Methods for Obtaining Safety Indicators of Airborne Systems Based on the AltaRica Model

Abstract

This invention provides a method for analyzing and obtaining safety indicators of airborne systems based on the AltaRica model. The method includes: S1, constructing an AltaRica model based on the functional architecture and dynamic reconfiguration strategy of the airborne system to obtain GTS objects; S2, traversing all migrations of the GTS objects to determine the triggered events in the current state of the airborne system; S3, updating the airborne system state and simulation runtime; and S4, performing statistical analysis on independent lifespan segments to obtain the safety indicators of the airborne system. This invention, based on the AltaRica model, evaluates the safety indicators of airborne systems with dynamic reconfiguration characteristics through stochastic simulation, which is used for airborne system architecture optimization and design improvement. It utilizes the stochastic characteristics of the AltaRica model to combine events for evaluation and analysis, calculates the frequency of event occurrences and statistical values ​​of observation points, and obtains the safety indicators of the airborne system.

Description

Technical Field

[0001] This invention relates to the field of safety analysis technology for airborne safety-critical systems, and in particular to a method for obtaining safety indicators of airborne systems based on the AltaRica model. Background Technology

[0002] Currently, in the aerospace industry, the scale and complexity of various safety-critical systems are constantly increasing. However, system failures during operation often lead to significant loss of life and property. Therefore, the safety requirements for safety-critical systems are becoming increasingly stringent. Consequently, Model-Based Safety Assessment (MBSA) has gradually gained widespread attention in the industry, and the revised appendix of the SAE-ARP 4761 standard has begun to adopt MBSA as a recommended method. In the process of model-based safety assessment, a model is first built based on the system's architecture, dynamic behavior, and internal interactions. Then, the entire model is analyzed, such as through fault tree analysis and simulation analysis, to identify potential safety flaws and risks in the system model. Subsequently, the overall system safety is improved by eliminating the consequences that these potential risks may cause.

[0003] AltaRica 3.0 is a system modeling language supporting MBSA (System Structure Modeling Language), capable of accurately representing the architecture and dynamic behavior of systems and handling the stochasticity and uncertainty of complex systems. However, currently, there is a lack of domestically developed and controllable safety assessment technologies for this language, such as automatic fault tree generation, single-step simulation, and stochastic simulation. AltaRica is an event-driven formal modeling language, comprising three versions. AltaRica 1.0 has developed model verifiers and critical event sequence generators, while AltaRica Data-Flow has developed mature tools such as OCAS and Simfia. AltaRica 3.0 currently only has the OpenAltaRica tool for academic research. AltaRica 3.0's semantics are based on GTS (Guarded Transition Systems), built upon system prototypes to facilitate the reuse of modeling processes and knowledge. This version introduces a fixed-point mechanism to facilitate the design of non-causal components and the handling of instantaneous cyclic systems. AltaRica 3.0 consists of two parts: the System Structure Modeling Language (S2ML) and the Guarded Transition Systems (GTS). System architecture modeling languages ​​are typically used to describe the hierarchical structure and fault behavior of complex systems. The Guardian conversion system is the execution semantic model of the AltaRica 3.0 model.

[0004] The Guardian Transition System (GTS) is an extension of pattern automata, a form of state / transition analysis dedicated to security analysis, encompassing stochastic Petri nets, reliability diagrams, and Markov chains. The time-based GTS is a six-tuple, i.e., GTS = ...<V=SUF,E,T,A,ι,delay> However, the time definition in GTS does not describe how to calculate delays, thus GTS includes random cases. To accurately represent randomness, the concept of 0racleo is introduced. The idea is to delegate all possible "randomness" in the system's operation to 0racleo. 0racleo is an infinite sequence of real numbers from 0 to 1 (inclusive), i.e. The only available operation on a 0racle is to consume its first element. A random GTS is a 7-tuple, i.e., GTS = ...<V=SUF,E,T,A,ι,delay,expectation> Where delay is a function from event and zero to a non-negative real number, representing the delay time for the event to be triggered, and expectation is a function from event to a non-negative real number, representing the probability of triggering the event.

[0005] Stochastic simulation of a model refers to simulating dynamic behavior under different combinations of random events through multiple operations, thereby providing system performance indicators under different conditions. This helps system safety analysts understand and predict system behavior and performance under various circumstances more quickly and accurately, and also assists system designers in optimizing and improving the system. In the safety and reliability assessment of high-reliability systems, it is often necessary to consider factors such as system randomness and uncertainty. However, traditional fault tree analysis cannot describe these factors; therefore, a method is needed to design a stochastic simulation evaluation method for the AltaRica 3.0 model. Summary of the Invention

[0006] To address the aforementioned issues, this invention provides a method for analyzing and obtaining safety indicators of airborne systems based on the AltaRica model. Based on the AltaRica model, this invention can evaluate the safety indicators of airborne systems with dynamic reconfiguration characteristics through stochastic simulation, supporting the optimization and design improvement of airborne system architecture. By utilizing the stochastic characteristics of the AltaRica model, different combinations of events are evaluated and analyzed, calculating the number of events and various statistical values ​​at observation points, thus completing the acquisition of airborne system safety indicators.

[0007] Specifically, this invention provides a method for analyzing and obtaining safety indicators of airborne systems based on the AltaRica model, the specific steps of which are as follows:

[0008] S1. Construct an AltaRica (an event-driven formal modeling language) model based on the functional architecture and dynamic reconfiguration strategy of the airborne system, and flatten it. Parse the flattened AltaRica model to obtain a GTS (Guardian Transformation System) object; the GTS object is a set of six tuples, as shown below:

[0009] G =<O,V,E,T,A,ι> ;

[0010] Where G is the six-tuple GTS object; O is the main observation point of the model; V is the first state in the airborne system model; ι is the second state in the airborne system model; E is the operation that occurs in different states; T is the state change after the operation is executed; A is the impact of the state change on the flow variable;

[0011] S2. Based on the current state of the airborne system, traverse all migrations of the GTS object in step S1, find the migrations that meet the conditions, and store their corresponding triggering events in the event queue; randomly sample the triggered events to determine the triggered events under the current airborne system state; if multiple triggered events exist at the same time, calculate the probability of each event, and the event with the highest probability is the triggered event. The probability calculation formula is as follows:

[0012]

[0013] Where p(ev) k ) is the triggered event ev k The probability of occurrence; ev k The event that is triggered; exp(ev k ) is the triggered event ev k The probability of triggering time; exp(ev i ) represents the triggering time probability of the i-th triggered event; i is the event number.

[0014] S3. Based on the triggered event in step S2, update the airborne system state and simulation runtime. First, perform the first variable update based on the triggered event and the affected migrations, as shown in the following formula:

[0015] π = Update(P, σ);

[0016] Where P represents the action performed during the migration process; σ represents the initial variable; π represents the variable updated after the migration; and Update represents the action P performed based on the initial variable σ.

[0017] Then, based on π obtained from the first variable update and the propagation assertion, the variables are updated a second time, as shown in the following formula:

[0018] yp = Propagate(P A ,π);

[0019] Among them, P A For propagating assertions; yp is the variable to which the assertion operation is performed; Propagate is the variable π updated after the migration to perform the propagation assertion P. A operate;

[0020] Finally, obtain all the updated variables, repeat steps S2-S3 until the set simulation duration is reached, and generate multiple independent lifetime segments in the simulation.

[0021] S4. Perform statistical analysis on the independent lifetime segments generated in step S3 to obtain the safety indicators of the airborne system, which can be used to support the optimization and design improvement of the airborne system architecture.

[0022] Preferably, the AltaRica model is a system modeling language that supports security analysis of models, which can accurately describe the architecture and dynamic behavior of the system and handle complex system information.

[0023] Preferably, the flattening process in step S1, and the parsing of the flattened AltaRica model to obtain the GTS object, specifically involves:

[0024] The AltaRica model is divided into six sets, and the corresponding GTS objects are obtained. When obtaining the GTS objects, since the flattened GTS objects are stored in XML format, the Dom4j tool is used to obtain the GTS objects through hierarchical traversal.

[0025] Preferably, in step S2, all migrations of the GTS object in step S1 are traversed, migrations that meet the conditions are found, and their corresponding triggering events are stored in the event queue. Specifically:

[0026] First, the data in the GTS object is parsed to obtain the initial variables. Then, within a given time and simulation count range, all the transition variables in the GTS object are iterated. By continuously comparing the transition variables with the initial variables, all transition variables that satisfy the initial variables are found, and the events corresponding to these transitions are stored in the defined event queue.

[0027] All transition variables that satisfy the initial variables are equal to the initial variables.

[0028] Preferably, in step S2, randomly sampling the triggered events to determine the triggered events in the current airborne system state specifically involves:

[0029] By analyzing all events in the event queue and their delay times, we can determine the first event to be triggered in this random event and record it. At this point, all events in the queue can be triggered. To determine the event that will be triggered, we first need to calculate the delay time of the event based on the event distribution type, and finally find the event with the shortest delay time, which is the event that will be triggered.

[0030] Preferably, if there are events with the same probability in step S2, the first event is selected as the triggered event.

[0031] Preferably, the calculation of event delay time based on event distribution type can be categorized into fixed value type, fixed time occurrence type, exponential distribution type, and Weibull distribution type, specifically:

[0032] The fixed value type requires generating a random number from 0 to 1. When the random number is less than or equal to the fixed value, the delay time is 0; otherwise, the event delay time is ∞.

[0033] The delay time for the fixed-time occurrence type is d;

[0034] The delay time d1 of the exponential distribution type is as follows:

[0035]

[0036] Where d1 is the delay time of the exponential distribution type; ps is a random number in [0, 1], and λ is the failure rate;

[0037] The delay time d2 of the Weibull distribution type is as follows:

[0038]

[0039] Where d2 is the delay time from the Weibull distribution type; α is the scale parameter; and β is the shape parameter.

[0040] Preferably, in step S4, statistical analysis is performed on the independent lifetime segments generated in step S3, specifically as follows:

[0041] The number of triggers Ts for different events is calculated as follows: a counter is set, and the counter is incremented each time the event is triggered. The average of these increments is then used to calculate the number of triggers for different events after N simulations. If the number of times the nth event is triggered in the i-th simulation is Xn, then the number of triggers Ts for different events after N simulations is calculated as follows:

[0042]

[0043] Where Ts is the number of times the event is triggered; Xn is the number of times the nth event occurs; and N is the number of simulations.

[0044] The probability of the observed time point occurring, Pt, is calculated as follows: In each simulation, if the observed time point at time T is true, it is marked; otherwise, it is ignored. The probability of the observed time point occurring after N simulations can be calculated by averaging the results. If the observed time point at time T is true in the i-th simulation, then K... i =1, if false, then K i =0, therefore, after N simulations, the probability Pt of the observation point occurring at that time is calculated as follows:

[0045]

[0046] Where Pt is the probability of the observation point occurring at time T; K1 is the probability of the observation point occurring at time T in the first simulation; K i Let T be the probability of the observation point occurring at time T in the i-th simulation.

[0047] The probability Pi of an observation point occurring within an interval is calculated as follows: In each simulation, if there is a true instance for the observation point within the observation time, it is marked. The probability of an observation point occurring within an interval after N simulations is then calculated by averaging the results. Within the interval, if there is a true instance for the observation point in the i-th simulation, then L... i =1, if false, then L i =0, therefore, after N simulations, the probability Pi of the interval occurrence of the observation point is calculated as follows:

[0048]

[0049] Where Pi is the probability of the interval occurring at the observation point; L1 is the probability of the interval occurring at the observation point in the first simulation; L i Let be the probability of the interval occurring at the observation point in the i-th simulation;

[0050] The initial time Tp of the statistical observation points is determined as follows: In N simulations, the moment when an observation point is true in each simulation is found. The initial time of the observation point after N simulations is then calculated by averaging the results. Within the interval, if an observation point is true in the i-th simulation, its time is recorded as T. i If it does not exist, its time is counted as 0. Therefore, after the Nth simulation, the initial time Tp of the observation point is calculated as follows:

[0051]

[0052] Where Tp is the initial time of the observation point; T1 is the initial time of the observation point in the first simulation; T iThis represents the initial time of the observation point in the i-th simulation.

[0053] The duration Tm of the observation point is calculated as follows: During N simulations, the duration for which the observation point is true in each simulation is statistically analyzed. The mean of this sum is then used to calculate the duration for which the observation point is true after N simulations. If there is a true observation point in the i-th simulation, the total duration of this true observation point in that simulation, i.e., M, is calculated. i =t, if it does not exist then K i =0; The duration Tm of the observation point is calculated as follows:

[0054]

[0055] Where Tm is the duration of the observation point; M1 is the duration of the observation point in the first simulation; M i Let be the duration of the observation point in the i-th simulation;

[0056] The interval Ti between observation points is calculated as follows: In N simulations, the average time interval between two consecutive observation points that are true values ​​is found in each simulation. The interval after N simulations can then be calculated by averaging the average. If in the i-th simulation, there are cases where observation points are consecutively true values, then the interval between these true values ​​is statistically represented as K. i =t, if it is true if it does not exist or occurs only once, then I i =0; The interval Ti between observation points is calculated as follows:

[0057]

[0058] Where Ti is the interval between observation points; I1 is the interval between observation points in the first simulation; I i Let be the interval time between observation points in the i-th simulation;

[0059] The interval average value Ai of the statistical observation points is calculated as follows: In N simulations, the interval average value of the observation points in each simulation is found. Finally, the interval average value after N simulations can be obtained by calculating the average value. Let the current simulation be the i-th simulation, where the output at hour t1 is x, the output at hour t2 is y, and the output at hour t3 is z. Then the average value of the i-th simulation is... The calculation method for the interval average value Ai of the observation points is as follows:

[0060] Ai=(t1*x+t2*y+t3*z) / (x+y+z);

[0061] Where Ai is the interval average of the observation points; t1 is the first time parameter; t2 is the second time parameter; t3 is the third time parameter; x is the output of the first time parameter; y is the output of the second time parameter; and z is the output of the third time parameter.

[0062] The output of the time parameter satisfies x + y + z = the total duration of the i-th simulation.

[0063] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0064] This invention provides a method for analyzing and obtaining safety indicators of airborne systems based on the AltaRica model. Based on a flattened AltaRica model, this invention can evaluate the safety indicators of airborne systems with dynamic reconfiguration characteristics through stochastic simulation. These safety indicators can ultimately support the optimization and design improvement of airborne system architecture. By utilizing the stochastic characteristics of the AltaRica model to evaluate and analyze different combinations of events, the number of events and various statistical values ​​of observation points are calculated, thus completing the analysis and acquisition of airborne system safety indicators. This method is beneficial for engineers to improve airborne systems. Attached Figure Description

[0065] Figure 1 This is a flowchart of a method for analyzing and obtaining safety indicators of airborne systems based on the AltaRica 3.0 model according to an embodiment of the present invention;

[0066] Figure 2 These are screenshots of the random simulation method process according to an embodiment of the present invention;

[0067] Figure 3 This is a stochastic simulation framework diagram of an airborne system according to an embodiment of the present invention. Detailed Implementation

[0068] Exemplary embodiments, features, and aspects of the present invention will now be described in detail with reference to the accompanying drawings. Although various parameter values ​​and aspects of the embodiments are shown, the simulation process need not be performed with exactly the same parameters and aspects unless specifically indicated.

[0069] The following will provide a more detailed explanation of this invention using a specific case study of airborne system safety index analysis based on the AltaRica model. Figure 1 This is a flowchart of a method for obtaining safety indicators of airborne systems based on the AltaRica 3.0 model according to an embodiment of the present invention. The specific implementation is as follows:

[0070] S1. Construct an AltaRica 3.0 model based on the functional architecture and dynamic reconfiguration strategy of the airborne system, and flatten it. Parse the flattened AltaRica 3.0 model to obtain the GTS object, specifically:

[0071] The AltaRica 3.0 model is divided into six sets, and the corresponding GTS objects are obtained. When obtaining the GTS objects, since the flattened GTS objects are stored in XML format, the Dom4j tool is used to retrieve them through hierarchical traversal. The AltaRica 3.0 model is a system modeling language that supports security analysis of models. It can accurately describe the architecture and dynamic behavior of a system and handle complex system information.

[0072] A GTS object is a collection of six tuples, as shown below:

[0073] G =<O,V,E,T,A,ι> ;

[0074] Where G is the six-tuple GTS object; O is the main observation point of the model; V is the first state in the airborne system model; ι is the second state in the airborne system model; E is the operation that occurs in different states; T is the state change after the operation is executed; and A is the impact of the state change on the flow variable.

[0075] S2. Based on the current state of the airborne system, traverse all migrations of the GTS objects in step S1, find the migrations that meet the conditions, and store their corresponding triggering events in the event queue. Specifically:

[0076] First, the data in the GTS object is parsed to obtain the initial variables. Then, within a given time and simulation count range, all the transition variables in the GTS object are iterated. By continuously comparing the transition variables with the initial variables, all transition variables that satisfy the initial variables are found, and the events corresponding to these transitions are stored in the defined event queue. All transition variables that satisfy the initial variables are considered to be equal to the initial variables.

[0077] Random sampling is performed on triggered events to determine the triggered events in the current airborne system state. Specifically, by analyzing all events in the event queue and their delay times, the first triggered event in this random event can be identified and recorded. At this point, all events in the queue can be triggered. To determine the event to be triggered, the delay time of the event needs to be calculated based on the event distribution type. Finally, the event with the shortest delay time is selected as the event to be triggered. If there are events with the same probability, the first event is selected as the triggered event. Figure 2 This is a screenshot of the random simulation method process according to an embodiment of the present invention.

[0078] The delay time of an event can be calculated based on its distribution type, and can be categorized into fixed-value type, fixed-time occurrence type, exponential distribution type, and Weibull distribution type, specifically:

[0079] Fixed value types require generating a random number from 0 to 1. When the random number is less than or equal to the fixed value, the delay time is 0; otherwise, the event delay time is ∞.

[0080] The delay time for the fixed-time occurrence type is d.

[0081] The delay time d1 for the exponential distribution type is as follows:

[0082]

[0083] Where d1 is the delay time of the exponential distribution type; ps is a random number in [0, 1]; and λ is the failure rate.

[0084] The delay time d2 of the Weibull distribution type is as follows:

[0085]

[0086] Where d2 is the delay time from the Weibull distribution type; α is the scale parameter; and β is the shape parameter.

[0087] If multiple events are triggered at the same time, calculate the probability of each event, and select the event with the highest probability as the triggered event. The probability calculation formula is as follows:

[0088]

[0089] Where p(ev) k ) is the triggered event ev k The probability of occurrence; ev k The event that is triggered; exp(ev k ) is the triggered event ev k The probability of triggering time; exp(ev i ) represents the triggering time probability of the i-th triggered event; i is the triggering event number.

[0090] S3. Based on the triggered event in step S2, update the airborne system status and simulation runtime. Since the event has a delay, it needs to be pushed back from the original time. With the triggering of the event, the values ​​of some variables will change due to the influence of transitions and assertions, therefore the initial values ​​of the variables need to be updated. The `updateVariable()` method in the algorithm mainly assigns the updated variable values ​​to the initial values. Its update method first changes the values ​​of the initial variables according to the influence of the transitions, then changes the values ​​of the transition variables according to the relevant conditions in the assertions, and finally obtains the new set of variable values. The first update of the variables is performed based on the triggered event and the affected transitions, as shown in the following formula:

[0091] π = Update(P, σ);

[0092] Where P represents the action performed during the migration process; σ represents the initial variable; π represents the variable updated after the migration; and Update represents the action P performed based on the initial variable σ.

[0093] Then, based on π obtained from the first variable update and the propagation assertion, the variables are updated a second time, as shown in the following formula:

[0094] yp = Propagate(P A ,π);

[0095] Among them, P A For propagating assertions; yp is the variable to which the assertion operation is performed; Propagate is the variable π updated after the migration to perform the propagation assertion P. A operate.

[0096] Finally, obtain all the updated variables, repeat steps S2-S3 until the set simulation duration is reached, and generate multiple independent lifetime segments in the simulation.

[0097] S4. Perform statistical analysis on the independent lifetime segments generated in step S3, specifically as follows:

[0098] The number of triggers Ts for different events is calculated as follows: a counter is set, and the counter is incremented each time the event is triggered. The average of these increments is then used to calculate the number of triggers for different events after N simulations. If the number of times the nth event is triggered in the i-th simulation is Xn, then the number of triggers Ts for different events after N simulations is calculated as follows:

[0099]

[0100] Where Ts is the number of times the event is triggered; Xn is the number of times the nth event occurs; and N is the number of simulations.

[0101] The probability of the observed time point occurring, Pt, is calculated as follows: In each simulation, if the observed time point at time T is true, it is marked; otherwise, it is ignored. The probability of the observed time point occurring after N simulations can be calculated by averaging the results. If the observed time point at time T is true in the i-th simulation, then K... i =1, if false, then K i =0, therefore, after N simulations, the probability Pt of the observation point occurring at that time is calculated as follows:

[0102]

[0103] Where Pt is the probability of the observation point occurring at time T; K1 is the probability of the observation point occurring at time T in the first simulation; Ki Let be the probability of the observation point occurring at time T in the i-th simulation.

[0104] The probability Pi of an observation point occurring within an interval is calculated as follows: In each simulation, if there is a true instance for the observation point within the observation time, it is marked. The probability of an observation point occurring within an interval after N simulations is then calculated by averaging the results. Within the interval, if there is a true instance for the observation point in the i-th simulation, then L... i =1, if false, then L i =0, therefore, after N simulations, the probability Pi of the interval occurrence of the observation point is calculated as follows:

[0105]

[0106] Where Pi is the probability of the interval occurring at the observation point; L1 is the probability of the interval occurring at the observation point in the first simulation; L i Let be the probability of the interval occurring at the observation point in the i-th simulation.

[0107] The initial time Tp of the statistical observation points is determined as follows: In N simulations, the moment when an observation point is true in each simulation is found. The initial time of the observation point after N simulations is then calculated by averaging the results. Within the interval, if an observation point is true in the i-th simulation, its time is recorded as T. i If it does not exist, its time is counted as 0. Therefore, after the Nth simulation, the initial time Tp of the observation point is calculated as follows:

[0108]

[0109] Where Tp is the initial time of the observation point; T1 is the initial time of the observation point in the first simulation; T i is the initial time of the observation point in the i-th simulation.

[0110] The duration Tm of the observation point is calculated as follows: During N simulations, the duration for which the observation point is true in each simulation is statistically analyzed. The mean of this sum is then used to calculate the duration for which the observation point is true after N simulations. If there is a true observation point in the i-th simulation, the total duration of this true observation point in that simulation, i.e., M, is calculated. i =t, if it does not exist then K i =0; The duration Tm of the observation point is calculated as follows:

[0111]

[0112] Where Tm is the duration of the observation point; M1 is the duration of the observation point in the first simulation; M i Let be the duration of the observation point in the i-th simulation.

[0113] The interval Ti between observation points is calculated as follows: In N simulations, the average time interval between two consecutive observation points that are true values ​​is found in each simulation. The interval after N simulations can then be calculated by averaging the average. If in the i-th simulation, there are cases where observation points are consecutively true values, then the interval between these true values ​​is statistically represented as K. i =t, if it is true if it does not exist or occurs only once, then I i =0; The interval Ti between observation points is calculated as follows:

[0114]

[0115] Where Ti is the interval between observation points; I1 is the interval between observation points in the first simulation; I i denoted as the interval time between observation points in the i-th simulation.

[0116] The interval average value Ai of the statistical observation points is calculated as follows: In N simulations, the interval average value of the observation points in each simulation is found. Finally, the interval average value after N simulations can be obtained by calculating the average value. Let the current simulation be the i-th simulation, where the output at hour t1 is x, the output at hour t2 is y, and the output at hour t3 is z. Then the average value of the i-th simulation is... The calculation method for the interval average value Ai of the observation points is as follows:

[0117] Ai=(t1*x+t2*y+t3*z) / (x+y+z);

[0118] Where Ai is the interval average of the observation points; t1 is the first time parameter; t2 is the second time parameter; t3 is the third time parameter; x is the output of the first time parameter; y is the output of the second time parameter; and z is the output of the third time parameter.

[0119] The output of the time parameter satisfies x + y + z = the total duration of the i-th simulation.

[0120] Obtain safety metrics for airborne systems to support the optimization and design improvement of airborne system architecture. Figure 3This is a stochastic simulation framework diagram of an airborne system according to an embodiment of the present invention. In the algorithm, a HashMap is used.<String,lnteger> `eventResult` stores the number of times an event was triggered, where the key represents the event name and the value corresponding to the key represents the number of times the event was triggered. A HashMap is used.<Observer,lnteger> `observerResult` stores the relevant values ​​for all observation points. The `Key` represents the observer, and the `Value` corresponding to the `Key` stores the statistical values ​​to be calculated for each observation point, including the probability of occurrence at a given time, the probability of occurrence within a given interval, the initial occurrence time, the duration, the interval time, the interval average, and the estimated value. The `ComputeObserver()` method calculates the observation point values, returning the observer point and its corresponding statistical data value, `statisticData`. The statistical data value depends on the statistical type and includes the following: the number of times the observation point occurred at a given time, the number of times it occurred within a given interval, the initial occurrence time, the duration, the average interval time, the interval average, and the estimated value. To calculate the observation point values ​​after N simulations, this statistical data and the observer point need to be stored in `observerResult`. Finally, at the end of all loops, the final observation point values ​​can be obtained by taking the average, corresponding to the `finalResult()` method in Algorithm 1.

[0121] The beneficial effects of this invention are as follows: This invention provides a method for analyzing and obtaining safety indicators of airborne systems. By using the flattened AltaRica 3.0 model, the safety indicators of airborne systems with dynamic reconfiguration characteristics can be evaluated through stochastic simulation. These safety indicators can ultimately be used to support the optimization and design improvement of airborne system architecture. By utilizing the stochastic characteristics of the AltaRica 3.0 model to evaluate and analyze different combinations of events, the number of events and various statistical values ​​of observation points are calculated, thus completing the analysis and acquisition of safety indicators of airborne systems. This is beneficial for engineers to improve airborne systems.

[0122] Finally, it should be noted that the above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions or parameters described in the foregoing embodiments, or make equivalent substitutions for some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for obtaining safety indicators of airborne systems based on the AltaRica model, characterized in that: It includes the following steps: S1. Construct an AltaRica model based on the functional architecture and dynamic reconfiguration strategy of the airborne system, and flatten it. Parse the flattened AltaRica model to obtain a GTS object; the GTS object is a set of six tuples, as shown below: ； in, A six-tuple GTS object; These are the main observation points of the model; This represents the first state in the airborne system model. This represents the second state in the airborne system model. These are the operations that occur under different states; This refers to the state change after the operation is executed; The effect of state changes on flow variables; S2. Based on the current state of the airborne system, traverse all migrations of the GTS object in step S1, find the migrations that meet the conditions, and store their corresponding triggering events in the event queue; randomly sample the triggered events to determine the triggered events under the current airborne system state; if multiple triggered events exist at the same time, calculate the probability of each event, and the event with the highest probability is the triggered event. The probability calculation formula is as follows: ； in, For the triggered event The probability of occurrence; The event that was triggered; For the triggered event The probability of triggering time; Let be the probability of triggering the i-th event; where i is the event number. S3. Based on the triggered event in step S2, update the airborne system state and simulation runtime. First, perform the first variable update based on the triggered event and the affected migrations, as shown in the following formula: ； in, Actions performed during the migration process; As initial variables; Variables to be updated after migration; To be based on initial variables Execute action operate; Then based on the first updated variable... The second update of variables is performed based on the propagation assertion, and the formula is shown below: ； in, To spread assertions; The variable used to perform the assertion operation; For variables updated after migration Execution of propagation assertions operate; Finally, obtain all the updated variables, repeat steps S2-S3 until the set simulation duration is reached, and generate multiple independent lifetime segments in the simulation. S4. Perform statistical analysis on the independent lifetime segments generated in step S3 to obtain the safety indicators of the airborne system, which can be used to support the optimization and design improvement of the airborne system architecture. Statistical analysis is performed on the independent lifetime segments generated in step S3, specifically as follows: The system calculates the number of times different events are triggered (Ts), the probability of occurrence at a given time (Pt), the probability of occurrence within a given interval (Pi), the initial occurrence time (Tp), the duration of each observation (Tm), the interval (Ti), and the average value (Ai) of each observation within a given interval.

2. The method for obtaining safety indicators of airborne systems based on the AltaRica model according to claim 1, characterized in that: The AltaRica model is a system modeling language that supports security analysis of models. It can accurately describe the architecture and dynamic behavior of a system and handle complex system information.

3. The method for obtaining safety indicators of airborne systems based on the AltaRica model according to claim 1, characterized in that: Step S1 involves flattening the AltaRica model and parsing the flattened model to obtain the GTS object. Specifically: The AltaRica model is divided into six sets, and the corresponding GTS objects are obtained. When obtaining the GTS objects, since the flattened GTS objects are stored in XML format, the Dom4j tool is used to obtain the GTS objects through hierarchical traversal.

4. The method for obtaining safety indicators of airborne systems based on the AltaRica model according to claim 1, characterized in that: In step S2, all migrations of the GTS object in step S1 are traversed, migrations that meet the conditions are found, and their corresponding triggering events are stored in the event queue. Specifically: First, the data in the GTS object is parsed to obtain the initial variables. Then, within a given time and simulation count range, all the transition variables in the GTS object are iterated. By continuously comparing the transition variables with the initial variables, all transition variables that satisfy the initial variables are found, and the events corresponding to these transitions are stored in the defined event queue. All transition variables that satisfy the initial variables are equal to the initial variables.

5. The method for obtaining safety indicators of airborne systems based on the AltaRica model according to claim 1, characterized in that: The step S2, which involves randomly sampling the triggered events to determine the triggered events in the current state of the airborne system, specifically involves: By analyzing all events in the event queue and their delay times, we can determine the first event to be triggered in this random event and record it. At this point, all events in the queue can be triggered. To determine the event that will be triggered, we first need to calculate the delay time of the event based on the event distribution type, and finally find the event with the shortest delay time, which is the event that will be triggered.

6. The method for obtaining safety indicators of airborne systems based on the AltaRica model according to claim 1, characterized in that: If there are events with the same probability in step S2, the first event is selected as the triggered event.

7. The method for obtaining safety indicators of airborne systems based on the AltaRica model according to claim 5, characterized in that: Event distribution types can be categorized into fixed-value type, fixed-time occurrence type, exponential distribution type, and Weibull distribution type, specifically: The fixed value type requires generating a random number from 0 to 1. When the random number is less than or equal to the fixed value, the delay time is 0; otherwise, the event delay time is... ; The delay time for the fixed-time occurrence type is d; The delay time of the exponential distribution type As shown below: ； in, For the time delay of the exponential distribution type; A random number in [0,1] Failure rate; The delay time of the Weibull distribution type As shown below: ； in, The delay time is for the Weibull distribution type; For scale parameters; For shape parameters.

8. The method for obtaining safety indicators of airborne systems based on the AltaRica model according to claim 1, characterized in that: The number of triggers Ts for different events is calculated as follows: a counter is set, and the counter is incremented each time the event is triggered. The average of these increments is then used to calculate the number of triggers for different events after N simulations. If the number of times the nth event is triggered in the i-th simulation is Xn, then the number of triggers Ts for different events after N simulations is calculated as follows: ； in, Xn represents the number of times the event is triggered; N represents the number of times the nth event occurs; N represents the number of simulations. The probability of the observed time point Pt is calculated as follows: In each simulation, if the observed time point T is true, it is marked; if it is false, it is ignored. The probability of the observed time point occurring after N simulations can be calculated by averaging the results. If the observed time point T is true in the i-th simulation, then... If it is false, then Therefore, after N simulations, the probability Pt of the observation point occurring at that time is calculated as follows: ； in, The probability of the time of occurrence at the observation point; This represents the probability of the observation point occurring at time T in the first simulation. Let T be the probability of the observation point occurring at time T in the i-th simulation. The probability Pi of an observation point occurring within an interval is calculated as follows: In each simulation, if there is a true instance for the observation point within the observation time, it is marked. The probability of the observation point occurring within an interval after N simulations is then calculated by averaging the results. Within the interval, if there is a true instance for the observation point in the i-th simulation, then... If it is false, then Therefore, after N simulations, the probability Pi of the occurrence of the observation point within an interval is calculated as follows: ； Where Pi is the probability of the interval occurrence of the observation point; This represents the probability of the interval occurring at the observation point in the first simulation. Let be the probability of the interval occurring at the observation point in the i-th simulation; The initial time Tp of the statistical observation points is determined as follows: In N simulations, the moment when an observation point is true in each simulation is found. The initial time of the observation point after N simulations is then calculated by averaging the results. Within the interval, if an observation point is true in the i-th simulation, that moment is recorded as... If it does not exist, its time is counted as 0. Therefore, after the Nth simulation, the initial time Tp of the observation point is calculated as follows: ； Where Tp is the initial time of the observation point; This refers to the initial time of the observation points in the first simulation. This represents the initial time of the observation point in the i-th simulation. The duration Tm of the observation point is calculated as follows: During N simulations, the duration for which the observation point is true in each simulation is statistically analyzed. The mean of this sum is then used to calculate the duration for which the observation point is true after N simulations. If there is a true observation point in the i-th simulation, the total duration for which the observation point is true in that simulation is calculated. If it does not exist, then The duration Tm of the observation point is calculated as follows: ； in, The duration of the observation point; This represents the duration of the observation point in the first simulation. Let be the duration of the observation point in the i-th simulation; The interval Ti between observation points is calculated as follows: In N simulations, the average time interval between two consecutive observation points that are true values ​​is found in each simulation. The interval after N simulations is then calculated using the average. If in the i-th simulation, there are cases where observation points are consecutively true values, the interval between these true values ​​is statistically calculated as follows: If it is true if it does not exist or occurs only once, then The interval Ti between observation points is calculated as follows: ； in, The time interval between observation points; This represents the time interval between observation points in the first simulation. Let be the interval time between observation points in the i-th simulation; The interval average value Ai of the statistical observation points is calculated as follows: In N simulations, the interval average value of the observation points in each simulation is found. Finally, the interval average value after N simulations can be obtained by calculating the average value. Let the current simulation be the i-th simulation, where... The hourly output is x. The hourly output is y. If the hourly output is z, then the mean of the i-th simulation is given. The interval average Ai of the observation points is calculated as follows: ; in, The average value of the observation points over the interval; This is the first time parameter; This is the second time parameter; y is the third time parameter; z is the output of the first time parameter; y is the output of the second time parameter; z is the output of the third time parameter. The output of the time parameter satisfies .

Images