Satellite operation risk quantitative evaluation method

Abstract

The invention relates to a satellite operation risk quantitative evaluation method. The method comprises the following steps: S1, dividing satellite operation consequence states, and formulating satellite operation risk evaluation criteria; s2, constructing a satellite operation risk quantitative evaluation model by using a Bayesian network modeling tool; the satellite operation risk quantitative evaluation model is decomposed according to construction logic of a satellite layer, a function layer, a subsystem layer and a single machine layer, and the state of a top layer node is defined as a satellite operation consequence state; s3, collecting satellite operation data, and calculating a fault probability of a single machine corresponding to a bottom layer node in the satellite operation risk quantitative evaluation model according to the satellite operation data; s4, calculating to obtain a probability value of a satellite operation consequence state by adopting a satellite operation risk quantitative evaluation model; s5, according to a satellite operation risk assessment criterion, calculating a satellite operation risk comprehensive score through the probability value of the satellite operation consequence state; and S6, traversing all satellites of the satellite system, and repeating the steps S1 to S5 to obtain operation risk comprehensive scores of all satellites and performing sorting.

Description

Technical Field

[0001] The invention belongs to the technical field of navigation satellite on-orbit operation risk assessment and relates to a navigation satellite operation risk quantitative assessment method. Background Art

[0002] Navigation satellite systems are generally composed of multiple subsystems and their individual machines. Multiple individual machines will inevitably fail during operation. When any individual machine fails, it will affect the satellite service. For example, the impact of some key individual machines is particularly significant. Therefore, satellite operation risk assessment is one of the most important auxiliary means to ensure the service performance of the satellite system.

[0003] At present, the process of existing risk assessment methods is: determine the risk research object, build a risk indicator system, and establish a risk model for risk assessment; for complex systems, the correlation between the various levels of the assessment objects is complex, and the various monitoring parameters are interconnected, which makes the existing risk assessment system modeling process complicated, difficult to characterize the risk propagation relationship between the various levels, poor applicability, and difficult to accurately quantify the assessment system risk. Summary of the invention

[0004] The technical problem solved by the present invention is: to overcome the shortcomings of the prior art, propose a satellite operation risk quantitative assessment method, construct a satellite operation risk quantitative assessment model, and combine the satellite on-orbit operation data to achieve satellite operation risk quantitative assessment.

[0005] The solution of the present invention is: a method for quantitatively assessing satellite operation risks, the method comprising the following steps:

[0006] S1. Classify satellite operation consequence states and formulate satellite operation risk assessment criteria;

[0007] S2. Use Bayesian network modeling tools to build a satellite operation risk quantitative assessment model; the satellite operation risk quantitative assessment model is decomposed layer by layer according to the construction logic of satellite layer-function layer-subsystem layer-single machine layer, and the state of the top-level node is defined as the satellite operation consequence state;

[0008] S3. Collect satellite operation data, and calculate the failure probability of a single machine corresponding to the bottom node in the satellite operation risk quantitative assessment model based on the satellite operation data;

[0009] S4, substituting the failure probability of a single machine into the satellite operation risk quantitative assessment model, and using the satellite operation risk quantitative assessment model to calculate the probability value of the satellite operation consequence state;

[0010] S5. Calculate the satellite operation risk comprehensive score based on the probability value of the satellite operation consequence state according to the satellite operation risk assessment criteria;

[0011] S6. Traverse all satellites in the satellite system and repeat steps S1 to S5 to obtain the comprehensive operational risk scores of all satellites and sort them.

[0012] Preferably, the satellite operation consequence status includes the following five categories:

[0013] “Satellite Normal Operation”, “Major Short-Term Unplanned Outage”, “General Short-Term Unplanned Outage”, “Major Long-Term Unplanned Outage” and “General Long-Term Unplanned Outage”.

[0014] Preferably, the satellite operation risk assessment criteria include:

[0015] The severity level of the consequence status of each satellite, the probability level of risk occurrence, the comprehensive risk evaluation matrix, and the comprehensive risk level;

[0016] The severity levels of the satellite consequence states include mild A, mild B, moderate C, severe D, and catastrophic E, as determined by the following table:

[0017] Satellite consequence status degree grade Normal operation - - General short-term unplanned outages slight A Major short-term unplanned outages Mild B General long-term unplanned outages medium C Major long-term unplanned outage serious D Satellite Exit System disaster E

[0018] The levels of probability of risk occurrence include extremely rare a, rarely b, rarely c, possibly d, and very likely e; determined based on the probability of risk occurrence, as shown in the following table:

[0019] degree grade Risk likelihood level statement Very rare a Almost never occurs, probability of occurrence p<0.01 rare b Rarely occurs, probability of occurrence 0.01≤p<0.05 few c Occurs occasionally, probability of occurrence 0.05≤p<0.1 possible d Occurs frequently, with a probability of 0.1≤p<1 Very likely e Very likely to happen, probability of occurrence p = 1

[0020] The elements of the comprehensive risk assessment matrix are a combination of the severity level of each satellite consequence state and the probability level of risk occurrence, as shown in the following table:

[0021]

[0022] The comprehensive risk levels include higher risk, high risk, medium risk, low risk and very low risk, which are determined according to the following table:

[0023] Overall level Comprehensive risk assessment index level Comprehensive risk score Ⅰ Aa, Ab, Ac, Ba, Ca, Da No risk 90-100 Ⅱ Ad,Ae,Bb,Bc,Cb,Db,Ea Low risk 80-89 Ⅲ Bc, Bd, Be, Cc, Cd, Dc Medium risk 70-79 Ⅳ Ce, Dd, Ec, Eb High risk 60-69 Ⅴ De, Ed, Ee Very high risk 50-59

[0024] Preferably, the steps of ranking the satellite operation risks are as follows:

[0025] S5.1. Obtain the probability value of each operation consequence state of the satellite, and determine the risk occurrence possibility level corresponding to the operation consequence state other than "normal operation" according to the probability value of the operation consequence state;

[0026] S5.2. The combination of the severity level of the operational consequence status other than "normal operation" and its corresponding risk occurrence probability level is used as the comprehensive risk evaluation index, and the comprehensive risk rating table is searched to obtain the comprehensive risk level corresponding to each operational consequence status of the satellite, forming a comprehensive satellite operational risk rating set;

[0027] S5.3. Based on the highest risk level in the satellite operation risk comprehensive rating set, find the lower limit of the corresponding risk comprehensive score range in the risk comprehensive rating table and use it as the basic score of the satellite;

[0028] S5.4. Based on the basic score of the satellite, satellites at the same risk level are classified and sorted from low to high according to the probability value of the satellite being in the "normal operation" state. The boundary of the probability interval is set according to the principle of minimum envelope. For satellites at the same risk level, the linear interpolation formula can be used to obtain additional scores of 0-9 points, which are added to the basic score to obtain the comprehensive satellite operation risk score;

[0029] S5.5. Traverse all satellites in the satellite system, and repeat steps S5.1 to S5.4 for each satellite to obtain the comprehensive operational risk scores of all satellites, and sort them from low to high according to the scores.

[0030] Preferably, the satellite operation risk quantitative assessment model includes satellite layer nodes, function layer nodes, subsystem layer nodes and single machine layer nodes from top to bottom;

[0031] There are node connections between each level with composition and inclusion relationships; the composition node is defined as the parent node, the composed node is defined as the child node, and the parent node points to the child node;

[0032] There is a series relationship between the stand-alone node and the subsystem node, between the subsystem node and the functional node, and between the functional node and the satellite node; there is a parallel relationship between the main and backup machines under the same stand-alone machine, and there is a parallel relationship between different types of stand-alone machines with functional backup in the subsystem layer;

[0033] The attributes of each node include name, state and conditional probability table CPT.

[0034] Preferably, the naming rules of the satellite operation risk assessment model are as follows:

[0035] The satellite layer includes 1 node, which is named according to "satellite number + operational risk";

[0036] The functional layer includes three nodes, named "platform", "payload" and "intersatellite link";

[0037] Subsystem layer: According to the actual configuration of the satellite, select the subsystem under each functional node and name it using the subsystem name;

[0038] The single machine layer selects the single machine under each subsystem node according to the actual configuration of the satellite and names it after the single machine;

[0039] In the case of a redundant backup machine, a specific redundant backup machine is mounted under the machine, and is named with the primary copy + machine name or the backup + machine name.

[0040] Preferably, according to the type of single-machine on-orbit failure, the method for setting the status of each node of the satellite operation risk assessment model is:

[0041] For mechanical, electronic, electrical and comprehensive single machines, the single machine status is divided into two types in the satellite operation risk assessment model according to whether it can be recovered after a fault occurs, namely: Type 1, divided into two states, including state 0: normal operation and state 1: permanent fault; Type 2, divided into three states, including state 0: normal operation, state 1: recoverable fault and state 2: permanent fault;

[0042] For consumable machines, the machines can be divided into three states according to the consumption rate of consumable materials, including state 0: normal operation, state 1: abnormal consumption and state 2: exhaustion;

[0043] At the subsystem layer and function layer, the status of the subsystem layer node and function layer node is set according to the status of the attached stand-alone node, and is consistent with the status setting of the attached node;

[0044] The "Satellite Number + Operation Risk" node in the satellite layer is set to 5 states: "Normal operation of satellite", "Important short-term unplanned interruption", "General short-term unplanned interruption", "Important long-term unplanned interruption" and "General long-term unplanned interruption".

[0045] Preferably, the setting method of the setting conditional probability table of the series relationship is:

[0046] All parent nodes and child nodes operate normally. If and only if one parent node fails, the child node fails.

[0047] Preferably, the conditional probability table of the parallel relationship is set as follows: if any parent node operates normally, the child node operates normally; if and only if all parent nodes fail, the child node fails.

[0048] Preferably, for different parent nodes under the same child node, if there is a redundant backup relationship between different parent nodes, the redundant backup includes cold backup and hot backup;

[0049] The conditional probability table of cold backup is set as follows: if any parent node is operating normally, the child node is operating normally. If and only if all working parent nodes and the parent node for cold backup fail, the child node fails. If and only if the working parent node fails and the parent node for cold backup needs to be switched to work, the child node has a certain failure probability due to different switching switches.

[0050] The conditional probability table of hot backup is set as follows: if any parent node operates normally, the child node operates normally; if and only if all working parent nodes and the parent node serving as hot backup fail, the child node fails.

[0051] The beneficial effects of the present invention compared with the prior art are:

[0052] (1) The present invention adopts the Bayesian network modeling method to construct a satellite operation risk quantitative assessment model based on the information such as satellite structure configuration and on-orbit operation status, conducts satellite operation risk quantitative assessment, realizes the transformation of satellite operation risk from qualitative assessment to quantitative assessment, and improves the satellite operation risk monitoring, assessment and control capabilities.

[0053] (2) In the process of constructing a satellite operation risk quantitative assessment model, the present invention comprehensively considers factors such as single-machine structure / function redundant backup, node polymorphic settings and uncertain relationships, which can make up for the insufficient refinement of the current satellite operation risk quantitative assessment model and solve the problem that due to on-orbit quality issues, there may be interactive effects between the states of nodes at each layer, making it difficult to comprehensively and accurately assess the risk value of the satellite consequence state and the correlation between the impacts of failures between different single machines.

[0054] (3) The present invention realizes the analysis and sorting of the complex structure of the satellite system by adopting methods such as event chain modeling, fault tree modeling and risk modeling. Compared with the qualitative analysis method in the prior art, the satellite refined modeling process is simplified while ensuring that the satellite configuration information remains unchanged;

[0055] (4) The present invention uses event tree, fault tree and other methods to construct a risk event chain model. On the basis of comprehensive consideration of factors such as single-machine structure / functional redundancy, node polymorphism and uncertainty expression, the Bayesian network is used to complete the model conversion, and then a satellite operation risk quantitative assessment model is constructed. The setting of the model node status and conditional probability table is completed, providing model support for the quantitative assessment of satellite operation risks.

[0056] (5) The present invention constructs a satellite operation risk quantitative assessment model by using a Bayesian network. By inputting actual probability data, a more accurate quantitative assessment of the risk of a single machine or satellite system can be performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 The overall process of the satellite operation risk quantitative assessment method according to the embodiment of the present invention is as follows;

[0058] Figure 2 This is an event tree of the atomic clock group according to an embodiment of the present invention;

[0059] Figure 3 This is a fault tree model of an atomic clock group according to an embodiment of the present invention;

[0060] Figure 4 A fault tree model according to an embodiment of the present invention;

[0061] Figure 5 The hot backup gate of the embodiment of the present invention is converted into a Bayesian network;

[0062] Figure 6 The cold backup gate of the embodiment of the present invention is transformed into a Bayesian network;

[0063] Figure 7 Conversion of the functional backup gate to the Bayesian network in the embodiment of the present invention

[0064] Figure 8 The satellite system layer of the satellite operation risk quantitative assessment model according to the embodiment of the present invention;

[0065] Fig. 9 It is the inter-satellite link function layer branch of the satellite operation risk quantification assessment model according to the embodiment of the present invention;

[0066] Fig.10 It is a functional layer branch of the satellite operation risk quantification assessment model platform according to an embodiment of the present invention;

[0067] Fig.11 It is a payload function layer branch of the satellite operation risk quantification assessment model according to an embodiment of the present invention;

[0068] Fig.12 This is a recoverable failure probability calculation process according to an embodiment of the present invention.

[0069] Fig.13 This is the resident fault probability calculation process of an embodiment of the present invention. DETAILED DESCRIPTION

[0070] The present invention will be further described below in conjunction with the embodiments.

[0071] Example:

[0072] The present invention is described in detail below by taking the Beidou navigation satellite on orbit as an example.

[0073] like Figure 1 As shown, the overall process of a satellite operation risk quantitative assessment method provided by the present invention includes the following steps:

[0074] S1. Classify satellite operation consequence states and formulate satellite operation risk assessment criteria;

[0075] S2. Use Bayesian network modeling tools to build a satellite operation risk quantitative assessment model; the satellite operation risk quantitative assessment model is decomposed layer by layer according to the construction logic of satellite layer-function layer-subsystem layer-single machine layer, and the state of the top-level node is defined as the satellite operation consequence state;

[0076] S3. Collect satellite operation data, and calculate the failure probability of a single machine corresponding to the bottom node in the satellite operation risk quantitative assessment model based on the satellite operation data;

[0077] S4, substituting the failure probability of a single machine into the satellite operation risk quantitative assessment model, and using the satellite operation risk quantitative assessment model to calculate the probability value of the satellite operation consequence state;

[0078] S5. Calculate the satellite operation risk comprehensive score based on the probability value of the satellite operation consequence state according to the satellite operation risk assessment criteria;

[0079] S6. Traverse all satellites in the satellite system and repeat steps S1 to S5 to obtain the comprehensive operational risk scores of all satellites and sort them.

[0080] 1. Formulate satellite operation risk assessment criteria

[0081] Through system analysis, the present invention is fully familiar with the system to be analyzed, including mission profile and system configuration, mission and system success criteria, operating procedures and engineering experience, etc., divides the satellite operation consequence status, and formulates satellite operation risk assessment criteria.

[0082] 1. Satellite operation consequence status

[0083] The satellite operation consequence states include the following five categories:

[0084] “Satellite Normal Operation”, “Major Short-Term Unplanned Outage”, “General Short-Term Unplanned Outage”, “Major Long-Term Unplanned Outage” and “General Long-Term Unplanned Outage”.

[0085] In constructing the satellite operation risk model, satellite nodes are set according to the above five types of consequence states.

[0086] 2. Satellite Operation Risk Assessment Criteria

[0087] The satellite operation risk assessment criteria include:

[0088] The severity level of the consequence status of each satellite, the probability level of risk occurrence, the comprehensive risk evaluation matrix, and the comprehensive risk level;

[0089] The severity levels of the satellite consequence states include mild A, mild B, moderate C, severe D, and catastrophic E, as determined by the following table:

[0090] Table 1 Classification of severity levels of satellite operation risk consequences

[0091]

[0092]

[0093] The levels of probability of risk occurrence include extremely rare a, rarely b, rarely c, possibly d, and very likely e; determined based on the probability of risk occurrence, as shown in the following table:

[0094] Table 2 Classification of risk likelihood

[0095] degree grade Risk likelihood level statement Very rare a Almost never occurs, probability of occurrence p<0.01 rare b Rarely occurs, probability of occurrence 0.01≤p<0.05 few c Occurs occasionally, probability of occurrence 0.05≤p<0.1 possible d Occurs frequently, with a probability of 0.1≤p<1 Very likely e Very likely to happen, probability of occurrence p = 1

[0096] The elements of the comprehensive risk assessment matrix are a combination of the severity level of each satellite consequence state and the probability level of risk occurrence, as shown in the following table:

[0097] Table 3 Risk consequence severity levels

[0098]

[0099] The comprehensive risk levels include higher risk, high risk, medium risk, low risk and very low risk, which are determined according to the following table:

[0100] Table 4 Comprehensive risk scores

[0101] Overall level Comprehensive risk assessment index level Comprehensive risk score Ⅰ Aa, Ab, Ac, Ba, Ca, Da No risk 90-100 Ⅱ Ad,Ae,Bb,Bc,Cb,Db,Ea Low risk 80-89 Ⅲ Bc, Bd, Be, Cc, Cd, Dc Medium risk 70-79 Ⅳ Ce, Dd, Ec, Eb High risk 60-69 Ⅴ De, Ed, Ee Very high risk 50-59

[0102] 2. Constructing a quantitative assessment model for satellite operation risks

[0103] Taking navigation satellites as an example, the steps of constructing a satellite operation risk quantitative assessment model are explained in detail:

[0104] 1. Establish an event tree model

[0105] Event chain modeling is an inductive process, which is completed by constructing an event sequence diagram or event tree for each type of primary event. The event sequence diagram can be converted into an event tree, and each different path in the event tree represents a different event chain. The primary event is the beginning of the event chain, which generally refers to an internal system failure or external event that may cause system safety consequences. For each primary event, the sequence and success / failure response of its subsequent events are modeled using an event sequence diagram or event tree. These events are the intermediate events of the event chain, which include preventive control measures that prevent the primary event from developing into potential adverse consequences, involving structures, systems, components, and human behavior. Intermediate events generally occur in a certain order. The consequence state refers to the different results caused by the occurrence or non-occurrence of the primary event and the intermediate event. The top level of the event tree from left to right is the primary event, the intermediate event, and the consequence state. Starting from the primary event at the upper left of the event tree, progressing to the right, you will encounter a branch below the "intermediate event". The path from this point downward represents the failure of the "intermediate event"; the path to the right represents the success of the "intermediate event". Different branches will eventually lead to different consequence states.

[0106] Event chain modeling is mainly divided into two steps: determining the initial cause event and building an event tree.

[0107] (1) Determine the initial cause

[0108] The internal structure of the navigation satellite was sorted out, and the failure of each component of the satellite was taken as the primary cause of the event.

[0109] (2) Constructing an event tree

[0110] The event tree of the satellite is a model composed of multiple event chains. The event chain model takes the faulty single machine as the initial cause event, the single machine or subsystem affected by the single machine failure as the intermediate event, and the satellite operation consequence state as the consequence event; the event chain model represents the path that will lead to different consequence events in the satellite system.

[0111] The event tree construction process of the satellite is as follows:

[0112] S1.1. Sort out the internal structure of the satellite and identify each satellite failure as the primary cause event;

[0113] S1.2. Starting from the initial event, identify the subsystems and systems to which the failure risk extends step by step as intermediate events;

[0114] S1.3. List the two branch states of whether the primary event and the intermediate event have failed. The different state combinations of the related events form different paths. The different paths will lead to different consequence events in the satellite system, and multiple event chains are obtained, thus forming an event tree model with a single fault as the primary event.

[0115] S1.4. Repeat steps S1.2 to S1.3 for each faulty unit on the satellite, and summarize to obtain a satellite event tree model.

[0116] If a single machine fails, the risk will be transmitted from the single machine, subsystem, satellite on-orbit function to the satellite system step by step, and finally affect the satellite on-orbit operation. Different single machine failures will cause the satellite to be in different satellite operation consequence states. The failures of the same type of single machine can be regarded as the same type of primary cause events, and the subsystem and satellite on-orbit function are intermediate events. Each type of primary cause event can construct an event tree model.

[0117] Taking the atomic clock of a navigation satellite as an example, the atomic clock group failure is identified as the primary event. If the atomic clock group fails, the risk will be transmitted upward step by step to the time-frequency subsystem, payload, and satellite system. The time-frequency subsystem and payload are intermediate events, and the operating status of the satellite system is the consequence event. Different paths will lead to different consequence events in the satellite system. The atomic clock event tree is as follows: Figure 2 In the figure, “Y” represents a failure and “N” represents no failure. Each path represents an event chain.

[0118] Other single-machine event trees of navigation satellites can be constructed according to the above method. The navigation satellite event tree model is composed of the event trees of each single machine.

[0119] The satellite operation consequence states include the following five categories:

[0120] “Satellite Normal Operation”, “Major Short-Term Unplanned Outage”, “General Short-Term Unplanned Outage”, “Major Long-Term Unplanned Outage” and “General Long-Term Unplanned Outage”.

[0121] 2. Establish a fault tree model

[0122] A fault tree is a graphical representation of a series of logical relationships. It can express both system-level failures and component-level failures. It is one of the most commonly used methods to link "component-level" failure information with "system-level" failure information. A fault tree can be built on the basis of a combination of basic events with "failure of a certain initial event" or "failure of a certain intermediate event" as the top event. This can transform an event chain described by intermediate events into an event chain described by basic events.

[0123] The fault tree can be used to model the faults of various intermediate events or initial events that need further analysis on the event chain constructed during satellite operation. In the process of decomposing the fault tree step by step, it can be stopped when it is decomposed to the single-machine level. Combined with the satellite event chain, a satellite fault tree model can be finally constructed.

[0124] In this embodiment, all event tree models in the satellite are summarized to form a basic structure of a satellite fault tree model. On the basis of the basic structure of the satellite fault tree model, the primary event or intermediate event with a backup condition in the satellite event chain is used as a top event to perform separate fault modeling, and the separately established fault model is attached to the primary event or intermediate event, and the basic structure of the satellite fault tree model is expanded to obtain a complete satellite fault tree model.

[0125] The satellite fault tree model includes bottom events, intermediate events and top events. The basic structure of the satellite fault tree model is established in the following steps:

[0126] First, for each intermediate event in the event chain that needs further analysis, record the preceding intermediate event and the corresponding initial cause event to determine the initial boundary conditions for event evaluation;

[0127] The base event of the satellite fault tree model is the set of primary cause events in the satellite event tree model;

[0128] The intermediate events of the satellite fault tree model are the collection of intermediate events in the satellite event tree model;

[0129] The top event of the satellite fault tree model is the satellite;

[0130] Secondly, use methods such as fault trees to model the faults of various intermediate events in the event chain that need further analysis. Depending on the system or function being modeled, the fault tree may have multiple levels:

[0131] According to the propagation path of event risk in the event tree model, the fault tree model connects the events connected in series in the event chain model into events with component inclusion relationships in a bottom-up order, and connects the component events to the component events;

[0132] If event A or event B is associated with the same event C in two event chain models, then in the fault tree model, event A and event B are in a series relationship with event C, and event A and event B are connected to event C through an OR gate.

[0133] The fault tree model with the initial cause event and the intermediate event as the top event with the backup situation is established according to the redundant backup relationship of the single machine, and the events corresponding to the two single machines of the redundant backup are connected by an AND gate.

[0134] Finally, associate the top event of the fault tree with the corresponding event on the event tree.

[0135] Taking the navigation satellite atomic clock as an example, since the atomic clock has 4 backups and 3, 1 hot backup, and 2 cold backups, the fault modeling of the atomic clock of the initial event can be carried out according to the redundant backup situation, such as Figure 3 shown.

[0136] In the atomic clock group fault tree, clock 1 is the working clock, clock 2 is the hot backup clock, and clocks 3 and 4 are both cold backup clocks. First, it is determined that both clocks 1 and 2 are faulty before node 1 fails. Therefore, clocks 1 and 2 are connected to node 1 using an AND gate. Similarly, node 1 and clock 3 are connected to node 2 using an AND gate, and node 2 and clock 4 are connected to the atomic clock group using an AND gate. According to the above method, fault modeling can be performed on the initial cause events and intermediate events with backup conditions in the navigation satellite event chain model.

[0137] By summarizing all event trees with different initial events but the same intermediate events and consequence events in navigation satellites, and combining them with the fault tree model constructed with the initial event or intermediate event as the top event, we can finally get the navigation satellite fault tree model, such as Figure 4 shown.

[0138] 3. Establish a quantitative assessment model for satellite operation risks

[0139] According to the series and parallel relationship of events in the satellite fault tree model, the Bayesian network modeling tool is used to convert the satellite fault tree model into a quantitative assessment model for satellite operation risks:

[0140] S3.1. Extract the bottom events and intermediate events in the navigation satellite fault tree model as nodes in the Bayesian network, and place and name the events in the Bayesian network one by one according to the level of the satellite fault tree model, so as to form a satellite operation risk assessment model. The satellite operation risk quantitative assessment model includes satellite layer nodes, function layer nodes, subsystem layer nodes and single machine layer nodes from top to bottom;

[0141] S3.2. According to the risk propagation path in the fault tree model, the nodes with component-inclusion relationship between the various levels of the satellite operation risk assessment model are connected; the component node is defined as the parent node, the component node is defined as the child node, and the parent node points to the child node;

[0142] S3.3. Convert the AND and OR gate relationships in the fault tree model into the series-parallel relationships of the satellite operation risk assessment model, specifically: there is a series relationship between the single machine node and the subsystem node, between the subsystem node and the functional node, and between the functional node and the satellite node; there is a parallel relationship between the main and backup machines under the same single machine, and there is a parallel relationship between different types of single machines with functional backup in the subsystem layer.

[0143] The naming rules of the satellite operation risk assessment model are as follows:

[0144] The satellite layer includes 1 node, which is named according to "satellite number + operational risk";

[0145] The functional layer includes three nodes, named "platform", "payload" and "intersatellite link";

[0146] Subsystem layer: According to the actual configuration of the satellite, select the subsystem under each functional node and name it using the subsystem name;

[0147] The single machine layer selects the single machine under each subsystem node according to the actual configuration of the satellite and names it after the single machine;

[0148] In the case of a redundant backup machine, a specific redundant backup machine is mounted under the machine, and is named with the primary copy + machine name or the backup + machine name.

[0149] In this embodiment, the satellite operation risk quantitative assessment model includes a satellite layer, a functional layer, a subsystem layer, and a single machine layer from top to bottom; the satellite layer includes 1 node, which is named according to "satellite number + operation risk", and the functional layer includes 3 nodes, which are named "platform", "payload", and "intersatellite link" respectively. The subsystem layer is under each functional node, and according to the actual configuration of the satellite, a subsystem or a single machine that can support the satellite to realize the corresponding function is selected. The "Platform" node includes 5 parent nodes, named "Control Subsystem", "Propulsion Subsystem", "Power Subsystem", "Measurement and Control Subsystem" and "Integrated Electronic Subsystem" respectively; the "Payload" node includes 5 parent nodes, named "Injection Subsystem", "Navigation Mission Subsystem", "Broadcast Subsystem", "Antenna Subsystem" and "Time and Frequency Subsystem" respectively; the "Intersatellite Link" node includes 3 parent nodes, named "Intersatellite Transceiver", "Ka Antenna" and "Ka Power Supply" respectively. The single machine layer is under each subsystem node. According to the actual configuration of the satellite, the key single machines that constitute each subsystem are selected, mainly referring to the electronic product type single machines with random failures in orbit, the wear and tear failure type single machines with performance degradation trends, and the comprehensive failure type single machines with random + wear and tear failures; in addition, for the single machines with redundant backups in the single machine layer, it is necessary to hang the corresponding redundant backup single machines below.

[0150] Between each level, if there is an ownership relationship between the upper node and the lower node, a connection line needs to be added from the lower node to the upper node. The ownership relationship includes composition relationship, redundant backup relationship, and uncertain relationship, specifically referring to the baseband synthesizer pointing to the atomic clock in the single machine layer.

[0151] 4. Set the node status of the satellite operation risk quantitative assessment model

[0152] According to the on-orbit fault type of a single machine and the cascade relationship of the nodes in the satellite operation risk quantitative assessment model, the status of all nodes in the satellite operation risk quantitative assessment model is set;

[0153] For mechanical, electronic, electrical and comprehensive single machines, the single machine status is divided into two types in the satellite operation risk assessment model according to whether it can be recovered after a fault occurs, namely: Type 1, divided into two states, including state 0: normal operation and state 1: permanent fault; Type 2, divided into three states, including state 0: normal operation, state 1: recoverable fault and state 2: permanent fault;

[0154] For consumable machines, the machines can be divided into three states according to the consumption rate of consumable materials, including state 0: normal operation, state 1: abnormal consumption and state 2: exhaustion.

[0155] Table 5 Classification of single machine failure types

[0156]

[0157]

[0158] At the subsystem layer and the function layer, the status of the subsystem layer nodes and the function layer nodes is set according to the status of the subordinate stand-alone nodes, and is consistent with the status setting of the subordinate nodes.

[0159] The state of the satellite layer is set to the set of consequence events in the satellite event tree model;

[0160] In this embodiment, the "satellite number + operation risk" node in the satellite layer is set to "normal satellite operation", "important short-term unplanned interruption", "general short-term unplanned interruption", "important long-term unplanned interruption" and "general long-term unplanned interruption" for a total of 5 states;

[0161] 5. Set up the node conditional probability table of the satellite operation risk quantitative assessment model

[0162] According to the AND gate and OR gate relationship of each event in the navigation satellite fault tree model, the conditional probability table is set for the nodes with connection relationship according to the series connection and parallel connection methods respectively.

[0163] The setting method of the conditional probability table for the series relationship is:

[0164] If any parent node operates normally, the child node operates normally. If and only if a parent node fails, the child node fails.

[0165] The conditional probability table of the parallel relationship is set as follows: if any parent node operates normally, the child node operates normally; if and only if all parent nodes fail, the child node fails.

[0166] For different parent nodes under the same child node, if there is a redundant backup relationship between different parent nodes, the redundant backup includes cold backup and hot backup;

[0167] The conditional probability table of cold backup is set as follows: if any parent node is running normally, the child node is running normally. If and only if all working parent nodes and the parent node for cold backup fail, the child node fails. If and only if the working parent node fails and the parent node for cold backup needs to be switched to work, the child node has a certain failure probability due to different switching switches, among which the failure probability of mechanical switching switches is 0.004; the failure probability of electronic switching switches is 0.003; the failure probability of hybrid switching switches is 0.001.

[0168] The conditional probability table of hot backup is set as follows: if any parent node operates normally, the child node operates normally; if and only if all working parent nodes and the parent node serving as hot backup fail, the child node fails.

[0169] In the actual operation of satellites, it is necessary to consider the redundant design of some functions / single machines to increase reliability, the problem of whether different single machines can be recovered when failure occurs, and the influence of the status of different single machines in special subsystems. Therefore, in view of the above phenomenon, in the process of constructing a satellite operation risk assessment model, it is necessary to focus on the following factors, including single machine structural redundancy and functional redundancy, node polymorphism and uncertainty expression.

[0170] The following mainly introduces the modeling process of these three elements, namely, single-machine structure and functional redundancy, node polymorphism, and uncertain expression, using the Bayesian network modeling tool.

[0171] One is in terms of functional redundancy of single-machine structure.

[0172] (1) Single machine redundant backup

[0173] In order to improve the reliability of satellites, in terms of satellite structure design, many key single machines will adopt backup measures, among which dual-machine backup is a common backup method, including cold backup and hot backup. In terms of satellite function design, functional redundancy backup measures will be taken between subsystems / single machines.

[0174] a) Transformation of dual-machine hot backup gate into Bayesian network

[0175] Assume that system A consists of single machine K1 and single machine K2. Single machine K1 is the working single machine, single machine K2 is the backup single machine, and single machine K2 performs hot backup for single machine K1. Then the fault tree of the system and the transformed Bayesian network are as follows: Figure 5 shown.

[0176] Assuming that a single node has two states, the conditional probability table corresponding to its Bayesian network is as follows:

[0177] Table 6 Hot backup gate Bayesian network conditional probability table

[0178]

[0179] b) Transformation of dual-machine cold backup gate into Bayesian network

[0180] Assume that system A consists of single machine K1 and single machine K2, single machine K1 is a working single machine, and single machine K2 performs cold backup for single machine K1. Then the fault tree and transformed Bayesian network of the system are as follows: Figure 6 shown.

[0181] Assuming that a single node is set to two states, the conditional probability table corresponding to its Bayesian network is as follows:

[0182] Table 7 Cold backup door Bayesian network conditional probability table (mechanical switch)

[0183]

[0184] Table 8 Cold backup door Bayesian network conditional probability table (electronic switching switch)

[0185]

[0186] Table 9 Cold backup door Bayesian network conditional probability table (comprehensive switching switch)

[0187]

[0188] (2) Expression of functional backup in Bayesian networks

[0189] When providing services, satellites back up some functions through subsystem / single-machine backup. Considering the satellite's main functions, even if a single machine fails, it will not affect the normal operation or service of the satellite. Instead, it will switch to a different satellite working mode, that is, back up the corresponding functions. However, the change of the corresponding system configuration or working mode will still affect the satellite's working status and reliability.

[0190] Assume that system A consists of a single machine K and a single machine S. Both single machines K and S are working machines and perform the same functions and back up each other. Then the Bayesian network is as follows: Figure 7 shown.

[0191] Assuming that the states of a single node include state 0: normal and state 1: failure, the conditional probability table corresponding to its Bayesian network is as follows:

[0192] Table 10 Function backup gate Bayesian network conditional probability table

[0193]

[0194] The second is in the node polymorphism setting.

[0195] By sorting out the internal structure and failure mechanism of the single machine, the single machine is roughly divided into three categories. One category is the mechanical single machine, which is irrecoverable after a failure. In the model, the single machine node is set to two states, namely state 0: normal operation and state 1: permanent fault.

[0196] Assume that system A consists of a single machine K and a single machine S, and that single machine K, single machine S and system A are all set to two states. Then the node conditional probability table in the Bayesian network is set as follows.

[0197] Table 11 Conditional probability table of system A (single machine K and single machine S are in series relationship)

[0198]

[0199] Table 5 Conditional probability table of system A (single machine K and single machine S are in parallel relationship)

[0200]

[0201] The other type is a single machine with both mechanical and electronic parts, that is, there are two types of faults: recoverable faults and non-recoverable faults. In the model, this type of node is set to three states, namely state 0: normal operation, state 1: recoverable fault and state 2: permanent fault.

[0202] Assuming that system A consists of a single machine K and a single machine S, and single machine K, single machine S and system A are all set to three states, the node conditional probability table in the Bayesian network is set as follows.

[0203] Table 12 Conditional probability table of system A (single machine K and single machine S are in series relationship)

[0204]

[0205] Table 13 Conditional probability table of system A (single machine K and single machine S are in parallel relationship)

[0206]

[0207] In summary, the child node should be determined according to the polymorphic setting of its parent node, that is, if the single machine under the subsystem has three states, the subsystem should also be set to three states; if the single machines under the subsystem are all in two states, the subsystem should be set to two states.

[0208] The third is the expression of node uncertainty.

[0209] The expression of node uncertainty is determined according to the specific situation of the single machine. Redundant backup is only for single machines with redundant design. Node polymorphism should be determined based on the failure mechanism of the single machine to determine whether a recoverable fault / permanent fault will occur. The expression of uncertainty should be determined based on whether there will be any interactive impact between specific single machines.

[0210] The node uncertainty expression in this implementation refers specifically to the relationship between the baseband synthesizer and the atomic clock.

[0211] Both "base frequency synthesizer" and "atomic clock" are set to four states, namely, state 0: normal operation, state 1: general recoverable fault, state 2: important recoverable fault, and state 3: permanent fault. The method of setting the conditional probability table is as follows: add an auxiliary judgment node, named "autonomous switching module", and set it to two states, namely, state 0: switch, state 1: do not switch; the "base frequency synthesizer" node points to the "autonomous switching module" node, and then the "autonomous switching module" node points to the "atomic clock" node. If and only if the "base frequency synthesizer" node is in the state of "important recoverable fault", the "autonomous switching module" node decides whether the "atomic clock" node switches abnormally from the state of "normal operation" to the state of "general recoverable fault".

[0212] The conditional probability table between the "Autonomous Switching Module" node and the "Baseband Synthesizer" node is set as:

[0213] Table 14 Conditional probability table between the "autonomous switching module" node and the "baseband synthesizer" node

[0214] Baseband Synthesizer 0 1 2 3 Autonomous switching module-state 0 1 1 0 1 Autonomous switching module-state 1 0 0 1 0

[0215] The conditional probability table between the "atomic clock" node and the "autonomous switching module" node is set as:

[0216] Table 15 Conditional probability table settings between the "atomic clock" node and the "autonomous switching module" node

[0217] Autonomous switching module 0 1 Atomic Clock - State 0 1 0 Atomic Clock - State 1 0 1 Atomic Clock - State 2 0 0 Atomic Clock - State 3 0 0

[0218] In summary, this embodiment takes the navigation satellite as the modeling object, uses the Bayesian network modeling tool, completes the conversion to the Bayesian network based on the constructed satellite fault tree model, and constructs the navigation satellite operation risk assessment model as follows: Figure 8 to Figure 11 shown.

[0219] 3. Calculate the probability of failure

[0220] The satellite operation data includes:

[0221] Data and information of each stand-alone product, including quality problem data, telemetry data, on-orbit baseline data, design data, supplier data, and experience judgment data of field experts;

[0222] By processing and analyzing the single-machine data, the probability value of the state of each node in the single-machine layer is calculated.

[0223] The normal operation probability, recoverable failure probability and resident failure probability can be used as input data for the satellite operation risk quantitative assessment model. The statistical examples are as follows:

[0224] Table 16 Statistics of normal operation probability, recoverable fault probability, and resident fault probability

[0225] Satellite number Single machine name Probability of normal operation Probability of recoverable failure Resident Failure Probability XXX XXX 0.8 0.15 0.05

[0226] (1) Calculation of random single-machine failure probability

[0227] Random failure type single machine refers to a single machine whose life follows the random failure distribution. It may soon fail on track and fail permanently, or it may operate normally for a long time and far exceed the design life. The failure probability of random failure type single machine is divided into recoverable failure probability and permanent failure probability.

[0228] 1. Single machine sample classification

[0229] According to the failure mechanism of a single machine, after completing the classification of single machines, it is necessary to divide the sample range of single machines of the same failure type. The specific division steps are as follows:

[0230] 1) According to the machine name, machines with the same name are divided into the same sample;

[0231] 2) Based on the above samples, according to the supplier data, the single machines with the same name and the same supplier name are divided into the same sample;

[0232] 3) Based on the samples divided in the first two steps, the existing samples are divided again. As of the current calculation time, the single machines that have worked in the existing samples are divided into the same sample, and the single machines that have not worked are divided into another sample.

[0233] 2. Calculation method of recoverable failure probability

[0234] For each single machine in each sample, the probability of single machine recoverable failure is calculated separately; when more than one single machine in the same sample has experienced recoverable failures up to the current calculation time, the probability of single machine recoverable failure is corrected using the common cause factor; when a single machine has been reconstructed up to the current calculation time, the probability of self-recoverable failure of the reconstructed single machine is calculated to update the probability of self-recoverable failure of the single machine. The specific calculation method is as follows:

[0235] 1) According to the recoverable fault data of random failure units, the availability of each unit during on-orbit operation is calculated and used as the probability of recoverable failure of the unit itself. Therefore, the calculation formula of the probability of recoverable failure of the unit itself is:

[0236]

[0237] In the formula, MTBF is the mean time between failures, and MTTR is the mean time to repair.

[0238] 2) Correction of single-machine recoverable failure probability considering reconstruction

[0239] If a single machine has a recoverable failure again after reconstruction as of the current calculation time, the probability of recoverable failure of the single machine itself needs to be corrected. The calculation formula is as follows:

[0240]

[0241] In the formula, MTTR 重构后 MTTR is the average trouble-free working time after the single machine is rebuilt 重构后 It is the average repair time after a single machine is rebuilt.

[0242] If no quality problems occur on a single machine after reconstruction up to the current calculation time, the probability of recoverable failure of the single machine is corrected to 0 (MTTR 重构后 is 0).

[0243] 3) Probability of single machine recoverable failure considering common causes

[0244] In the same sample, single machines with the same structure and working environment often have common cause failures. Therefore, for the probability of recoverable failure of a single machine, the common cause failure part must be comprehensively considered, and the common cause factor must be used to make corrections based on the divided sample results.

[0245] The method of using common cause factors to correct the probability of recoverable failure of a single machine is as follows:

[0246] Corrected single machine recoverable failure probability =

[0247] The probability of a single machine's own recoverable failure before correction + β*the sum of the probabilities of other single machines' recoverable failures in the sample to which the single machine belongs

[0248] Among them, β is the common cause factor, and its value is 0.001-0.01 according to expert experience.

[0249] Preferably, the single machine type and sample situation can be further considered, and the β value is as follows.

[0250] Table 17 Common cause factor values ​​for each single machine

[0251]

[0252] Similarly, taking into account the common cause failures, the probability of a single machine's own recoverable failure after reconstruction can be substituted into the probability of a single machine's own recoverable failure before correction to calculate the probability of a single machine's own recoverable failure considering common causes.

[0253] 3. Calculation method of resident failure probability

[0254] The probability of resident failure is mainly calculated based on the resident failures in the quality problem combined with the on-orbit baseline and supplier data. Based on the division of samples according to supplier information and working status, the actual number of resident failures in different samples is different, so the analysis methods used are different. The on-orbit baseline refers to the current on-orbit operation status of the satellite at the time of calculation.

[0255] The machines with the same batch, model and supplier are divided into the same sample. On this basis, the existing samples are divided again. As of the current calculation time, the machines that have been worked in the existing samples are divided into the same sample, and the machines that have not been worked are divided into another sample.

[0256] According to the total number of resident faults that occurred in the sample up to the current calculation time, different resident fault probability calculation methods are selected:

[0257] When the total number of resident faults that have occurred in all single machines in the sample up to the current calculation time is 0, the reliability distribution R(t) is calculated using the zero-failure small sample analysis model;

[0258] When the total number of resident faults that have occurred in all single machines in the sample up to the current calculation time is 1-2, the timed truncation model is used to calculate the single machine reliability distribution R(t);

[0259] When the cumulative number of resident failures of all single machines in the sample as of the current calculation time is greater than or equal to 3, the non-parametric estimation model is used to calculate the single machine reliability distribution R(t).

[0260] According to the reliability R(t0) of each single machine up to the current calculation time, the resident failure probability of the single machine up to the current calculation time is calculated.

[0261] 1) Calculate the probability of permanent failure using the zero-failure data analysis model

[0262] If no permanent faults have occurred in all the single machines in the sample up to the current calculation time, it can be regarded as a small sample with no failure. The structure of the no-failure data is shown in the following table.

[0263] Table 18: Data structure of small sample without failure

[0264] Group number i <![CDATA[Truncation time T i > <![CDATA[The number of samples in the i-th group, n i > <![CDATA[Number of non-expired S i > 1 <![CDATA[T1]]> <![CDATA[n1]]> <![CDATA[S1]]> 2 <![CDATA[T2]]> <![CDATA[n2]]> <![CDATA[S2]]> 3 … … … 4 <![CDATA[T i ]]> <![CDATA[n i ]]> <![CDATA[S i ]]>

[0265] According to the definition of the multi-layer Bayes method and the Bayes theorem, under square loss, the failure probability pihB of a single machine in the i-th group of samples is calculated as follows:

[0266]

[0267] In the formula, S iis the number of non-failures in the i-th group of samples, c is the hyperparameter engineering recommended value of 5, and the failure probability p of a single machine in the i-th group of samples can be obtained according to the above formula ihB Estimated value.

[0268] According to the weighted least squares estimation method, the Weibull double parameter estimation values ​​of shape parameter β and life parameter η are obtained as follows:

[0269]

[0270] η=expμ

[0271] Where:

[0272]

[0273] Where:

[0274]

[0275] Where ω i is the weight value, T i is the censoring time of the i-th group, k is the number of samples, n i is the number of single machines in the i-th group of samples.

[0276] x i and i The formula is as follows:

[0277]

[0278] Where p ihB is the failure probability of a single machine in the i-th group of samples, T i is the censoring time of group i.

[0279] Substituting the obtained Weibull parameter point estimate into the reliability formula, we can get the reliability R of the original sample that obeys the Weibull sampling function. 无失效 (t), as follows:

[0280]

[0281] Substituting the running time t0 of the single machine up to the current calculation time, we can get the resident failure probability of the single machine under this sample as 1-R 无失效 (t0).

[0282] 2) Calculation of resident fault probability using the time-truncation model

[0283] For single machine samples that have experienced less than three times and more than zero resident faults up to the current calculation time, the timed truncation test method can be used to calculate the reliability distribution parameters and further obtain the resident fault probability.

[0284] According to the reliability index model R = e -λt , parameter θ is the mean failure time, which is the inverse of the failure rate λ, and the formula is as follows:

[0285]

[0286] Where, T r is the sum of the running time of all the machines in the sample, and r is the sum of the number of resident faults that occur in the sample.

[0287] Combined with the reliability function, it is as follows:

[0288]

[0289] Substituting the running time t0 of a single machine up to the current calculation time into the above formula, we can obtain the probability of a single machine with no resident faults in the sample as 1-R 定时截尾 (t0).

[0290] 3) Non-parametric estimation model to calculate the probability of permanent failure

[0291] For single machine samples that have experienced more than three resident faults up to the current calculation time, the reliability distribution parameters can be calculated using non-parametric estimation methods, and the resident fault probability can be further obtained.

[0292] The total number of samples is N, the number of failed (abnormal) samples is n, and the number of truncated test samples is Nn. Using the failure / abnormal information of the single machine sample, calculate the reliability of 1, 2, ..., n failed (abnormal) machines.

[0293] The reliability of one failed unit is:

[0294] The reliability of failed 2 units is:

[0295] …

[0296] The reliability of n failed units is:

[0297] The nonparametric estimated single machine reliability probability is expressed in terms of operating time (days), and the curve is fitted using Weibull distribution to calculate the shape parameter β′ and life parameter η′ of the nonparametric estimated Weibull distribution. The results of the nonparametric analysis of the sample single machine are logarithmized twice and the minimum variance fitting is performed.

[0298] Through fitting, the slope of the straight line is a and the intercept is b, so the shape parameter β and life parameter η' of the non-parametric estimation of the Weibull distribution can be obtained:

[0299] β′=a

[0300]

[0301] The reliability calculation formula is as follows:

[0302]

[0303] Substituting the running time t0 of a single machine up to the current calculation time into the above formula, we can obtain the probability of a single machine with no resident faults in the sample as 1-R 非参数估计 (t0).

[0304] Considering the impact of reconstruction on a single machine, a correction factor is added to the calculation result of the resident fault probability. The calculation formula for the resident fault of a single machine with random failure is as follows:

[0305] λ1(1-R(t0))

[0306] When the reconstruction scheme can effectively solve or improve the working condition of a single machine on orbit, the correction coefficient λ1 takes a value of 0.5 to 1; when the reconstruction scheme is irrelevant to the single machine, λ1=1; when the reconstruction scheme worsens the working condition of the specified single machine or increases the load, the correction coefficient λ1 takes a value of 1 to 1.5.

[0307] (2) Calculation of comprehensive single-machine failure probability

[0308] The integrated failure type single machine is defined, including two-floating gyroscope, traveling wave tube amplifier, atomic clock, inertial attitude controller, inertial attitude sensor. The integrated failure type single machine is a random failure and wear and tear failure type single machine.

[0309] like Fig.12 As shown, the present invention provides a method for calculating a single machine fault of a comprehensive failure type, the method comprising the following steps:

[0310] S1. Extract all satellites’ comprehensive failure units, and classify units of the same batch, model, and supplier into the same sample. On this basis, divide the existing samples again. As of the current calculation time, the units that have worked in the existing samples are classified into the same sample, and the units that have not worked are classified into another sample.

[0311] S2, divide each single machine into a random failure part and a wear and tear failure part, and divide the random failure part in the same sample into the same sample again, and divide the wear and tear failure part in the same sample into another sample;

[0312] S3. For each failure part in each sample, calculate the recoverable failure probability of the random failure part as the recoverable failure probability of the single machine with comprehensive failure;

[0313] S4, obtaining telemetry parameters reflecting the degradation trend of the loss-of-function part of the single machine in the sample, wherein the telemetry parameters reflecting the degradation trend of the loss-of-function part of the single machine in the sample have the same change rule, and when the telemetry parameters monotonically increase or decrease over time, execute steps S5 and S6, otherwise, proceed to step S7;

[0314] S5. Calculate the reliability distribution R for each random failure part and wear failure part of each single machine in the sample. 耗损 (t), multiply the reliability distribution of the random failure part of a single machine and the failure part of wear and tear to obtain the reliability distribution of the single machine with comprehensive failure;

[0315] S6. Substitute the running time t0 of each single machine up to the current calculation time into the reliability distribution R(t) of the single machine of the comprehensive failure class, calculate the reliability R(t0) of the single machine of the comprehensive failure class up to the current calculation time, and calculate the resident failure probability of the single machine of the comprehensive failure class up to the current calculation time according to the reliability R(t0) of the single machine of the comprehensive failure class;

[0316] S7. Calculate the resident failure probability for each random failure part and wear failure part of each single machine in the sample, and sum the resident failure probabilities of the random failure part and the wear failure part of the single machine to obtain the resident failure probability of the comprehensive failure type single machine.

[0317] (1) Random failure part

[0318] 1) Calculation of recoverable failure probability of random failure part

[0319] The probability of recoverable failure is mainly calculated based on the recoverable failures in the quality problem and their corresponding interruption time.

[0320] For each random failure part of each single machine in each sample, calculate the probability of recoverable failure of the random failure part of the single machine;

[0321] When more than one single-machine random failure part in the same sample has experienced recoverable failures up to the current calculation time, the probability of recoverable failures of the single-machine random failure part is corrected using the common cause factor;

[0322] When the random failure part of a single machine has been reconstructed up to the current calculation time, the probability of recoverable failure of the random failure part of the single machine after reconstruction is calculated to update the probability of recoverable failure of the random failure part of the single machine.

[0323] The method for calculating the probability of recoverable failure of the random failure part of a single machine, the method for correcting the probability of recoverable failure considering software reconstruction, the method for calculating the probability of recoverable failure of the random failure part considering common causes, and the calculation of the probability of resident failure of the random failure part are the same as those for the random failure type single machine, except that the single machine is replaced by the single machine random failure part.

[0324] (2) Consumption failure part

[0325] The resident failure probability of the consumption failure part is mainly calculated based on the telemetry data of the single machine and the corresponding threshold.

[0326] 1) Lognormal model

[0327] When the telemetry parameters increase or decrease monotonically over time, the lognormal model can be used for calculation.

[0328] Using the log-normal model, the reliability distribution R of the failure part of a single machine is calculated. 耗损 (t), the specific steps are as follows:

[0329] Select a telemetry parameter that reflects the degradation trend of the loss-of-function part of the single machine in the sample as a candidate telemetry parameter, and use the measured value y of the candidate telemetry parameter of the lognormal model i and its corresponding stand-alone running time t i Perform fitting, i = 1 ~ n, the candidate telemetry parameter fitting formula is as follows:

[0330]

[0331] Among them, b0 and b1 are fitting parameters, is the error of the random variable of standard normal distribution; n is the number of telemetry parameters in the sample;

[0332] Substitute the candidate telemetry parameter boundary value of each single machine into the candidate telemetry parameter fitting formula, and calculate the single machine running time corresponding to the boundary value. The single machine running time corresponding to the boundary value is defined as the life of the wear and tear part of the corresponding single machine. i , i = 1 to n;

[0333] Based on the age of the worn-out parts of all the units in the sample i , the mean μ′ and standard deviation σ′ of the failure part life of a single machine in the sample are calculated, and the formula is as follows:

[0334]

[0335] This results in the reliability model:

[0336]

[0337] The reliability model of the mean μ′ and standard deviation σ′ of the inner life of the failure part of the sample unit is:

[0338]

[0339] 2) Stress intensity model

[0340] For telemetry parameters that have no obvious degradation trend over time (no monotonically increasing or decreasing trend), the stress intensity model can be used to calculate the probability of permanent failure.

[0341] A telemetry parameter that reflects the degradation trend of the loss-of-function part of a single machine in the sample is selected as a candidate telemetry parameter;

[0342] Obtain a sampling sequence of candidate telemetry parameters for a single machine;

[0343] Calculate the mean of the candidate telemetry parameter sampling sequence and standard deviation S x :

[0344]

[0345] Among them, M is the length of the candidate telemetry parameter sampling sequence, x m is the mth sampling value in the candidate telemetry parameter sampling sequence.

[0346] If the candidate telemetry parameter has a design lower limit, the first coefficient K1 is calculated based on the design lower limit L:

[0347]

[0348] According to the first coefficient K1, the given confidence level γ, and the candidate telemetry parameter sampling sequence length M, the normal distribution bilateral tolerance coefficient table QJ1384-88 is checked to obtain the shortest interval [a1, b1] containing K1 and the p corresponding to a1 and b1. (11) , p (12) ; Then check the normal distribution quantile table GB4086 and find the value corresponding to p (11) The corresponding normal distribution quantile With p (12) The corresponding normal distribution quantile

[0349] Using linear interpolation, we get Look up the normal distribution table to get the p1 formula:

[0350]

[0351] The NormalDist function is used to calculate the cumulative distribution value of the normal distribution;

[0352] If the candidate telemetry parameter has a design upper limit, the second coefficient K2 is calculated according to the design upper limit U:

[0353]

[0354] According to the second coefficient K2, the given confidence level γ, and the candidate telemetry parameter sampling sequence length M, the normal distribution bilateral tolerance coefficient table QJ1384-88 is checked to obtain the shortest interval [a2, b2] containing K2 and the p corresponding to a2 and b2. (21) , p (22) ; Then check the normal distribution quantile table GB4086 and find the value corresponding to p (21) The corresponding normal distribution quantile With p (22) The corresponding normal distribution quantile

[0355] Using linear interpolation, we get Check the normal distribution table to get the p2 formula:

[0356]

[0357] The NormalDist function is used to calculate the cumulative distribution value of the normal distribution;

[0358] If the candidate telemetry parameter has both a lower design limit and an upper design limit, then:

[0359] Reliability of the failed part: R 耗损 =1-(p1+p2).

[0360] If the candidate telemetry parameters only have design lower limits, then:

[0361] Reliability of the failed part: R 耗损 =1-p1.

[0362] If the candidate telemetry parameters only have design upper limits, then:

[0363] Reliability of the failed part: R 耗损 =1-p2.

[0364] The probability of permanent failure of the wear-out failure part is: 1-R 耗损 .

[0365] (3) Comprehensive calculation of the resident failure probability of a single machine

[0366] like Fig.13 As shown in Figure 2, the recoverable failure probability of a single machine with comprehensive failure is obtained from the recoverable failure probability of the random part.

[0367] When the telemetry parameters do not have a monotonically increasing or decreasing relationship with time, the stress intensity model is used for the wear and tear failure part. The formula for the resident failure probability of a single machine in the single machine comprehensive failure category is as follows:

[0368] The probability of resident failure of a single machine with comprehensive failure

[0369] =(1-R 随机 (t))+(failure probability value calculated by stress intensity model)

[0370] When the telemetry parameters increase or decrease monotonically over time, the loss failure part adopts the log-normal model, and the resident failure probability formula of a single machine of the single machine comprehensive failure type is as follows:

[0371] The probability of permanent failure of a single machine with comprehensive failure = 1-R 随机 (t)*R 耗损 (t).

[0372] Considering the impact of single machine reconstruction, the second correction coefficient λ2 is added to correct the resident failure probability of the comprehensive failure type single machine. The corrected resident failure probability of the single machine is: λ2*resident failure probability of the comprehensive failure type single machine.

[0373] Among them, λ2 is the second correction coefficient. When the single machine is not reconstructed, the second correction coefficient λ2=1; when the reconstruction can effectively solve or improve the working state of the single machine on orbit, the second correction coefficient λ2=0.5~1; when the reconstruction scheme makes the working condition of the specified single machine worse or the load increases, the second correction coefficient λ2=1~1.5.

[0374] IV. Comprehensive scoring and ranking of satellite operation risks

[0375] The steps of satellite operation risk ranking are as follows:

[0376] S5.1. Obtain the probability value of each operation consequence state of the satellite, and determine the risk occurrence possibility level corresponding to the operation consequence state other than "normal operation" according to the probability value of the operation consequence state;

[0377] In this embodiment, the probabilities corresponding to the operation consequence states other than "normal operation" are 0.1, 0.05, 0.05, 0; the corresponding risk occurrence possibility level set is {d, c, c, a}

[0378] S5.2. The combination of the severity level of the operational consequence status other than "normal operation" and its corresponding risk occurrence probability level is used as the comprehensive risk evaluation index, and the comprehensive risk rating table is searched to obtain the comprehensive risk level corresponding to each operational consequence status of the satellite, forming a comprehensive satellite operational risk rating set;

[0379] In this embodiment, the combination of risk occurrence possibility levels {Bd, Cc, Dc, Ea}) corresponds to {III, III, III, II} in this embodiment.

[0380] S5.3. Based on the highest risk level in the satellite operation risk comprehensive rating set, find the lower limit of the corresponding risk comprehensive score range in the risk comprehensive rating table and use it as the basic score of the satellite;

[0381] In this embodiment, the highest risk level is III, and the lower limit of the comprehensive risk score range is 80.

[0382] S5.4. Based on the basic score of the satellite, satellites at the same risk level are classified and sorted from low to high according to the probability value of the satellite being in the "normal operation" state. The boundary of the probability interval is set according to the principle of minimum envelope. For satellites at the same risk level, the linear interpolation formula can be used to obtain additional scores of 0-9 points, which are added to the basic score to obtain the comprehensive satellite operation risk score;

[0383] In this embodiment, there are three satellites that are all at medium risk, with basic scores of 80. They are ranked from low to high according to the probability of being in normal operation, which are 0.81, 0.83 and 0.84 respectively, and the probability interval is 0.80-0.85. Using linear interpolation, the additional scores of the three satellites are 1.8, 5.4, and 7.2 respectively. When added with the basic scores, the comprehensive operation risk scores of the three satellites are 81.8, 85.4, and 87.2 respectively.

[0384] The formula for additional points is:

[0385] S5.5. Traverse all satellites in the satellite system, and repeat steps S5.1 to S5.4 for each satellite to obtain the comprehensive operational risk scores of all satellites, and sort them from low to high according to the scores.

[0386] Although the present invention has been disclosed as above in the form of a preferred embodiment, it is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications to the technical solution of the present invention by using the methods and technical contents disclosed above without departing from the spirit and scope of the present invention. Therefore, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope of the technical solution of the present invention.

[0387] Although the present invention has been disclosed as above in the form of a preferred embodiment, it is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications to the technical solution of the present invention by using the methods and technical contents disclosed above without departing from the spirit and scope of the present invention. Therefore, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope of the technical solution of the present invention.

Claims

1. A satellite operation risk quantitative assessment method, characterized in that The steps include: S1. Classify satellite operation consequence states and formulate satellite operation risk assessment criteria; S2. Use Bayesian network modeling tools to build a satellite operation risk quantitative assessment model; the satellite operation risk quantitative assessment model is decomposed layer by layer according to the construction logic of satellite layer-function layer-subsystem layer-single machine layer, and the state of the top-level node is defined as the satellite operation consequence state; S3. Collect satellite operation data, and calculate the failure probability of a single machine corresponding to the bottom node in the satellite operation risk quantitative assessment model based on the satellite operation data; S4, substituting the failure probability of a single machine into the satellite operation risk quantitative assessment model, and using the satellite operation risk quantitative assessment model to calculate the probability value of the satellite operation consequence state; S5. Calculate the satellite operation risk comprehensive score based on the probability value of the satellite operation consequence state according to the satellite operation risk assessment criteria; S6. Traverse all satellites in the satellite system and repeat steps S1 to S5 to obtain the comprehensive operational risk scores of all satellites and sort them.

2. A satellite operation risk quantitative assessment method according to claim 1, characterized in that: The satellite operation consequence states include the following five categories: "Satellite Normal Operation", "Major Short-Term Unplanned Outage", "Normal Short-Term Unplanned Outage", "Major Long-Term Unplanned Outage" and "Normal Long-Term Unplanned Outage".

3. A satellite operation risk quantitative assessment method according to claim 1, characterized in that: The satellite operation risk assessment criteria include: The severity level of the consequence status of each satellite, the probability level of risk occurrence, the comprehensive risk evaluation matrix, and the comprehensive risk level; The severity levels of the satellite consequence states include mild A, mild B, moderate C, severe D, and catastrophic E, as determined by the following table: Satellite operation risk consequence severity classification The levels of probability of risk occurrence include extremely rare a, rarely b, rarely c, possibly d, and very likely e; determined based on the probability of risk occurrence, as shown in the following table: The elements of the comprehensive risk assessment matrix are a combination of the severity level of each satellite consequence state and the probability level of risk occurrence, as shown in the following table: The comprehensive risk levels include higher risk, high risk, medium risk, low risk and very low risk, which are determined according to the following table: 。 4. A satellite operation risk quantitative assessment method according to claim 3, characterized in that: The steps of satellite operation risk ranking are as follows: S5.

1. Obtain the probability value of each operation consequence state of the satellite, and determine the risk occurrence possibility level corresponding to the operation consequence state other than "normal operation" according to the probability value of the operation consequence state; S5.

2. The combination of the severity level of the operational consequence states other than "normal operation" and the corresponding risk occurrence probability level is used as the comprehensive risk evaluation index, and the comprehensive risk rating table is searched to obtain the comprehensive risk level corresponding to each operational consequence state of the satellite, forming a comprehensive satellite operational risk rating set; S5.

3. Based on the highest risk level in the satellite operation risk comprehensive rating set, find the lower limit of the corresponding risk comprehensive score range in the risk comprehensive rating table and use it as the basic score of the satellite; S5.

4. Based on the basic score of the satellite, satellites at the same risk level are classified and sorted from low to high according to the probability value of the satellite being in the "normal operation" state. The boundary of the probability interval is set according to the principle of minimum envelope. For satellites at the same risk level, the linear interpolation formula can be used to obtain additional scores of 0-9 points, which are added to the basic score to obtain the comprehensive satellite operation risk score; S5.

5. Traverse all satellites in the satellite system, and repeat steps S5.1 to S5.4 for each satellite to obtain the comprehensive operational risk scores of all satellites, and sort them from low to high according to the scores.

5. The method for quantitatively assessing satellite operation risk according to claim 1, characterized in that: The satellite operation risk quantitative assessment model includes satellite layer nodes, function layer nodes, subsystem layer nodes and single machine layer nodes from top to bottom; There are node connections between each level that constitute a containment relationship; The constituent nodes are defined as parent nodes, the constituent nodes are defined as child nodes, and the parent nodes point to the child nodes; There is a series relationship between the stand-alone node and the subsystem node, between the subsystem node and the functional node, and between the functional node and the satellite node; there is a parallel relationship between the main and backup machines under the same stand-alone machine, and there is a parallel relationship between different types of stand-alone machines with functional backup in the subsystem layer; The attributes of each node include name, state and conditional probability table CPT.

6. A satellite operation risk quantitative assessment method according to claim 1, characterized in that: The naming rules of the satellite operation risk assessment model are as follows: The satellite layer includes 1 node, which is named according to "satellite number + operational risk"; The functional layer includes three nodes, named "platform", "payload" and "intersatellite link"; Subsystem layer: According to the actual configuration of the satellite, select the subsystem under each functional node and name it using the subsystem name; The single machine layer selects the single machine under each subsystem node according to the actual configuration of the satellite and names it after the single machine; In the case of a redundant backup machine, a specific redundant backup machine is mounted under the machine, and is named with the primary copy + machine name or the backup + machine name.

7. A satellite operation risk quantitative assessment method according to claim 1, characterized in that: According to the type of single-machine on-orbit failure, the method for setting the status of each node in the satellite operation risk assessment model is as follows: For mechanical, electronic, electrical and comprehensive single machines, the single machine status is divided into two types in the satellite operation risk assessment model according to whether it can be recovered after a failure, namely: Type 1, divided into two states, including state 0: normal operation and state 1: permanent failure; Type 2, divided into three states, including state 0: normal operation, state 1: recoverable fault and state 2: permanent fault; For consumable machines, the machines can be divided into three states according to the consumption rate of consumable materials, including state 0: normal operation, state 1: abnormal consumption and state 2: exhaustion; At the subsystem layer and function layer, the status of the subsystem layer node and function layer node is set according to the status of the attached stand-alone node, and is consistent with the status setting of the attached node; The "Satellite number + operation risk" node in the satellite layer is set to 5 states: "Satellite normal operation", "Important short-term unplanned interruption", "General short-term unplanned interruption", "Important long-term unplanned interruption" and "General long-term unplanned interruption".

8. A satellite operation risk quantitative assessment method according to claim 1, characterized in that: The setting method of the conditional probability table for the series relationship is: All parent nodes and child nodes operate normally. If and only if one parent node fails, the child node fails.

9. A satellite operation risk quantitative assessment method according to claim 1, characterized in that: The conditional probability table of the parallel relationship is set as follows: if any parent node operates normally, the child node operates normally; if and only if all parent nodes fail, the child node fails.

10. A satellite operation risk quantitative assessment method according to claim 1, characterized in that: For different parent nodes under the same child node, if there is a redundant backup relationship between different parent nodes, the redundant backup includes cold backup and hot backup; The conditional probability table of cold backup is set as follows: if any parent node is operating normally, the child node is operating normally. If and only if all working parent nodes and the parent node for cold backup fail, the child node fails. If and only if the working parent node fails and the parent node for cold backup needs to be switched to work, the child node has a certain failure probability due to different switching switches. The conditional probability table of hot backup is set as follows: if any parent node operates normally, the child node operates normally; if and only if all working parent nodes and the parent node serving as hot backup fail, the child node fails.

Images