisms, systems and sensors increases, it becomes increasingly difficult to design warning systems, and the requirements for warning technology are becoming increasingly high. There may be conflicts between different warning methods, for example, two conflicting warnings may be displayed or announced at the same time, causing the crew to react slowly and leading to major or catastrophic effects.

[0003] In the early days, each warning on the aircraft usually used a separate light warning to inform the crew of abnormal system status. Because the cockpit space was limited, the entire cockpit was occupied by a large number of system warning lights, which also brought a great workload to the crew. With the development of warning technology, the current warning methods include electronic screen display, light display, voice broadcast and stick vibration. Aircraft warning technology itself is special and important. It involves many aircraft systems and has complex connections. In fact, there are many cross-links in aircraft onboard signals. Warning suppression technology or principles cannot fully cope with the warning combination for different flight stages. This also leads to more or less problems in the integrated warning system of various types of civil aircraft, such as complicated warning items, unclear root warnings and derived warnings, and false warnings. Therefore, successful aircraft manufacturers in the world attach great importance to the application and optimization design of integrated warning technology, and successful models must strive for excellence in the application of warning technology in their warning systems, and they must also do a good job in handling these problems. A complete flight display and warning system will rationally use mature warning technologies to optimize the sorting, suppression and combination of warning signals.

[0004] To this day, the level of aircraft design is still unable to ideally handle any combination of abnormal situations and support the crew to perform optimal operation sequencing. This is because:

[0005] 1. As the sensors and electronic equipment inside the aircraft become more and more complex, the various signals, warning lights and sounds inside the aircraft are increasing. According to rough statistics, even aircraft with relatively simple onboard equipment have dozens of various warning signals in the cockpit. The occurrence of internal faults is random, and the faults of each system and the combination of faults cannot be listed one by one. Prior knowledge is not complete. If a fault outside the pilot's manual occurs, it may not be handled in a timely and reasonable manner, and the best rescue period will be missed.

[0006] 2. Multiple systems reporting faults at the same time indicate too much information and a lack of cross-linking between systems, making it impossible for pilots to quickly and accurately locate the aircraft. However, this may be caused by a single sensor / system failure. For example, a RA failure may cause failures in the landing configuration warning system, autopilot system, ground proximity warning system, etc.

[0007] Considering that aviation accident history has repeatedly proven that there are many common modes, external events and human errors in the world that we have not considered, in the event of multiple key sensor failures such as rotor explosion, aircraft mid-air collision, maintenance error or damage, the safety analysis assumptions are no longer valid, and the warning system often loses the ability to effectively assist the crew in making decisions.

[0008] Therefore, how to more effectively assist the crew in making decisions and issuing warnings is an urgent problem that needs to be solved. Summary of the invention

[0009] The purpose of this application is to provide a comprehensive warning level transition method based on a risk model to solve the problem in the prior art that pilots are unable to make effective decisions on warning information due to the randomness of internal faults and excessive characterization information.

[0010] The technical solution of the present application is: a comprehensive alarm level transition method based on a risk model, comprising: determining the factors to be considered in risk assessment, establishing a risk model, and the risk model is Risk = αR person +βR plane , where Risk represents the comprehensive risk after multiple system failures occur simultaneously, R person is the risk of pilot safety after a failure occurs, R plane is the risk of aircraft safety after a failure occurs, and the constants α and β are R person , R plane influencing factors; according to the risk model, a pilot safety risk model and an aircraft risk model are established respectively, the pilot safety risk model performs risk assessment through cockpit temperature, pressure and oxygen content, and the aircraft risk model performs risk assessment by classifying and grading the airborne equipment and applying different weights to each of them; real-time collection of flight fault information; real-time assessment of risk levels according to the pilot safety risk model and the aircraft risk model, sorting the warning information, and issuing and registering the warning information; different disposal decisions are made according to different warning registrations, and different aircraft warning information is processed according to different disposal decisions.

[0011] Preferably, the pilot safety risk model is:

[0012] R person =c t R T +cp R p +c o R O

[0013] In the formula, R person is the risk level of the pilot, R T is the risk posed by cockpit temperature to the pilot, R p is the risk degree of cockpit pressure to the pilot, c t , c p , c o R T , R p and R O The impact factor, R O The risk posed to pilots by the oxygen content in the cockpit.

[0014] Preferably, when the pilot does not wear an oxygen mask, the risk model of the risk posed by the cockpit oxygen content to the pilot is:

[0015]

[0016] Where, H is the altitude, in meters;

[0017] When the pilot wears an oxygen mask, the risk model of the risk posed by the cockpit oxygen content to the pilot within the total use time T of the pilot's oxygen mask is:

[0018]

[0019] When the pilot runs out of oxygen, the risk to the pilot posed by cockpit oxygen levels is consistent with the risk model without oxygen masks.

[0020] Preferably, the risk model of the atmospheric pressure causing risk to the pilot is:

[0021]

[0022] In the formula, R P Indicates the risk posed by atmospheric pressure to pilots, P atmospheric pressure, unit is kPa; R P Indicates the risk posed by atmospheric pressure to pilots, P atmospheric pressure, in kPa;

[0023] The relationship between atmospheric pressure and altitude is:

[0024] P=P0(1-H / 443000) 5.256

[0025] Where P is the air pressure at an altitude of H, and P0 is the standard atmospheric pressure.

[0026] Preferably, the risk model of the ambient temperature causing risk to the pilot is:

[0027]

[0028] In the formula, R T is the risk degree caused by temperature to the pilot, T is the temperature, the unit is ℃;

[0029] According to the relationship between atmospheric pressure P and altitude, the relationship between temperature, atmospheric pressure and altitude is:

[0030]

[0031] In the formula, H is the altitude, the unit is m; R is the molar gas constant, the value is 8.51, and g is the gravitational acceleration, which is 9.8 m / s 2 ; M is the relative molecular weight of the gas, and the relative molecular weight of air is 28.959.

[0032] Preferably, the analysis method of the aircraft risk model is: conduct equipment failure assessment analysis, and divide the risk of airborne equipment from large to small; classify the airborne equipment according to the importance of the characteristics of the airborne equipment and the impact of product failures on flight safety and mission completion, and grade different types of airborne equipment, and use weights within the same level to represent the threat level to the aircraft, and at the same time determine whether the airborne equipment undergoes a risk transition; establish a risk model based on the category and level of the airborne equipment.

[0033] Preferably, the aircraft risk model is:

[0034] Establish the risk level of aircraft safety according to the level and weight of the equipment:

[0035]

[0036] In the formula, R plane is the risk level of aircraft safety, K i is the impact on aircraft safety when the i-th layer equipment fails, P i is the threat level of each device, and n is the risk level;

[0037] Combining multiple devices in each layer, we get the expression of threat level of multiple devices in each layer:

[0038]

[0039] In the formula, α j represents the weight of the jth device in the i-th layer, N (i，j) represents the weight of the function set of the jth device in the i-th layer, O (i，j)represents the set of the jth device function at the i-th layer, k (i，j) Indicates the ascending coefficient of the set of the jth device function in the i-th layer, a (i，j) represents the redundant number of the jth device in the i-th layer;

[0040] The fault expression of the jth device in the i-th layer is:

[0041]

[0042] Risk level after aircraft equipment failure:

[0043]

[0044] Preferably, when the equipment function is facing complete loss and the aircraft has no spare equipment or related data, a risk transition is performed, and the calculation method of the risk transition is:

[0045] If the risk level of the current layer exceeds the minimum risk level of the device in the next higher layer, an inter-layer transition occurs. The mathematical expression is:

[0046]

[0047] In the formula, K i-1 Indicates the layer influence degree of the i-1th layer, (P i-1 ) min Indicates the minimum threat level in the i-1th layer, K i Indicates the layer influence degree of the i-th layer, P (i，j) is the threat level of the jth device at the i-th layer;

[0048] The inter-layer transition expression of the same type of equipment is:

[0049]

[0050] With K i-1 , K i The expression of the corresponding relationship is:

[0051]

[0052] Preferably, the method for determining the level of influence is:

[0053] Threat level P of equipment without functional redundancy i，j for:

[0054]

[0055] Threat level P of equipment with functional redundancy i，j for:

[0056]

[0057] The present application discloses a comprehensive warning level transition method based on a risk model. The risk model is established and calculated based on the pilot safety risk model and the aircraft risk model. When the aircraft encounters a risk, the risk level is accurately assessed by combining the cockpit temperature, pressure and oxygen content and classifying and grading the onboard equipment and applying different weights to each of them. For risks with a higher assessment, emergency operations are used to directly replace the pilot's operations. For smaller risk levels, the pilot is informed to perform relevant operations. No matter what kind of risk the aircraft encounters, the aircraft can make the most correct decision, whether to return, make an emergency landing or continue flying, thereby reducing the risk of deformation of the operation caused by the pilot's need to make risk judgments, which can greatly improve the safety performance of the aircraft and reduce the occurrence of aviation disasters. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solution provided by the present application, the following is a brief introduction to the accompanying drawings. Obviously, the accompanying drawings described below are only some embodiments of the present application.

[0059] Figure 1 This is a schematic diagram of the overall process of this application;

[0060] Figure 2 Intent of application for onboard equipment failure determination and disposal measures;

[0061] Figure 3 This is a schematic diagram of the classification structure of the airborne equipment for this application;

[0062] Figure 4 This is a schematic diagram of the hierarchical structure of the onboard equipment of this application. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of the implementation of this application clearer, the technical solutions in the embodiments of this application will be described in more detail below in conjunction with the drawings in the embodiments of this application.

[0064] A comprehensive warning registration transition method based on a risk model. Risk refers to the risk that a fault poses to pilot safety, aircraft safety, and mission safety when an aircraft fails. This numerical evaluation can be used to evaluate the impact of multiple faults occurring concurrently, aircraft safety, and the ability of the aircraft to perform flight missions.

[0065] like Figure 1 As shown, the following steps are included:

[0066] Step S100, determine the factors to be considered for risk assessment and establish a risk model. Risk estimation can generally be performed in the following steps:

[0067] 1) Determine the factors that need to be considered in risk assessment;

[0068] 2) Determine the membership function based on the provided target factors, and then determine the corresponding impact weights based on the interrelationships between the factors and the degree of impact on the risk;

[0069] 3) Comprehensively assess the risk level of the target through weighted summation;

[0070] 4) Risk level ranking.

[0071] Table 1 Risk classification table

[0072]

[0073]

[0074] Table 2 Examples of catastrophic failures

[0075] Serial number Fault description 1 Emergency landing 2 Deaths 3 Aircraft damage

[0076] Table 3 Examples of dangerous failures

[0077] Serial number Fault description 1 Causing the aircraft's important systems to stop working and lose all functions of the system 2 Uncontrolled fire - cannot be extinguished by the aircraft's fire extinguishing system 3 Temporary or permanent inability to climb or fly above 1,000 feet along the planned route 4 Rapid cabin depressurization

[0078] Table 4 Examples of failures with significant impact

[0079] Serial number Fault description 1 Controlled fire (i.e. a fire that is extinguished by the aircraft's onboard fire extinguishing system) 2 Minor injuries, extinguished 3 The landing gear cannot be lowered and needs to be lowered manually by the crew 4 Termination of any high speed takeoff 5 The main structural cracks and corrosion of the aircraft 6 Slow decompression of the cabin

[0080] Table 5 Examples of minor faults

[0081] Serial number Fault description 1 Causing the aircraft's important systems to stop working and lose all functions of the system 2 Uncontrolled fire - cannot be extinguished by the aircraft's fire extinguishing system

[0082] Table 6 Examples of failures with no safety impact

[0083] Serial number Fault description 1 False alarms that do not cause any economic or safety consequences or impacts. 2 The ground circuit breaker trips and no other measures are taken. It returns to normal after reset. 3 Transient failure (occasional failure), subsequent flight is normal.

[0084] Aircraft system failures include flight control, power, environmental control, hydraulic and landing gear system failures, and different system failures occur at different flight stages. Usually, when an aircraft has a system failure, it often has a great impact on the safety of the pilot and the aircraft. The threat level of these two factors directly affects the threat level to the aircraft as a whole after the failure, and thus affects the aircraft safety and mission execution capability after multiple failures occur. Therefore, the following risk assessment model is constructed:

[0085] Risk=αR person +βR plane (1)

[0086] In the above formula, Risk represents the comprehensive risk after multiple system failures occur simultaneously, R person is the risk of pilot safety after a failure occurs, R plane is the risk of aircraft safety after a failure occurs, and the constants α and β are R person , R plane The influencing factors are related to the flight phase, fault source, environmental parameters and aircraft parameters, and the sum of the two is 1.

[0087] Step S200, establishing a pilot safety risk model and an aircraft risk model according to the risk model, wherein the pilot safety risk model performs risk assessment by using cockpit temperature, pressure and oxygen content, and the aircraft risk model performs risk assessment by classifying and grading airborne equipment and applying different weights to each of them;

[0088] Preferably, the method for establishing the pilot safety risk model is as follows:

[0089] There are many factors that affect pilot safety. For example, when an aircraft malfunctions (such as the Sichuan Airlines Flight 8633 accident), it causes direct damage to the pilot's body, making it impossible for the pilot to fly the aircraft normally. Another example is that when an aircraft malfunctions, the cockpit environment undergoes a huge change (such as low temperature, low pressure, etc.), causing the pilot to be in a physiologically extreme environment, thereby affecting the pilot's handling and response to the malfunction, and ultimately leading to an increase in the threat level.

[0090] The risk to pilots is mainly caused by the huge changes in the cockpit environment when an aircraft malfunctions, which causes the pilots to be exposed to extreme conditions and make it impossible for them to operate the aircraft well, which in turn causes some faults that originally had a lower risk level to jump to a higher risk level, ultimately causing serious consequences.

[0091] There are many factors that usually affect human physiological health, such as oxygen, pressure, temperature, humidity, and ultraviolet intensity. However, during the flight, as the aircraft altitude increases, the oxygen, temperature, and pressure outside the aircraft drop rapidly, and the cruising altitude of 8,000-12,000 meters is no longer suitable for human survival. Therefore, the pilot safety risk model only considers the three main factors of oxygen, pressure, and temperature when the cockpit loses pressure, and its expression is as follows:

[0092] R person =ctR T +c p R p +c o R O (2)

[0093] In the above formula, R person is the risk level of the pilot, R Tis the risk posed by cockpit temperature to the pilot, R p is the risk degree of cockpit pressure to the pilot, R O is the risk degree of cockpit oxygen content to the pilot, hereinafter referred to as oxygen content risk degree, parameter c t , c p , c o R T , R p and R O The impact factor is usually 1 / 3.

[0094] 1) Oxygen content risk

[0095] As the altitude increases, the atmospheric pressure and temperature decrease, and the air becomes extremely thin, which is no longer suitable for human survival. However, when the cockpit of an aircraft loses pressure at high altitude, the oxygen in the cabin leaks out and the pressure decreases, causing the pilot's body to instantly be in a low-temperature, low-pressure, and oxygen-deficient environment. If the pilot cannot quickly escape from this environment, he will gradually lose consciousness due to lack of oxygen and suffocation, leading to more serious consequences.

[0096] The following table shows the effects of oxygen levels on the human body:

[0097] Table 7 Effects of oxygen content in air on humans

[0098]

[0099] Based on the analysis of the above table, assuming that the crew cannot wear oxygen masks normally when the cockpit loses pressure, that is, without considering the cockpit backup oxygen, the following oxygen content risk model can be established according to the level of the onboard equipment alarm:

[0100]

[0101] In the above formula, R Ois the danger caused by oxygen content to the pilot, and N is the oxygen concentration. The model is divided into three danger levels. When the oxygen concentration is between 19.5% and 23.5%, the pilot's risk is 0, because this concentration range is the normal oxygen concentration range for human survival and has no effect on the human body; when the oxygen concentration is lower than 19.5% and greater than 15%, people will experience mild hypoxia, which will lead to reduced work efficiency. Therefore, the system needs to give a warning-level alarm to prompt the pilot to descend to maintain normal breathing. If the pilot cannot descend in time, it will cause problems with the head and lungs, and the risk of this pilot will gradually increase with the increase of the event; when the oxygen concentration is lower than 15%, the pilot will begin to experience symptoms such as shortness of breath and loss of judgment. At this time, the pilot's danger level has risen to the warning level, and the pilot must take immediate measures, otherwise it will affect the pilot's life and thus affect the safety of the entire aircraft.

[0102] Considering that when the cockpit of an aircraft loses pressure at high altitude, the cabin environment instantly becomes similar to the environment outside the aircraft. However, in this emergency situation, the aircraft cannot effectively measure the real-time oxygen content in the cockpit, which will cause the system to be unable to determine the degree of danger of the pilot's current state, and thus unable to give accurate warning information. Therefore, it is necessary to convert the above model into a relationship with the data that can be directly measured by the onboard sensors.

[0103] The following table shows the relationship between the oxygen content in the atmosphere and the altitude (the table shows the theoretical oxygen content, and the oxygen content will vary slightly due to different seasons, climates, and geographical environments).

[0104] Table 8 Relationship between altitude and oxygen content in the air

[0105]

[0106]

[0107] By fitting a curve to the data in the above table, we can get the following relationship between atmospheric oxygen content and altitude:

[0108] N=-0.0015*H+20.7682 (4)

[0109] In the formula, N is the oxygen concentration in the atmosphere, and H is the altitude, in meters. Based on this, formula (3) can be rewritten as:

[0110]

[0111] Assuming that the pilot can put on the oxygen mask at the moment of cockpit depressurization, the pilot's risk level is 0. However, as time goes by, the remaining use time of the oxygen mask is gradually decreasing, and the pilot's risk level is also increasing. Therefore, the pilot oxygen threat coefficient k is introduced into the above model. This coefficient is a function of time t and can be used to calculate the pilot's risk level in the current state.

[0112] Assuming that the risk level of the pilot without an oxygen mask is R0, the change in risk level at time t after the pilot puts on the oxygen mask is as follows:

[0113] R t =R0k(t) (6)

[0114] Formula (6) is substituted into formula (5), and the pilot's oxygen risk within the total use time T of the pilot's oxygen mask is:

[0115]

[0116] When the pilot's reserve oxygen is exhausted, the pilot's risk level will be consistent with that described by equation (3). Therefore, the following relationship holds:

[0117]

[0118] The pilot's threat factor k should satisfy 0<k<1 for alert warning and 0.5<k<1 for warning warning.

[0119] 2) Atmospheric pressure risk

[0120] The impact of atmospheric pressure on humans is mainly on various physiological indicators of the human body. With the increase of the degree of hypoxia and exposure time, the harm to the body has a clear limit. The first is functional changes, especially changes in the respiratory, blood circulation system, and brain function; when it develops to a certain extent, it will cause pathological damage to the human body, and these functional changes will all affect the safety of the human body.

[0121] Usually, the cruising altitude of civil aircraft is 8,000 to 12,000 meters. When the cockpit of an aircraft loses pressure at high altitude, the pressure in the cockpit will drop sharply and eventually reach a level equivalent to the outside atmospheric pressure. At this time, the pilot will be exposed to the harsh environment of low temperature and low pressure. When the ambient air pressure quickly changes from the normal level to the low pressure level, the nitrogen originally dissolved in the tissues and liquids in the human body will be released quickly and in large quantities, thus forming high-altitude decompression sickness (Decompression Sickness, DCS). The following table shows the effects of different degrees of low pressure on people.

[0122] Table 9 Effects of different degrees of low pressure on people

[0123]

[0124]

[0125] The risk model of atmospheric pressure to pilots is:

[0126]

[0127] In the formula, R P Indicates the risk posed by atmospheric pressure to pilots, P atmospheric pressure, unit is kPa; R P Indicates the risk level of atmospheric pressure to pilots, P atmospheric pressure, in kPa. Similar to the oxygen risk model, this model also divides the risk level of pilots into three levels: no risk, alert, and warning. The dividing lines are 84.56 kPa and 67.64 kPa respectively. The relationship between atmospheric pressure and altitude is as follows:

[0128] P=P0(1-H / 443000) 5.256 (10)

[0129] In the formula, P is the air pressure value when the altitude is H, P0 is the standard atmospheric pressure (101.325 kPa), and H is the altitude in meters. Substituting the above formula into formula (9), we can get the relationship between the risk degree caused by atmospheric pressure to pilots and the altitude.

[0130] 3) Temperature risk

[0131] The human body has the ability to adapt to cold, but to a certain extent. If the adaptability is exceeded, temperature regulation will be impaired, the body temperature will drop, or even hypothermia will occur, which will affect the body's functions.

[0132] According to aviation medicine requirements, the most comfortable cockpit temperature is 20-22°C, and it is normally maintained in the comfort zone of 15-26°C. In addition, the temperature field in the cockpit should be 3) uniform, and the difference in cockpit temperature in all directions should generally not exceed ±3°C. Give corresponding warnings based on the pilot's current environment to help the pilot escape from danger better.

[0133] The risk model of ambient temperature to pilots is:

[0134]

[0135] In the formula, R T is the risk degree caused by temperature to the pilot, T is the temperature, the unit is ℃;

[0136] The model uses the pilot's body temperature as the independent variable. For a plane with a broken windshield, the cockpit temperature is almost the same as the outside temperature. In addition, considering that the plane is very fast at high altitudes, this model assumes that the pilot's instantaneous body temperature is equal to the air temperature. Usually, the conversion relationship between altitude and atmospheric pressure and temperature is:

[0137]

[0138] Where H is the altitude, in meters, R is the molar gas constant, which is 8.51, T is the thermodynamic temperature, in K, g is the acceleration due to gravity, M is the relative molecular weight of the gas, the molecular weight of air is 28.959, P0 is the standard atmospheric pressure, which is 101.325 kPa, and P is the air pressure at the current altitude;

[0139] Calculate the relationship between temperature T and altitude and air pressure:

[0140]

[0141] Where, T is the temperature after unit conversion, and the unit of T is ℃;

[0142] From formula (10), we can see that the air pressure value is a function of the altitude H. Substituting it into formula (13), we can get the relationship between temperature, atmospheric pressure and altitude:

[0143]

[0144] Where H is the altitude, in meters; R is the molar gas constant, which is 8.51; and g is the acceleration due to gravity, which is usually 9.8 m / s. 2 ; M is the relative molecular weight of the gas, and the relative molecular weight of air is 28.959.

[0145] Preferably, the aircraft risk usually refers to the degree of danger to aircraft safety when an onboard device fails during flight, which is directly related to whether the flight mission can be successfully carried out, and even the life safety of the people on board. However, the types, occurrence times, and severity of failures of different onboard devices are different. Therefore, when conducting an aircraft risk analysis when multiple faults occur concurrently, we can start with the degree of threat posed by each device to the aircraft, and by analyzing the cross-linking relationship between the devices, we can determine the comprehensive threat degree to aircraft safety after multiple device failures occur concurrently, so as to evaluate the risk of aircraft safety in the current state and provide a basis for decision-making for pilots.

[0146] The analysis method of the aircraft risk model is:

[0147] 1. Carry out equipment failure assessment and analysis, and classify the risk of airborne equipment from large to small; Figure 2 As shown, faults are divided into P1-P5 levels, P1 is a disaster level; P2 is a dangerous level; P3 is a major level; P4 is a minor level; P5 is a safe level. When facing P1-3 levels, for redundant and replaceable equipment, parameter reconstruction or switching redundancy is performed, and then if the risk level jumps, emergency operations are adopted. If the risk level is reduced, the pilot is informed to operate; for non-redundant and irreplaceable equipment, emergency operations are adopted for handling. For P4 level, senior pilots perform operations, and for P5 level, normal flight can be carried out.

[0148] For a single device failure, the risk can be expressed as follows: Figure 2 The method shown is used for decision making.

[0149] When the failed equipment has no redundancy, the threat level can be determined according to the type of the airborne equipment. For situations with risk levels of P1, P2, and P3, the problem can be solved by executing the quick checklist of the equipment, etc. If the problem is solved, the current risk level of the aircraft is reduced. Otherwise, the risk level increases by one level, and the crew is prompted with emergency countermeasures. If the aircraft is in the take-off stage, the crew can be prompted to return. If the aircraft is in the cruising stage, the crew can be prompted to contact the airport for emergency landing. If the current state of the aircraft is not enough to reach the nearest airport for emergency landing, the crew is prompted to contact the nearest highway or make an emergency landing on the sea. If the aircraft is in the landing stage, the crew can be prompted to contact the airport's firefighting, medical and other facilities according to the situation on board to wait for the aircraft to land; for situations with a lower risk level of P4, the pilot can be prompted to perform relevant disposal operations; for situations with a risk level of P5, it can be ignored and the pilot continues to perform the flight mission.

[0150] 2. Classify the airborne equipment according to the importance of its characteristics and the impact of product failures on flight safety and mission completion, and grade the different types of airborne equipment. Use weights within the same grade to indicate the threat level to the aircraft, and determine whether the airborne equipment should undergo a risk transition.

[0151] like Figure 3 , Figure 4 As shown in the figure, according to the importance of the characteristics of airborne equipment and the impact of product failures on flight safety and mission completion, airborne equipment can be divided into three categories: A, B, and C. That is, critical airborne equipment, if a failure occurs, will directly affect flight safety; important airborne equipment, if a failure occurs, will not directly affect flight safety, but will directly affect mission completion; general airborne equipment, if a failure occurs, will not directly affect flight safety and mission completion, but will only increase the maintenance workload.

[0152] When conducting equipment failure risk assessment, it is necessary to divide the airborne equipment into levels according to the degree of impact on the aircraft. The threat level to the aircraft is expressed by weights within the same level. For example, aircraft altitude data can be provided by radio altimeters, GPS, atmospheric machines, and inertial navigation combined with accelerometers, which means that the function of providing altitude has four redundancies, so the weight of each type of altitude is 1 / 4. If one of the altitudes fails, the altitude can be provided by the remaining equipment. The overall threat level has not increased, but the impact weights of the remaining equipment have increased, such as becoming 1 / 3. When all the equipment that provides altitude fails, the aircraft will have no altitude data available, which will greatly increase the risk level of the aircraft. Therefore, the threat level needs to be increased by one level to prompt the pilot to make reasonable response operations.

[0153] When classifying the importance of equipment, the focus should be on the failure mode of the airborne equipment that may produce the most serious consequences of failure, and logical decisions should be made based on this starting point. When analyzing "whether it affects flight safety", you can first ignore whether the airborne equipment belongs to the redundant system, and simply assume that the airborne equipment is non-redundant. This approach can avoid easily making a conclusion of downgrading the airborne equipment that belongs to the redundant system. The so-called hidden failure means that the failure of the airborne equipment is not easy to detect for the flight crew performing normal duties. When one of the following situations exists, it is considered to have a hidden function: the airborne equipment is in working condition under normal use, but when it fails and stops working, there is no indication to the flight crew (no signs are displayed); the airborne equipment does not work under normal circumstances, but when it needs to be used, the flight crew cannot understand whether it is in good condition.

[0154] 3. Establish a risk model based on the type and level of airborne equipment.

[0155] The method for establishing the risk model is:

[0156] Based on the analysis in the previous section, a risk model can be established from the perspective of stratification and decentralization. The stratum can determine whether the impact of the current fault has reached the standard for leapfrogging, and the weight can be used to determine the threat level of the equipment in the same stratum to the aircraft. The product of the two together constitutes the risk level caused by equipment failure to the aircraft. The risk level of aircraft safety is established according to the stratum and weight of the equipment:

[0157]

[0158] In the formula, R plane is the risk level of aircraft safety, K i is the impact on aircraft safety when the i-th layer equipment fails, P i is the threat level of each device, n is the risk level. According to the classification method in the previous section, the value of n is 3.

[0159] For the threat level P, it is mainly determined by the impact weight a of the device in the layer and whether the device fails F:

[0160] P=αF (16)

[0161] The weight N of a class of equipment with the same function is set, which is related to the transition coefficient k of the degree of influence of equipment between adjacent levels and the number of redundancies a of the equipment. When a failure occurs, the weight α of the impact of the equipment on the aircraft is:

[0162]

[0163] Substituting formula (17) into formula (16) yields:

[0164]

[0165] Since there is often more than one device in each level, it may include devices with multiple functions, and some devices may be redundant, so the above formula can be rewritten as:

[0166]

[0167] In the formula, α j represents the weight of the jth device in the i-th layer, N (i，j) represents the weight of the function set of the jth device in the i-th layer, O (i，j) represents the set of the jth device function at the i-th layer, k (i，j) Indicates the ascending coefficient of the set of the jth device function in the i-th layer, a (i，j) represents the number of redundancies of the jth device in the i-th layer. Here, when the function of the device is non-redundant, k (i，j) The value is 1.

[0168] For the jth device in the i-th layer, whether it fails can be determined by F (i，j) Indicates that if the device fails, F (i，j) The value is 1 otherwise, 0.

[0169]

[0170] Substituting equations (19) and (20) into equation (18), we can get the threat level P of the i-th layer device: i :

[0171]

[0172] In the formula, m is the number of devices in the i-th layer;

[0173] Substituting formula (21) into formula (15), we can get the risk H after the aircraft equipment fails:

[0174]

[0175] Preferably, the calculation method of risk transition is:

[0176] Risk transition means that when the equipment function is facing complete loss and the aircraft has no spare equipment or relevant data available, the threat to the safety and mission of the aircraft will increase seriously. For the warning system, when the risk level transitions, the warning system needs to issue an alarm according to the risk level. Figure 1 Two types of transitions are described, namely, the transition of the impact degree of the inter-layer on the aircraft without redundancy (hereinafter referred to as inter-layer transition) and the weight transition within the layer with redundancy (hereinafter referred to as intra-layer transition). Inter-layer transition means that the impact degree of the mission and safety of the aircraft has changed significantly due to the complete failure of the function, resulting in a change in the impact degree of the current layer; intra-layer transition means that when a device with functional redundancy or quantity redundancy fails, the weight of the redundant device or function changes due to the failure of some devices or functions.

[0177] The level transition standard is: if the risk level of the current layer exceeds the minimum risk level of the equipment in the next higher layer, the inter-layer transition occurs. Its mathematical expression is as follows:

[0178]

[0179] In the formula, K i-1 Indicates the layer influence degree of the i-1th layer, (P i-1 ) min Indicates the minimum threat level in the i-1th layer, K i Indicates the layer influence degree of the i-th layer, P (i，j) is the threat level of the jth device in the i-th layer. The right side of the above formula represents the risk level of a class of devices with the same function.

[0180] Here, the influence degree of the same layer (K i-1 , K i ) are the same. Therefore, substituting formula (21) into formula (23) yields:

[0181]

[0182] In order to simplify the model, it is assumed that the level-up coefficient k of a class of devices with the same function is i，j are the same and can be written as k i，j =k Aj , A j Represents the set of functions of this type of device in the current layer j; the weight N of a type of device with the same function (i，j) are the same, that is Likewise, A jrepresents the set of this type of functions of the jth device in the current layer. Therefore, the formula can be transformed into:

[0183]

[0184] From formula (20), we can see that when a device fails, F (i，j) =1, we get:

[0185]

[0186] Since a class of devices with the same function and is certain, and a (i，j) It represents the redundant number of the jth device in the i-th layer. The sum of the number of similar devices is equal to the sum of the redundant numbers of each device. The inter-layer transition rule of similar devices can be obtained as shown in the following formula:

[0187]

[0188] Assume that the functional redundancy of the current device is λ, that is, there are λ types of devices with the same function as the current device. When λ-1 types of devices fail, the level of impact of the current function is judged to have a transition. Therefore, the overall inter-layer transition rules are as follows:

[0189]

[0190] In the above formula, the equality sign holds true if and only if the transition standard is just met, from which the level transition coefficient of a type of equipment with the same function can be obtained: As shown below:

[0191]

[0192] In the above formula, K i-1 , K i The values ​​are the influence degrees of two adjacent layers respectively. This value is a reference value obtained through a large amount of accident data investigation. Once the function type and level of the equipment are determined, , (P i-1 ) min and λ are both constants, so we can conclude that The value of K i-1 , K i Relevant, namely:

[0193]

[0194] Preferably, the method for determining the level of influence is:

[0195] From formula (30), we can see that the level-jumping coefficient of a type of equipment with the same function is With Ki / K i-1 Related, that is, K i-1 With K i The value setting will affect the level jump. Usually, when a certain airborne equipment or function has more redundancy, the risk of one of them failing to the whole aircraft is not very high. The crew can solve the current failure by reconfiguring parameters or switching to normal equipment. At this time, there is no need to escalate the danger, which can avoid causing greater psychological pressure on the pilot; otherwise, If it is very sensitive, it will cause equipment failure to easily transition, which means that all equipment failures are high-risk. This phenomenon is obviously not expected.

[0196] Threat level P of equipment without functional redundancy i，j for:

[0197]

[0198] Threat level P of equipment with functional redundancy i，j for:

[0199]

[0200] From equations (31) and (32), we can see that the threat level of a single device P i，j Inversely proportional, when When the value is very small, it will cause P i，j The value is very large, so the alarm information is prone to jump.

[0201] Step 300, collecting flight fault information in real time;

[0202] Step S400, assessing the risk level in real time according to the pilot safety risk model and the aircraft risk model, sorting the warning information, and issuing and registering the warning information;

[0203] Step S500, making different handling decisions according to different warning registrations, and processing different aircraft warning information according to different handling decisions.

[0204] By establishing a risk model and calculating the risk model based on the pilot safety risk model and the aircraft risk model respectively, when the aircraft encounters risks, the risk level is accurately assessed by combining the cockpit temperature, pressure and oxygen content, and classifying and grading the onboard equipment and applying different weights to each. For risks with a higher assessment, emergency operations are used to directly replace the pilot's operations. For smaller risk levels, the pilot is informed to perform relevant operations. No matter what kind of risk the aircraft encounters, the aircraft can make the most correct decision, whether to return, make an emergency landing or continue flying, reducing the risk of pilots making risk judgments and causing operational deformation, which can greatly improve the safety performance of the aircraft and reduce the occurrence of aviation disasters.

[0205] As a specific implementation method, a comprehensive warning level transition method based on a risk model is provided. For the Southern Airlines DC-9 passenger plane No. N1335U, it can be seen from the course of the accident in 1977 and the investigation results that both engines of the aircraft stopped after experiencing heavy rain and hail. Therefore, the risk of the accident can be calculated with two engine failures as input. According to the aircraft model and the above risk model, it can be analyzed that the hierarchical impact degree of the engine of this aircraft model is K=4, the equipment weight is N=23.78, and the equipment redundancy number is a=2. Since the engine has no functional redundancy for the aircraft, it can be known according to the assumption of the risk model that the engine failure transition coefficient k=1.

[0206]

[0207] The above formula can calculate that the risk degree of engine failure to the aircraft at this time is 95.12, which is already in a very dangerous state. At this time, the integrated warning system will issue an engine failure alarm at the warning level, sort the corresponding alarm information, and prompt the crew to descend and escape the rainstorm area as soon as possible. In this process, the crew is prompted to perform the double engine failure quick checklist in the abnormal and emergency procedures, report the situation to the tower, and prepare for forced landing. This can avoid the final air crash that hit the gas station and exploded.

[0208] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A comprehensive alarm level transition method based on a risk model, characterized in that: include: Determine the factors that need to be considered in risk assessment and establish a risk model, the risk model is Risk = αR person +βR plane , where Risk represents the comprehensive risk after multiple system failures occur simultaneously, R person is the risk of pilot safety after a failure occurs, R plane is the risk of aircraft safety after a failure occurs, and the constants α and β are R person , R plane Impact factor; According to the risk model, a pilot safety risk model and an aircraft risk model are respectively established. The pilot safety risk model performs risk assessment by using cockpit temperature, pressure and oxygen content, and the aircraft risk model performs risk assessment by classifying and grading airborne equipment and applying different weights to each of them; Collect flight fault information in real time; Assess risk levels in real time based on pilot safety risk model and aircraft risk model, sort warning information, and issue warnings and register them; Make different handling decisions according to different warning registrations, and process different warning information of aircraft according to different handling decisions; The analysis method of the aircraft risk model is: Conduct equipment failure assessment and analysis, and classify the risk level of airborne equipment from high to low; Classify airborne equipment according to the importance of its characteristics and the impact of product failures on flight safety and mission completion, and grade different types of airborne equipment. Use weights within the same grade to indicate the threat level to the aircraft, and determine whether the airborne equipment should undergo a risk transition. Establish an aircraft risk model based on the types and levels of onboard equipment; The aircraft risk model is: Establish the risk level of aircraft safety according to the level and weight of the equipment: In the formula, R plane is the risk level of aircraft safety, K i is the impact on aircraft safety when the i-th layer equipment fails, P i is the threat level of each device, and n is the risk level; Combining multiple devices in each layer, we get the expression of threat level of multiple devices in each layer: In the formula, α j represents the weight of the jth device in the i-th layer, N (i,j) represents the weight of the function set of the jth device in the i-th layer, O (i,j) represents the set of the jth device function at the i-th layer, k (i,j) Indicates the ascending coefficient of the set of the jth device function in the i-th layer, a (i,j) represents the redundant number of the jth device in the i-th layer; The fault expression of the jth device in the i-th layer is: Risk level after aircraft equipment failure:

2. The comprehensive alarm level transition method based on the risk model according to claim 1, characterized in that: The pilot safety risk model is: R person =c t R T +c p R p +c o R o In the formula, R person is the risk level of the pilot, R T is the risk posed by cockpit temperature to the pilot, R p is the risk degree of cockpit pressure to the pilot, c t , c p , c o R T , R p and R o The impact factor, R o The risk posed to pilots by the oxygen content in the cockpit.

3. The comprehensive alarm level transition method based on the risk model as claimed in claim 2, characterized in that: When the pilot does not wear an oxygen mask, the risk model of the risk posed by the cockpit oxygen content to the pilot is: Where, H is the altitude, in meters; When the pilot wears an oxygen mask, the risk model of the risk posed by the cockpit oxygen content to the pilot within the total use time T of the pilot's oxygen mask is: When the pilot runs out of oxygen, the risk to the pilot posed by cockpit oxygen levels is consistent with the risk model without oxygen masks.

4. The comprehensive alarm level transition method based on the risk model as claimed in claim 3, characterized in that: The risk model of the risk caused by cockpit pressure to the pilot is: In the formula, R p Indicates the risk level of cockpit pressure to the pilot, P is atmospheric pressure, in kPa; The relationship between atmospheric pressure and altitude is: P=P0(1-H / 443000) 5.256 Where P is the air pressure at an altitude of H, and P0 is the standard atmospheric pressure.

5. The comprehensive alarm level transition method based on risk model as claimed in claim 4, characterized in that: The risk model of the cockpit temperature causing risk to the pilot is: In the formula, R T is the risk degree of cockpit temperature to the pilot, T is the temperature in °C; According to the relationship between atmospheric pressure P and altitude, the relationship between temperature, atmospheric pressure and altitude is: In the formula, H is the altitude, the unit is m; R is the molar gas constant, the value is 8.51, and g is the gravitational acceleration, which is 9.8 m / s 2 ; M is the relative molecular weight of the gas, and the relative molecular weight of air is 28.

959.

6. The comprehensive alarm level transition method based on risk model as claimed in claim 1, characterized in that: When the equipment function is facing complete loss and the aircraft has no spare equipment or related data, a risk transition is performed. The calculation method of the risk transition is: If the risk level of the current layer exceeds the minimum risk level of the device in the next higher layer, an inter-layer transition occurs. The mathematical expression is: In the formula, K i-1 Indicates the level of influence of the i-1th layer, (P i-1 ) min represents the minimum threat level in the i-1th layer, K i Indicates the level of influence of the i-th layer, P i,j is the threat level of the jth device at the i-th layer; The inter-layer transition expression of the same type of equipment is: With K i-1 , K i The expression of the corresponding relationship is:

7. The comprehensive alarm level transition method based on risk model as claimed in claim 6, characterized in that: The method for determining the degree of influence of the said level is as follows: Threat level P of equipment without functional redundancy i,j for: Threat level P of equipment with functional redundancy i,j for:

Images