Fault-tolerant design method for electromechanical management subsystem based on hybrid redundant heterogeneous network
Through the fault-tolerant design method based on a hybrid balance heterogeneous network, the data bus switching and self-reconstruction of the electromechanical management subsystem are realized, which solves the problem of unswitchable equipment in the prior art and improves task reliability.
Patent Information
- Application Number
- CN202211319612.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-10-26
- Publication Date
- 2024-12-17
- Estimated Expiration
- 2042-10-26
AI Technical Summary
The existing electromechanical management subsystem cannot realize the switchable function between devices when the data bus fails or the node machine fails, resulting in insufficient task reliability.
The fault-tolerant design method based on hybrid residual heterogeneous network is adopted, and the data bus switching and self-reconstruction are realized through the one-main and one-standard working method and the watchdog monitoring system to ensure the reliability of data transmission.
In the event of a data bus failure or a node machine failure, information interaction can be continued through data buses of other structures, improving the task reliability of signal acquisition, data transmission, and control output functions of the electromechanical management subsystem.
Smart Images
Figure CN115903578B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of airborne electromechanical integrated control and management, and in particular relates to a fault-tolerant design method for an electromechanical management subsystem based on a hybrid redundant heterogeneous network. Background Art
[0002] The present invention is applied to a certain type of aircraft electromechanical system - an electromechanical management subsystem. The electromechanical management subsystem implements functions such as signal acquisition, data transmission, and output control in the electromechanical system. It is composed of two electromechanical management computers and two remote interface units. It mainly completes information interaction with various electromechanical electronic systems of the aircraft, and realizes real-time monitoring, fault detection, fault isolation and system reconstruction after faults of the electromechanical system. Due to its core position in the electromechanical system, its mission reliability requirements are very high. In order to improve the mission reliability of the signal acquisition, data transmission, and control output functions of the electromechanical management subsystem, the prior art usually adopts a single redundancy method, which cannot realize the switchable function between devices. Summary of the invention
[0003] In view of this, the present invention provides a fault-tolerant design method for an electromechanical management subsystem based on a hybrid redundant heterogeneous network. When a data bus of a certain structure fails, safe switching of data management can be performed to improve the security of electromechanical management data interaction.
[0004] A fault-tolerant design method for an electromechanical management subsystem based on a hybrid redundant heterogeneous network, wherein the electromechanical management computer UMC1 and the electromechanical management computer UMC2 adopt a one-master-one-standby working mode, and during the power-on initialization process, the electromechanical management computer UMC1 and the electromechanical management computer UMC2 perform the steps of grabbing BC, including:
[0005] S101: The electromechanical management computer UMC1 and the electromechanical management computer UMC2 are respectively configured to include at least two channels, an inner bus and an upper bus;
[0006] S102: During the power-on initialization process, the mechatronic management computer UMC1 and the mechatronic management computer UMC2 respectively initialize their own upper bus and mechatronic internal bus to the remote terminal RT;
[0007] S103: the internal bus barking time of the machine management computer UMC1 is set to a preset duration T1, the internal bus barking time of the management computer UMC2 is set to a preset duration T2, the preset duration T1 is less than the preset duration T2, and the internal bus BC is set in the "barking" interrupt service program;
[0008] S104: When the watchdog monitoring system issues a "dog barking" sound, the electromechanical management computer UMC1 switches itself to the internal bus BC in the interrupt service program to obtain bus control, and the management computer UMC1 starts to send control signals to the internal bus set by the device.
[0009] The technical beneficial effects of the present invention are:
[0010] The data transmission network between the electromechanical management subsystem and the avionics system adopts a triple-redundant heterogeneous design, and the data transmission network within the electromechanical management subsystem adopts a dual-redundant heterogeneous design. When a data bus of a certain structure fails, information interaction can continue through the data bus of other structures; when a node machine fails, the electromechanical management subsystem can switch the bus and self-reconstruct, and the node machine with normal functions continues to perform key tasks. Effectively improve the task reliability of the electromechanical management subsystem's signal acquisition, data transmission, and control output functions. BRIEF DESCRIPTION OF THE DRAWINGS
[0011] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0012] Figure 1 It is a hybrid redundant heterogeneous data transmission network architecture within the electromechanical management subsystem and between the electromechanical management subsystem and the avionics system;
[0013] Figure 2 This is a schematic diagram of the process when bus switching occurs within the electromechanical management subsystem. DETAILED DESCRIPTION
[0014] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.
[0015] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.
[0016] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.
[0017] The electromechanical management subsystem fault-tolerant design method of the hybrid redundant heterogeneous network provided by the present invention is applicable to the electromechanical management system, which includes an electromechanical management computer UMC1 and an electromechanical management computer UMC2. Both the electromechanical management computer UMC1 and the electromechanical management computer are provided with a watchdog monitoring system, and the watchdog monitoring system is provided with a barking duration. The electromechanical management computer UMC1 and the electromechanical management computer UMC2 adopt a one-master-one-standby working mode, specifically, the one that grabs the BC serves as the main electromechanical management computer. In the initial state, both the electromechanical management computers UMC1 and UMC2 have no bus control rights. During the power-on initialization process, the steps for the electromechanical management computer UMC1 and the electromechanical management computer UMC2 to grab the BC (the one that grabs the BC obtains the bus controller, that is, the one that grabs the BC can dispatch other airborne devices) include:
[0018] S101: The mechatronic management computer UMC1 and the mechatronic management computer UMC2 are respectively configured to include at least two channels, namely, an inner bus (mechatronic inner bus) and an upper bus (avionics bus);
[0019] S102: During the power-on initialization process, the mechatronic management computer UMC1 and the mechatronic management computer UMC2 respectively initialize their own upper bus and mechatronic internal bus to the remote terminal RT;
[0020] S103: The barking time of the internal bus of the electromechanical management computer UMC1 is set to a preset time T1, such as 600ms, and the barking time of the internal bus of the electromechanical management computer UMC2 is set to a preset time T2, such as 1600ms. The preset time T1 is less than the preset time T2. Therefore, the electromechanical management computer UMC1 preferentially sets itself to use the internal bus BC in the "barking" interrupt service program. For example, after the preset time T1, the internal bus of the electromechanical management computer UMC1 barks. When the watchdog monitoring system issues a "barking", UMC1 switches itself to the internal bus BC in the interrupt service program (specifically, converts RT into BC for use) to obtain bus control; the electromechanical management computer UMC1 thus starts to send control signal instructions to other set internal buses;
[0021] S104: The logical relationship for the electromechanical management computer UMC1 to preferentially grab the BC is as follows: because there is no BC in the internal bus when the power is just turned on, the internal bus of UMC1 will preferentially generate a barking signal after 600ms, and before the internal bus of UMC2 reaches the time threshold of 1600ms (the preset barking time), UMC1 has fed the watchdog monitoring system, so the internal bus dog of the electromechanical management computer UMC2 will not bark. At this time, the electromechanical management computer UMC2 is used as the avionics bus BRT (backup). The electromechanical management computer UMC2 will turn off the sending function and be used as RT.
[0022] As a specific implementation method provided in this case, the electromechanical management computer UMC1 is configured with a self-test circuit for function detection in the prior art. When the self-test circuit detects that the electromechanical management computer UMC1 is faulty, the electromechanical management computer UMC1 does not switch itself, does not grab BC, and is used as RT, and does not "feed the dog" to the watchdog monitoring system of the electromechanical management computer UMC2;
[0023] When the preset time T2 (1600ms) is reached, the dog monitoring system of the electromechanical management computer UMC2 emits a dog barking sound, and the electromechanical management computer UMC2 sets itself to the internal bus BC (switching the initialized RT to BC) and the avionics bus (upper bus) RT, obtains bus control and exchanges data with the avionics bus.
[0024] Furthermore, the aircraft is provided with a remote interface unit RIU1 and a remote interface unit RIU2 (for example, an onboard landing gear and a hydraulic lifting system, etc.); the upper bus of the electromechanical management computer UMC1 and the management computer UMC2 includes: RT and BRT, and the inner bus includes: BC and RT;
[0025] The party that grabs the BC will use it as the primary device, and the other party will be the backup device.
[0026] When the watchdog monitoring system of the electromechanical management computer UMC1 issues a "dog barking" sound, the interrupt service program switches the RT of the inner bus to BC, and switches the BRT of the upper bus to RT, so as to obtain bus control, and starts to send control signals to the BRT included in the electromechanical management computer UMC2 and its remote interface units RIU1 and RIU2.
[0027] When the electromechanical management computer UMC1 switches itself to the internal bus BC, the electromechanical management computer UMC1 sends a control signal to the remote interface unit RIU1 and the remote interface unit RIU2; when the electromechanical management computer UMC1 fails and the electromechanical management computer UMC2 switches itself to the internal bus BC, the electromechanical management computer UMC2 sends a control signal to the remote interface unit RIU1 and the remote interface unit RIU2
[0028] How bus switching works:
[0029] If a node machine failure or a bus-level failure occurs during the initialization process of the two UMCs, or during normal operation after initialization, bus switching is required to ensure that one UMC can normally dispatch the two RIUs to communicate with itself and communicate normally with the avionics system.
[0030] Under normal circumstances, UMC1 serves as the RT of the avionics bus and the BC of the electromechanical internal bus. If a node machine failure or a bus-level failure occurs during the initialization of the two UMCs, or during normal operation after initialization, bus switching is required to ensure that one UMC can normally dispatch the two RIUs to communicate with itself and communicate normally with the avionics system.
[0031] Under normal circumstances, UMC1 is the RT of the avionics bus and the BC of the electromechanical internal bus. When the six situations shown in Table 1 occur, UMC1 will set the bus switch flag to valid and set itself to the RT of the avionics bus and the RT of the electromechanical internal bus. Table 1 shows the bus switch initiation conditions:
[0032]
[0033] The above table is annotated as follows:
[0034] UMC1'MBIA: "UMC1 avionics bus GJB289A communication circuit self-test result" and "whether UMC1 can normally obtain the time stamp message sent by the avionics system" take the value of logical OR, "1" means fault, "0" means normal;
[0035] UMC2'MBIA: "UMC2 avionics bus GJB289A communication circuit self-test result" and "Can UMC2 normally obtain the time stamp message sent by the avionics system" take the value of logical OR, "1" means fault, "0" means normal;
[0036] UMC1'MBIB: UMC1 electromechanical internal bus GJB289A communication circuit self-test result, "1" means fault, "0" means normal;
[0037] UMC2'MBIB: UMC2 electromechanical internal bus GJB289A communication circuit self-test result, "1" indicates fault, "0" indicates normal.
[0038] When bus switching occurs, if any cross transmission channel between the two UMCs is normal, UMC2 obtains the valid information of the bus switching flag sent by UMC1 through cross transmission, and sets itself to the RT of the avionics bus and the BC of the electromechanical internal bus; when both cross transmission paths fail, since UMC1 has set its internal bus to RT and the electromechanical internal bus has no BC dog, the bus dog of UMC2 will bark, causing an interruption, and set itself to the RT of the avionics bus and the BC of the electromechanical internal bus. The process of bus switching is shown in the attached figure. Figure 2 shown.
[0039] 4. Data transmission strategy between electromechanical management subsystem and avionics system
[0040] Three heterogeneous data transmission networks are designed between the electromechanical management subsystem and the avionics system, namely the GJB289A bus, RS-422A bus and ARINC429 bus. The bus network architecture is a redundant design, that is, the three buses are configured between UMC1, UMC2 and the avionics system. Figure 1 shown.
[0041] One UMC as the avionics RT has the priority to communicate with the avionics system on the GJB289A bus and the RS-422A bus, and the other UMC remains silent on the GJB289A bus and the RS-422A bus; the two UMCs communicate with the avionics system on ARINC429 at the same time without priority, and the avionics system decides which party's uploaded data to use.
[0042] When bus switching occurs, the faulty UMC shuts down its own GJB289A bus and RS-422A bus communication circuits to the avionics system, and the other one starts up its own GJB289A bus and RS-422A bus communication circuits to the avionics system.
[0043] RIU1 and RIU2 are not directly connected to the avionics system. RIU1 and RIU2 upload the collected status information to a UMC serving as the avionics RT through the GJB289A bus, and this UMC then uploads the information to the avionics system. The maintenance or IBIT instructions of the avionics system are first sent to a UMC serving as the avionics RT, and this UMC then sends the information to RIU1 and RIU2, and RIU1 and RIU2 perform corresponding operations.
[0044] The overall data interaction method:
[0045] 1. Data transmission strategy within the electromechanical management subsystem
[0046] The data transmission within the electromechanical management subsystem is divided into three levels:
[0047] 1) Data cross transmission between two UMCs;
[0048] 2) Data cross transmission between two RIUs;
[0049] 3) Bidirectional data transmission between two RIUs and two UMCs.
[0050] The data transmission network within the electromechanical management subsystem is as follows: Figure 1 shown.
[0051] 2. Data transmission strategy between two UMCs
[0052] 2.1 There are both GJB289A bus and RS-422A bus between UMC1 and UMC2. When the GJB289A bus communication between UMC1 and UMC2 is normal, the information cross-transmitted through the GJB289A bus is used; when the GJB289A bus communication between UMC1 and UMC2 fails, the information cross-transmitted through the RS-422A bus is used.
[0053] 2.2 Data transmission strategy between two RIUs
[0054] There are both GJB289A bus and RS-422A bus between RIU1 and RIU2. When the GJB289A bus communication between RIU1 and RIU2 is normal, the information cross-transmitted through the GJB289A bus is used; when the GJB289A bus communication between RIU1 and RIU2 fails, the information cross-transmitted through the RS-422A bus is used.
[0055] 2.3 Data transmission strategy between two UMCs and two RIUs
[0056] There are GJB289A buses between UMC1 and RIU1, RIU2, and there are GJB289A buses between UMC2 and RIU1, RIU2.
[0057] Under normal circumstances, UMC1 and UMC2 receive information sent by RIU1 and RIU2 respectively through the GJB289A bus, and a UMC serving as the avionics RT sends command information to RIU1 and RIU2 respectively through the GJB289A bus.
[0058] When the GJB289A bus communication between UMC1 / UMC2 and RIU1 fails, and RIU2 can normally receive information from RIU1 through the GJB289A bus, UMC1 / UMC2 uses the information that RIU1 cross-transmits to RIU2 through the GJB289A bus and then sent by RIU2 through the GJB289A bus;
[0059] When the GJB289A bus communication between UMC1 / UMC2 and RIU1 fails, and RIU2 cannot receive information from RIU1 via the GJB289A bus, UMC1 / UMC2 uses information that is cross-transmitted from RIU1 to RIU2 via the RS-422A bus and then sent by RIU2 via the GJB289A bus;
[0060] When the GJB289A bus communication between UMC1 / UMC2 and RIU2 fails, and RIU1 can normally receive information from RIU2 via the GJB289A bus, UMC1 / UMC2 uses information that RIU2 cross-transmits to RIU1 via the GJB289A bus and then sent by RIU1 via the GJB289A bus;
[0061] When the GJB289A bus communication between UMC1 / UMC2 and RIU2 fails, and RIU1 cannot receive information from RIU2 through the GJB289A bus, UMC1 / UMC2 uses the information that RIU2 cross-transmits to RIU1 through the RS-422A bus, and then RIU1 sends it through the GJB289A bus.
[0062] 3. Improvement of fault tolerance
[0063] The communication network between the electromechanical management subsystem and the avionics system is configured in a heterogeneous and redundant form. The high-speed, large-bandwidth GJB289A bus is responsible for the data transmission of the full status monitoring information, and the relatively low-speed RS-422A bus and ARINC429 bus are responsible for the data transmission of key and important status monitoring information; the two UMCs back up each other in the bus communication tasks with the avionics system. Under normal circumstances, UMC1 communicates with the avionics system. When the avionics bus circuit of UMC1 fails or cannot normally receive the time stamp message sent by the avionics system, UMC2 takes over UMC1 through bus switching to continue communicating with the avionics system. The above two methods jointly improve the fault tolerance capability of the bus communication tasks between the electromechanical management subsystem and the avionics system.
[0064] UMC1 is the BC of the electromechanical internal bus, and UMC2 is the backup BC of the electromechanical internal bus. Under normal circumstances, UMC1 schedules the mutual communication between UMC1, UMC2, RIU1, and RIU2. When the electromechanical internal bus circuit of UMC1 fails, or UMC1 cannot receive the bus messages from UMC2, RIU1, and RIU2 at the same time, UMC2 takes over UMC1 and becomes the BC of the electromechanical internal bus through bus switching. This method improves the fault tolerance of the bus communication task in the electromechanical management subsystem.
[0065] The cross transmission network between the two UMCs is configured in a heterogeneous and redundant form. The full status monitoring information of the two UMCs is transmitted to the other UMC through the GJB289A bus, and the important monitoring information of the two UMCs is transmitted to the other UMC through the RS-422A bus. When the GJB289A bus circuit fails, the information transmitted by the RS-422A bus is used. This method improves the fault tolerance of the cross transmission task between the two UMCs.
[0066] The cross transmission network between the two RIUs is configured in a heterogeneous and redundant form. The full status monitoring information of the two RIUs is transmitted to the other RIU via the GJB289A bus, and the important monitoring information of the two RIUs is transmitted to the other RIU via the RS-422A bus. When the GJB289A bus circuit fails, the information transmitted by the RS-422A bus is used. This method improves the fault tolerance of the cross transmission task between the two RIUs.
[0067] The above are only specific embodiments of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.
Claims
1. A fault-tolerant design method for an electromechanical management subsystem based on a hybrid redundant heterogeneous network, which is applicable to an electromechanical management system. The electromechanical management system includes an electromechanical management computer UMC1 and an electromechanical management computer UMC2. Both the electromechanical management computer UMC1 and the electromechanical management computer UMC2 are provided with a watchdog monitoring system, which is characterized in that: The electromechanical management computer UMC1 and the electromechanical management computer UMC2 adopt a one-master-one-standby working mode, and during the power-on initialization process, the electromechanical management computer UMC1 and the electromechanical management computer UMC2 perform the steps of grabbing BC including: S101: The electromechanical management computer UMC1 and the electromechanical management computer UMC2 are respectively configured to include at least two channels, an inner bus and an upper bus; S102: During the power-on initialization process, the mechatronic management computer UMC1 and the mechatronic management computer UMC2 respectively initialize their own upper bus and mechatronic internal bus to the remote terminal RT; S103: the internal bus barking time of the machine management computer UMC1 is set to the preset time length T1, the internal bus barking time of the management computer UMC2 is set to the preset time length T2, the preset time length T1 is less than the preset time length T2, and the internal bus BC is set in the "barking" interrupt service program; S104: When the watchdog monitoring system issues a "dog bark", the electromechanical management computer UMC1 switches itself to the internal bus BC in the interrupt service program to obtain bus control, and the management computer UMC1 starts to send control signals to the internal bus set by the equipment; if a node machine failure or a bus-level failure occurs during the initialization process of the two UMCs, or during the normal operation after the initialization is completed, bus switching is required to ensure that one UMC can normally dispatch the two RIUs to communicate with itself and communicate with the avionics system normally; The steps of self-checking performed by the mechatronic management computer UMC1 during the initialization process include: The electromechanical management computer UMC1 is equipped with a self-check circuit. When the self-check circuit detects that the electromechanical management computer UMC1 has a fault, the electromechanical management computer UMC1 will not enter its own switching, will not grab the BC, will be used as the RT, and will not "feed the dog" for the watchdog monitoring system of the electromechanical management computer UMC2; when the preset time T2 is reached, the dog monitoring system of the electromechanical management computer UMC2 will bark, and the electromechanical management computer UMC2 will set itself to the internal bus BC and the avionics bus RT, obtain the bus control right and exchange data with the avionics bus.
2. According to the fault-tolerant design method of the electromechanical management subsystem based on the hybrid redundant heterogeneous network of claim 1, a remote interface unit RIU1 and a remote interface unit RIU2 are provided on board, characterized in that: When the mechatronic management computer UMC1 switches itself to the internal bus BC, the mechatronic management computer UMC1 sends control signals to the remote interface units RIU1 and RIU2; When the mechatronic management computer UMC1 fails and the mechatronic management computer UMC2 switches itself to the internal bus BC, the mechatronic management computer UMC2 sends control signals to the remote interface units RIU1 and RIU2.
3. According to claim 2, the fault-tolerant design method of electromechanical management subsystem based on hybrid redundancy heterogeneous network is characterized in that: The upper bus of the electromechanical management computer UMC1 and the management computer UMC2 includes: RT and BRT, and the inner bus includes: BC and RT When the watchdog monitoring system issues a "dog barking" signal, the electromechanical management computer UMC1 switches the RT of the inner bus to BC in the interrupt service program, and switches the BRT of the upper bus to RT to obtain bus control, and starts sending control signals to the BRT included in the electromechanical management computer UMC2 and its remote interface units RIU1 and RIU2.
4. According to claim 1, the fault-tolerant design method of electromechanical management subsystem based on hybrid redundant heterogeneous network is characterized in that: The preset time length T1 is 600 ms, and the preset time length T2 is 1600 ms.