A fault monitoring system incomplete coverage behavior modeling method

Abstract

The present application belongs to the technical field of fault incomplete coverage recovery mechanism modeling, and particularly relates to a fault monitoring system incomplete coverage behavior modeling method, comprising the following steps: step one, performing fault mode, mechanism and influence analysis on the fault monitoring system; step two, establishing a BDD model of the fault monitoring system; step three, establishing a BDD model of components in the fault monitoring system; and step four, solving the fault monitoring system recovery mechanism model. The method can analyze the influence of new fault behaviors caused by faults with incomplete coverage on system reliability, and makes up for the inaccurate problem of traditional methods in attributing incomplete coverage.

Description

Technical Field

[0001] This invention belongs to the field of fault incomplete coverage recovery mechanism modeling technology, specifically relating to a fault monitoring system incomplete coverage behavior modeling method. Background Technology

[0002] Complex systems with fault-tolerant mechanisms are used in many fields, such as aerospace, flight control, nuclear power plants, data storage, and communication systems. In such systems, even if hardware or software occasionally fails, the system can still perform its intended functions under the mediation of the fault-tolerant mechanism. The fault-tolerant mechanism plays an important role in the detection, location, isolation, and recovery of faults. However, these fault-tolerant mechanisms can also fail, causing the system to be unable to properly detect, locate, isolate, and recover from internal faults. Even if there are enough redundant components in the system, these uncovered faults will still propagate in the system, eventually causing the entire system to be in a faulty state. This phenomenon is called Imperfect Fault Coverage (IFC).

[0003] Fault detection and recovery mechanisms play a crucial role in the design of redundant systems. This is because even with sufficient redundancy, a failure in these mechanisms can still impact the system due to undetected faults. For example, in computer systems, undetected faults can lead to the failure of other computing modules or errors in operational logic. Similarly, incomplete fault coverage exists in load-sharing systems, power distribution systems, data storage systems, and data conversion systems. Therefore, accurate reliability analysis addressing these characteristics of incomplete fault coverage is essential. This analysis requires not only examining the system structure and design but also considering incomplete fault coverage and the system's fault behavior.

[0004] Based on the severity of the fault, incomplete fault coverage can be categorized into three types: unit-level coverage, fault-level coverage, and performance-dependent coverage. Based on the type of fault-tolerance technology and fault handling mechanism, incomplete fault coverage can be divided into component-level and system-level coverage. Component-level incomplete fault coverage can be further subdivided into single-point faults and multiple faults. System-level incomplete fault coverage describes not only the system's response to a faulty component but also the fault behavior of the entire system. The staged discrete-time model assumes that the recovery process is performed in stages, and the time spent in each stage is negligible (or not considered). Therefore, the fault handling model can be represented by a discrete-time Markov chain. Furthermore, the Binary Decision Diagram (BDD) can be applied to the reliability analysis of systems with more than two states. Combining the BDD model with the concept of multiple states allows for the analysis of the reliability of systems exhibiting incomplete fault coverage behavior.

[0005] Previous research on incomplete fault coverage has primarily focused on solving for the coverage factor in the system. Numerous and well-developed models address fault handling mechanisms and recovery times. Solving the incomplete fault coverage problem is largely equivalent to solving for the system coverage factor. However, studies on incomplete fault coverage have not considered the impact of uncovered faults on other components and the overall system fault behavior, nor have they described the problem from the perspective of fault mechanisms. Therefore, this invention designs a method for modeling the incomplete coverage behavior of fault monitoring systems to address the shortcomings of existing technologies. Summary of the Invention

[0006] This invention proposes a method for modeling the incomplete coverage behavior of a fault monitoring system, which addresses the technical problems of existing incomplete fault coverage not considering the impact of uncovered faults on other components and system fault behavior, and not describing the incomplete fault coverage problem from the perspective of fault mechanism.

[0007] The technical solution of the present invention:

[0008] A method for modeling incomplete coverage behavior in a fault monitoring system includes the following steps:

[0009] Step 1: Conduct fault mode, mechanism, and impact analysis on the fault monitoring system, including: collecting relevant product information, understanding the product composition and functional relationships of each part; establishing a functional logic diagram of the fault monitoring system, clarifying the interrelationships between the various parts of the system; classifying the system hierarchically and determining the hierarchical relationships; determining the fault mechanisms and detection mechanisms of system components; identifying the key components of the system and their fault mechanisms, and drawing a fault tree model.

[0010] Step 2: Establish the fault monitoring system BDD model, including: converting the fault tree model of the fault monitoring system into the corresponding BDD model, and representing the fault recovery operation, monitoring probability and fault incomplete coverage event in the BDD model, and updating the system BDD model in real time according to the BDD model update criteria.

[0011] Step 3: Establish BDD models of components in the fault monitoring system;

[0012] Step 4: Solving the fault monitoring system recovery mechanism model, including: using a stage-type discrete-time model to solve the four physical fault mechanisms of competition, triggering, promotion and inhibition, and damage accumulation using a BDD model.

[0013] Step two involves representing fault recovery operations, monitoring probabilities, and incomplete fault coverage events in the BDD model, and updating the system BDD model in real time according to BDD model update criteria. These criteria include:

[0014] If a component in the model fails, but the monitoring mechanism does not detect the failure, this component causes a change in the development rate of the corresponding failure mechanism in another component. Without changing the original system BDD model, the faulty component is filled with gray to represent the failure that the monitoring mechanism did not detect.

[0015] If a component in the model fails and the monitoring mechanism detects the failure, the monitoring mechanism will cut off the operating voltage of the failed component, making the failed component in a non-working state. Therefore, the failed component is completely isolated from the system. At this time, the unreliability of the system is not affected by the failed component. In order to maintain the integrity of the system's logical structure, the failed component is retained in the BDD system model, and the subsequent "1" side of the failed component is replaced with a dashed line instead of a solid line, indicating that the system will cover the failure of the failed component, so that it is isolated from the system. The monitoring mechanism will monitor and restore the failed component with a fixed probability.

[0016] Step three establishes the component BDD model in the fault monitoring system, including: sorting out the fault mechanism inside each component in the fault monitoring system, and using the competition, promotion and inhibition, triggering and damage accumulation relationship model of the BDD fault mechanism coupling to establish the component BDD model; for components whose faults are not detected by the monitoring mechanism, the nodes representing the component fault mechanism and the "0" and "1" endpoints representing the component working state in the component BDD model are filled with gray.

[0017] For components whose faults can be detected by the monitoring mechanism, the subsequent "1" edges representing the component fault mechanism nodes in the component BDD model are replaced with dashed lines instead of solid lines, indicating that the system will cover the fault of the faulty component and isolate it from the system. The corresponding nodes of the system BDD model in step two are replaced with the component BDD model to obtain the final system BDD model.

[0018] The solution of the system recovery mechanism model in step four includes: assuming that the recovery process of the stage-type discrete time model is carried out in stages, and the time spent in each stage is negligible; the formula of the stage-type discrete time model is shown in the following formula (1), where F represents the current cumulative failure probability of the system, F′ represents the cumulative failure probability of the system before the failure occurs, and the conditional probability P(recovered failure|occurring failure) represents the probability of the system recovering from the instantaneous failure.

[0019] F = F′ × P(Recovered fault | Occurred fault)…………(1).

[0020] The competitive physical failure mechanisms in step four include: some independent failure mechanisms may have different development rates, and the lifespan of a component depends only on the mechanism that fails first.

[0021] The fault mechanism of promoting inhibition relationship in step four includes: when a certain mechanism develops to a certain extent, it accelerates or slows down the development rate of other mechanisms.

[0022] The triggering relationship fault mechanism in step four refers to the fault mechanism that triggers other faults after a certain fault mechanism has developed to a certain extent. Let m0 represent a certain fault mechanism that generates the trigger, and m1, m2, m... n This is represented as the fault mechanism triggered by m0;

[0023] The cumulative damage relationship fault mechanism is that fault mechanisms acting on the same component may have the same damage effect. This damage effect will be superimposed, causing the component to fail earlier.

[0024] The beneficial effects of this invention are:

[0025] This invention proposes a method for modeling the incomplete coverage behavior of a fault monitoring system. Based on an improved binary decision graph (BDD) model, an incomplete coverage model of a hierarchical inductively coupled circuit (IFC) system is established. A staged discrete-time model is used to describe the fault recovery mechanism, dividing fault detection, localization, and recovery into different stages, each with a corresponding success probability. The mechanisms of typical fault recovery mechanisms are presented, and a BDD-based system modeling and solution method is used to analyze the system's fault behavior under different fault recovery mechanisms. In addition, this invention also has the following technical advantages:

[0026] (1) The method of this invention studies the problem of incomplete fault coverage from the underlying mechanism of typical fault recovery mechanisms, and its understanding is more in-depth than that of traditional coverage factors;

[0027] (2) This method uses a stage discrete time model to describe the fault recovery mechanism of the system, providing an underlying model for the modeling and evaluation of fault-tolerant systems;

[0028] (3) This invention proposes a modeling and solving algorithm based on improved BDD, which integrates fault recovery operations, monitoring probabilities and fault incomplete coverage events into the model, providing a new technical path for solving fault-tolerant system models;

[0029] (4) The method of the present invention can analyze the impact of new fault behaviors caused by faults with incomplete coverage on system reliability, and make up for the problem of inaccurate attribution of incomplete coverage by traditional methods.

[0030] (5) The method of the present invention can obtain the incomplete coverage probability of the system under special fault behaviors such as competition, triggering, promotion and inhibition, and damage accumulation, providing a basis for the design of fault tolerance mechanism. Attached Figure Description

[0031] Figure 1 This is a flowchart of the incomplete coverage behavior modeling method of the fault monitoring system designed in this invention;

[0032] Figure 2 This is an example system fault tree model diagram as described in this invention;

[0033] Figure 3 This is the system BDD model before the example system update described in this invention;

[0034] Figure 4 This is the updated system BDD model of the example system described in this invention;

[0035] Figure 5 This is the updated BDD model of component A of the example system described in this invention.

[0036] Figure 6 This is the updated BDD model of component B of the example system described in this invention;

[0037] Figure 7 This is the final system BDD model updated in step three of the example system described in this invention.

[0038] Figure 8 This is a schematic diagram of the stage discrete time model described in this invention;

[0039] Figure 9 This is the 2 / 3 voting system described in this invention;

[0040] Figure 10 This is a functional block diagram of the control module system formed by combining the various components in the embodiments of the present invention;

[0041] Figure 11 This is the fault tree model calculated on a single board in the embodiments described in this invention;

[0042] Figure 12 This is the BDD model of the control module system in the embodiments of the present invention;

[0043] Figure 13 This is the BDD model of the control module component in the embodiment of the present invention.

[0044] Figure 14 This is a cumulative failure probability diagram of the component IC in the embodiment of the present invention;

[0045] Figure 15This is a cumulative fault probability diagram of the control module under different conditions in the embodiments of the present invention. Detailed Implementation

[0046] The following describes in detail a method for modeling incomplete coverage behavior in a fault monitoring system according to the present invention, with reference to the accompanying drawings and embodiments.

[0047] like Figure 1 As shown, a method for incomplete behavior modeling in a fault monitoring system includes the following steps:

[0048] Step 1: Conduct fault mode, mechanism, and impact analysis on the fault monitoring system, including: collecting relevant product information to understand the product's composition and functional relationships between its components; establishing a functional logic diagram of the fault monitoring system to clarify the interrelationships between its components; classifying the system hierarchically to determine the hierarchical relationships; identifying the fault mechanisms and detection mechanisms of system components; identifying key system components and their fault mechanisms, and drawing a fault tree model; such as... Figure 2 The example shown is a static fault tree. Figure 2 In this example, common AND gates and voting gates are included. The monitoring device monitors the entire system, and the probability of detecting a fault in each monitorable component is M. Due to the monitoring mechanism, the fault at point B is covered, and the fault at point A is not detected. Therefore, component A in the AND gate structure cannot be monitored.

[0049] Step 2: Establish a BDD model for the fault monitoring system, including: converting the fault tree model of the fault monitoring system into a corresponding BDD model, such as... Figure 3 As shown; and in establishing the BDD model, fault recovery operations, monitoring probabilities, and fault incomplete coverage events are represented, and the system BDD model is updated in real time according to the BDD model update criteria; the system BDD model update criteria include:

[0050] If a component in the model fails, but the monitoring mechanism does not detect the failure, this component causes a change in the development rate of the corresponding failure mechanism in another component. Without changing the original system BDD model, the faulty component is filled with gray to represent the failure that the monitoring mechanism did not detect.

[0051] If a component in the model fails and the monitoring mechanism detects the failure, the monitoring mechanism will cut off the operating voltage of the failed component, making the failed component in a non-working state. Therefore, the failed component is completely isolated from the system. At this time, the unreliability of the system is not affected by the failed component. In order to maintain the integrity of the system's logical structure, the failed component is retained in the BDD system model, and the subsequent "1" side of the failed component is replaced with a dashed line instead of a solid line, indicating that the system will cover the failure of the failed component, so that it is isolated from the system. The monitoring mechanism will monitor and restore the failed component with a fixed probability.

[0052] by Figure 3 To further illustrate step three, let's take an example: in establishing... Figure 3 The BDD model needs to represent fault recovery operations, monitoring probabilities, and fault incomplete coverage events, and... Figure 3 The system BDD model is updated using the system BDD model update criterion, resulting in the following: Figure 4 The updated system BDD model is shown.

[0053] contrast Figure 2 , 3 and Figure 4 Analysis revealed that component A in the AND gate malfunctioned, but the monitoring mechanism failed to detect the malfunction, causing a change in the development rate of the corresponding malfunction mechanism in component C. This phenomenon was updated to the BDD modeling method as follows: without changing the original system BDD, the malfunctioning component was filled with gray to indicate that this was a malfunction that the monitoring mechanism failed to detect.

[0054] In the voting gate, component B malfunctions. The monitoring mechanism detects this fault and cuts off its operating voltage, rendering it inactive. Therefore, component B is completely isolated from the system, and the system's unreliability is not affected by B. The updated BDD modeling method for this phenomenon is as follows: To maintain the integrity of the system's logical structure, component B is retained in the BDD model, but the subsequent "1" edges of component B are replaced with dashed lines instead of solid lines. The dashed lines represent the system covering the fault of component B, isolating it from the system. Due to the existence of the fault monitoring mechanism, if a fault occurs in the voting system, the monitoring mechanism will monitor and recover it with a fixed probability. Therefore, in the diagram, the probability corresponding to the "1" edge of the subsystem that can detect the fault is described by connecting it. Figure 4 Node c in the middle.

[0055] Step 3: Establish component BDD models in the fault monitoring system, including: sorting out the fault mechanism inside each component in the fault monitoring system, and using the competition, promotion and inhibition, triggering and damage accumulation relationship model of the BDD fault mechanism coupling to establish the component BDD model; for components whose faults are not detected by the monitoring mechanism, fill the nodes representing the component fault mechanism and the "0" and "1" endpoints representing the component working state in the component BDD model with gray.

[0056] For components whose faults can be detected by the monitoring mechanism, the subsequent "1" edges representing the component fault mechanism nodes in the component BDD model are replaced with dashed lines instead of solid lines, indicating that the system will cover the fault of the faulty component and isolate it from the system. The corresponding nodes of the system BDD model in step two are replaced with the component BDD model to obtain the final system BDD model.

[0057] For example Figure 2 In the example system, where components A and B contain two competing fault mechanisms, the updated BDD model for component A is as follows: Figure 5 As shown, the gray fill in component A represents a fault that was not detected by the monitoring mechanism, such as... Figure 6 In the updated BDD model for component B, the dashed line replaces the solid line to indicate that the system will cover the fault of component B, thus isolating it from the system.

[0058] After updating the system BDD model and all component BDD models in step two, replace the corresponding nodes of the system BDD model in step two with the updated component BDD models from step three to obtain the final system BDD model, such as... Figure 7 As shown.

[0059] Step 4: Solving the fault monitoring system recovery mechanism model, including: using a stage-type discrete-time model to solve the four physical fault mechanisms of competition, triggering, promotion and inhibition and damage accumulation; assuming that the recovery process of the stage-type discrete-time model is carried out in stages, and the time spent in each stage is negligible; the formula of the stage-type discrete-time model is shown in the following formula (1), where F represents the current cumulative fault probability of the system, F′ represents the cumulative fault probability of the system before the fault occurred, and the conditional probability P(recovered fault|occurring fault) represents the probability of the system recovering from the instantaneous fault;

[0060] F = F′ × P(Recovered fault | Occurred fault)…………(1).

[0061] In step four, the four physical failure mechanisms of competition, triggering, promotion and inhibition, and damage are some independent failure mechanisms that may have different development rates. The lifespan of a component depends only on the mechanism that fails first.

[0062] The mechanism of promoting-inhibition relationship failure refers to the phenomenon where, when a certain mechanism develops to a certain extent, it accelerates or slows down the development rate of other mechanisms.

[0063] Triggering failure mechanisms are those that, after a certain failure mechanism develops to a certain extent, trigger other failures. Let m0 represent a triggering failure mechanism, and m1, m2, m... n This is represented as the fault mechanism triggered by m0;

[0064] The cumulative damage relationship fault mechanism is that fault mechanisms acting on the same component may have the same damage effect. This damage effect will be superimposed, causing the component to fail earlier.

[0065] The phased discrete-time model effectively addresses the problems of large system state variables, computational difficulties, and the intolerable nature of the state exponential retention time assumption. This model assumes the recovery process is phased, with the time spent in each phase being negligible or disregarded. For example... Figure 8 The diagram shown is a schematic of a stage-discrete time model. Figure 8 In the diagram, P represents the probability of success, S represents successful recovery, and F represents failed recovery. In a staged discrete-time model, fault monitoring, location, and recovery all have a certain probability. Therefore, the system's reliability at this point can be expressed as the conditional probability that the system can perform normal monitoring and recovery.

[0066] Taking a fault mechanism involving competition as an example, its probability distribution is shown in equation (2). In the equation... It represents the integral form of the i-th fault mechanism in the system or component.

[0067]

[0068] like Figure 9The 2 / 3 voting system shown consists of components C1, C2, and C3, all three components being identical. When component C1 fails, the system attempts to recover from the fault, typically by restarting the faulty component. If recovery fails, the power supply to the faulty component is cut off, rendering it inactive. After component C2 fails, the system experiences the same state as component C1, attempting to restart. If this fails, the cumulative number of failed components is 2, exceeding the number of normally functioning devices in the voting system, rendering the system completely faulty. Taking a fault mechanism where only competition exists among the components as an example, when no fault occurs in the system, the cumulative fault probability distribution function of the 2 / 3 voting system can be obtained from formula (3).

[0069]

[0070] When the fault mechanism in a component involves promotion, inhibition, triggering, and damage accumulation, the cumulative probability distribution function of the system can be modified according to the corresponding probability distribution function.

[0071] When a system malfunctions and the malfunction can be monitored, the system enters the malfunction recovery phase. Generally, malfunction recovery involves cutting off the working stress of the working components, rendering them inactive.

[0072] At this point, there are two cases, which will be expressed in the form of a full probability formula. When the monitoring equipment captures the fault with a certain probability and processes the fault with a certain probability, the cumulative fault probability of the system is as shown in formula (4), where the letter C represents the coverage factor of the system.

[0073]

[0074] If we consider the probability of fault location and successful coverage as both to be 1, then the size of the coverage factor is the probability of detecting the fault.

[0075] If there is a certain probability between fault location and coverage, then the coverage factor C here can be expressed as the product of the probabilities of monitoring, location, and coverage.

[0076] When the monitoring equipment detects a fault but cannot recover from it, if the probability of fault location and coverage are both considered as 1, the cumulative fault probability formula of the fault system is as shown in formula (5).

[0077]

[0078] The development rate of the fault mechanism in the faulty component is 0. The faulty component may enter a faulty state or a covered state.

[0079] The technical solution of the present invention will be further illustrated below by way of embodiments:

[0080] Taking a nuclear power plant control module as an example (hereinafter referred to as the control module), this paper demonstrates the proposed fault behavior and analysis method. In practice, to ensure the safe operation of the control module, a monitoring mechanism needs to be added to important sub-circuits to monitor the circuit's operating parameters. When parameter changes are detected, the fault can be handled through internal design, thereby ensuring the normal operation of the controller system.

[0081] Step 1: FMMEA analysis of the control module.

[0082] The control module consists of isolated power supplies (IPs), a transmission array (TSV), TTL circuitry, logic chips (ICs), a central processing unit (CPU1, CPU2), and a buffer (Bu). The functional block diagram of the control module system formed by the combination of these components is shown below. Figure 10 As shown, this control module consists of five sub-circuits, each interconnected and composed of different types of electronic components. This case study's control module includes a PHM (Prognostics and Health Management) monitoring device. At the circuit board level, it monitors output parameters to determine the overall system reliability. Simultaneously, at the internal component level, it also monitors the parameters of devices significantly impacting the circuit board's reliability. Due to this monitoring mechanism, when a critical CPU malfunctions, the recovery mechanism allows for status assessment and switching, ensuring normal system operation.

[0083] According to FMMEA analysis, the system in this case study is divided into two layers. The lowest layer (second layer) is the component level, containing different types of electronic components and functional sub-circuits composed of these components. The highest layer (first layer) is the circuit board layer, which is the control module itself. Through analysis of the components of a certain type of control module, the health status of the monitoring mechanism has a relatively small impact on the system's functionality and is therefore not considered. The established fault tree is as follows: Figure 11 As shown.

[0084] Step 2: Establish the system BDD model.

[0085] The static fault tree model of the control module is transformed into a system BDD model, such as... Figure 12As shown. During this process, through internal functional analysis of the circuit board, it was found that components in the buffer circuit were prone to failure. Therefore, we believe that the integrated circuit chip (IC) within it suffers from incomplete coverage failure, which manifests as functional failure. After a period of time, it releases heat, causing physical impact, and eventually transforms into physical failure. Simultaneously, load and FMMEA analysis revealed that component Bu lacks heat-related failure mechanisms and is unaffected by IC failures. The TSV circuit contains heat-related failure mechanisms, but its function is relatively simple, so its impact is negligible. Finally, after analysis, it is concluded that the incomplete coverage failure of the integrated circuit chip (IC) will affect the CPU. Because of the CPU's complex structure and critical functions, redundancy and backup are provided. Sub-circuit-level monitoring devices are added to the logic judgment sub-circuit. When one CPU fails, recovery is performed according to a staged discrete-time recovery model, involving three steps: CPU fault monitoring, fault location, and recovery. Each step has a certain probability of success; for most systems, the success probability is generally between 0.9 and 1. In this case, the CPU's monitoring, location, and recovery probabilities are calculated to be 0.95. The system can only recover successfully if each step of CPU fault monitoring, location, and recovery is successful; otherwise, if any step fails, the system recovery fails. Because the monitoring device has a certain probability of detecting and recovering from faults, if the monitoring device fails to detect a fault in the k / n system, this undetected fault can still affect another working CPU or the system.

[0086] Step 3: Establish the BDD model of the control module components.

[0087] Based on the results of Failure Mode, Mechanism, and Effects Analysis (FMMEA) of the system, the main mechanisms and failure effects of each component in the system were determined. Combined with the study of failure physics, the types and correlations of each mechanism were determined, as shown in Table 1. In Table 1, TF represents thermal fatigue, VF represents vibration fatigue, EM represents electromigration, TDDB represents time-dependent dielectric breakdown, HCI represents hot carrier injection, SDDV represents stress-induced void diffusion, ESD represents electrostatic discharge, and NTBI represents negative bias temperature instability; IC_m1 represents the first failure mechanism in the integrated circuit chip of the component. MACO represents the competing relationship in the failure mechanism correlation, MACC represents promotion, and MADA represents damage accumulation. Based on the mechanism correlations and parameter distributions in Table 1, a BDD model of the component can be established.

[0088] Table 1. Relationships and distributed parameters of the control module mechanism

[0089]

[0090]

[0091] Taking IC and CPU components as examples, through analysis of the internal functions of the circuit board and reference to FMMEA results, it was found that components in the buffer circuit are high-risk components for failure. Therefore, we believe that the integrated circuit chip IC has an incomplete coverage fault, which manifests as functional failure. After a period of time, it releases heat, causing physical effects, and finally, its failure mode transforms into physical failure. Similarly, if it is determined that either of the two CPUs in the circuit has failed, and if the monitoring equipment is operating normally, after monitoring, location, and recovery, it can cover the component with a certain probability, disconnecting its working stress and isolating it from the system. In this case, the fault in the CPU will not affect the system. Conversely, if the monitoring equipment fails to detect the fault with a certain probability, the fault of that CPU is considered an incomplete fault, and its effects will disappear after a period of time, causing a change in the fault behavior of the working components in the system. The established subsystem update BDD model is as follows: Figure 13 As shown.

[0092] Step 4: Solve the system recovery mechanism model.

[0093] As shown in Table 1, the lifespan of a component IC depends on the cumulative damage from both TF and VF failure mechanisms. The cumulative failure probability of the component IC is as follows: Figure 14 As shown. Figure 14 The solid line marked with a blank circle represents the actual cumulative failure probability curve of the device IC. The black solid line and the black solid line marked with a solid triangle represent the relationship between the cumulative failure probability and lifetime of the IC under the independent failure mechanisms TF and VF. From the analysis results, it can be concluded that device IC1 failed at 5000h.

[0094] Since the sub-circuit monitoring equipment of the control module can only monitor the output parameters of the judgment circuit, while the main function of the integrated circuit chip in the buffer circuit is to perform logical judgment, thereby filtering the influence of erroneous logic signals on the buffer circuit and playing a protective role. The integrated circuit chip is connected in parallel across the buffer. When the integrated circuit chip IC fails, the buffer circuit can still complete the predetermined function. Only when an erroneous logic signal is input will the output parameters of the buffer circuit drift, so that the fault of the buffer circuit can be detected by the monitoring equipment.

[0095] When analyzing the impact of functional failure on other components, the impact of the faulty component can be ignored in two cases: those far from the faulty component and those close to the faulty component but insensitive to environmental loads. Based on the above analysis, it is concluded that the integrated circuit chip in the buffer sub-circuit of the control module has an uncovered fault. As shown in the FMMEA analysis results in Table 1, the CPU in the circuit is likely to be affected by this fault.

[0096] Figure 15 The graph shows the cumulative failure probability curves of a single-board system under different conditions. The solid black line in the graph represents the cumulative failure probability when the system is operating normally; the dashed black line indicates the cumulative failure probability of the system when component CPU1 in the judgment sub-circuit fails after 3000 hours and the monitoring equipment covers it; the curves marked with solid black triangles and white circles represent the actual cumulative failure probability curves of the system when considering the uncovered failure of CPU1 in the system and when considering the uncovered failure of both CPU1 and IC in the system, respectively.

[0097] from Figure 15 As can be seen, when considering the impact of uncovered faults in components CPU1 and integrated circuit IC in the system, the system lifespan is shortened from 10,000 hours to 8,000 hours, and the system fails 2,000 hours earlier. Most importantly, if uncovered faults in the system are not considered in actual engineering applications, engineering analysts may draw rather rash conclusions, which may lead to significant economic losses.

[0098] The embodiments of the present invention have been described in detail above. The present invention is not limited to the above examples. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method for modeling incomplete coverage behavior in a fault monitoring system, characterized in that, Includes the following steps: Step 1: Conduct fault mode, mechanism, and impact analysis on the fault monitoring system, including: collecting relevant product information, understanding the product composition and functional relationships of each part; establishing a functional logic diagram of the fault monitoring system, clarifying the interrelationships between the various parts of the system; classifying the system hierarchically and determining the hierarchical relationships; determining the fault mechanisms and detection mechanisms of system components; identifying the key components of the system and their fault mechanisms, and drawing a fault tree model. Step 2: Establish a fault monitoring system BDD model, including: converting the fault tree model into the corresponding system BDD model, representing fault recovery operations, monitoring probabilities, and fault incomplete coverage events in the system BDD model, and updating the system BDD model in real time according to the system BDD model update criteria. Step 3: Establish component BDD models in the fault monitoring system, including: sorting out the fault mechanism inside each component in the fault monitoring system, and using the competition, promotion and inhibition, triggering and damage accumulation relationship model of the BDD fault mechanism coupling to establish the component BDD model; for components whose faults are not detected by the monitoring mechanism, fill the nodes representing the device fault mechanism and the "0" and "1" endpoints representing the device operating state in the component BDD model with gray. For components whose faults can be detected by the monitoring mechanism, the subsequent "1" edges representing the device fault mechanism nodes in the component BDD model are replaced with dashed lines instead of solid lines, indicating that the system will cover the fault of the faulty component and isolate it from the system; the corresponding nodes of the system BDD model in step two are replaced with the component BDD model to obtain the final system BDD model. Step 4: Solving the fault monitoring system recovery mechanism model, including: using a stage-type discrete-time model to solve the system BDD model for four physical fault mechanisms: competition relationship, triggering relationship, promotion and inhibition relationship, and damage accumulation relationship; Assuming the staged discrete-time model recovery process is carried out in stages, with each stage taking negligible time; the formula for the staged discrete-time model is shown in equation (1) below, where This represents the current cumulative failure probability of the system. This represents the cumulative probability of failure before the system experiences a failure, or conditional probability. P (Recovered Fault | Occurred Fault) represents the probability that the system will recover from a transient fault; …………（1）。 2. The method for incomplete coverage behavior modeling in a fault monitoring system according to claim 1, characterized in that: Step 2 involves representing fault recovery operations, monitoring probabilities, and fault incomplete coverage events in the established system BDD model, and updating the system BDD model in real time according to the system BDD model update criteria. The system BDD model update criteria include: if a component in the model fails, but the monitoring mechanism does not detect the failure, and this component causes a change in the development rate of the corresponding fault mechanism in another component, the faulty component is filled with gray without changing the original system BDD model to represent the failure not detected by the monitoring mechanism. If a component in the model fails and the monitoring mechanism detects the failure, the monitoring mechanism will cut off the operating voltage of the failed component, making the failed component in a non-working state. Therefore, the failed component is completely isolated from the system. At this time, the unreliability of the system is not affected by the failed component. In order to maintain the integrity of the system's logical structure, the failed component is retained in the system's BDD model, and the subsequent "1" edge of the failed component is replaced with a dashed line instead of a solid line, indicating that the system will cover the failure of the failed component, so that it is isolated from the system. The monitoring mechanism will monitor and restore the failed component with a fixed probability.

3. The incomplete coverage behavior modeling method for a fault monitoring system according to claim 1, characterized in that: The competitive physical failure mechanisms in step four include: some independent failure mechanisms may have different development rates, and the lifespan of a component depends only on the mechanism that fails first.

4. The incomplete coverage behavior modeling method for a fault monitoring system according to claim 1, characterized in that: The failure mechanism of promoting inhibition relationship in step four includes: when a certain mechanism develops to a certain extent, it accelerates or slows down the development rate of other mechanisms. The triggering relationship fault mechanism in step four refers to the fault mechanism that triggers other faults after a certain fault mechanism has developed to a certain extent. The cumulative damage relationship fault mechanism is that fault mechanisms acting on the same component may have the same damage effect. This damage effect will be superimposed, causing the component to fail earlier.

Images