Satellite operation risk quantitative evaluation model construction method

Abstract

The invention relates to a satellite operation risk quantitative evaluation model construction method. The method comprises the following steps: constructing an event tree model of a satellite; constructing a fault tree of the satellite; converting the satellite fault tree model into a satellite operation risk quantitative evaluation model by using a Bayesian network modeling tool according to an event series-parallel relationship in the satellite fault tree model; setting the states of all nodes in the satellite operation risk quantitative evaluation model according to the in-orbit fault type of the single machine and the cascade relation of the nodes in the satellite operation risk quantitative evaluation model; according to AND gate and OR gate relations of events in the satellite fault tree model, setting a conditional probability table for nodes with a connection relation according to a series-parallel connection logic relation;

Description

Technical Field

[0001] The invention belongs to the technical field of navigation satellite operation risk assessment on-orbit, and relates to a method for constructing a satellite operation risk quantitative assessment model. Background Art

[0002] The structure of the navigation satellite system is complex. In order to ensure the success and safety of the mission, early engineering and technical personnel often use the "margin design" method to ensure the reliability and safety of the satellite system. Qualitative analysis methods such as "failure mode and effect analysis" are used to provide sufficient information for the margin design of each key factor of the system, and to ensure the safety and reliability of the system by providing a sufficiently large margin for each key component. However, qualitative analysis methods often find it difficult to estimate the probability of an accident in a complex engineering system, and cannot fully and accurately characterize the overall risk of the system. At the same time, due to the complexity and variability of the aerospace environment and the difficulty in integrating fault information of products at different levels, there is a high degree of uncertainty in the system risk propagation path, and it is difficult to grasp the correlation between the impact of faults between different units.

[0003] At present, the satellite operation risk assessment model is not sophisticated enough, and there are interactive influences between satellite units and subsystems, making it difficult to comprehensively and accurately quantify and assess satellite operation risks. Summary of the invention

[0004] The technical problem solved by the present invention is: to overcome the shortcomings of the prior art, propose a method for constructing a satellite operation risk quantitative assessment model, construct a satellite operation risk quantitative assessment model, and combine the satellite on-orbit operation data to realize the satellite operation risk quantitative assessment.

[0005] The solution of the present invention is: a method for constructing a satellite operation risk quantitative assessment model, the method comprising the following steps:

[0006] S1. Construct an event tree of the satellite. The event tree of the satellite is a model composed of multiple event chains. The event chain model takes a single machine failure as the primary event, the single machine or subsystem affected by the single machine failure as the intermediate event, and the satellite system operation status as the consequence event. The event chain model represents the path that will lead to different consequence events in the satellite system.

[0007] S2. Constructing the fault tree of the satellite: Summarizing all event tree models in the satellite to form the basic structure of the satellite fault tree model. Based on the basic structure of the satellite fault tree model, the primary event or intermediate event with backup in the satellite event chain is used as the top event to perform separate fault modeling. The separately established fault model is attached to the primary event or intermediate event, and the basic structure of the satellite fault tree model is expanded to obtain a complete satellite fault tree model.

[0008] S3. According to the series-parallel relationship of events in the satellite fault tree model, the satellite fault tree model is converted into a satellite operation risk quantitative assessment model using a Bayesian network modeling tool; the satellite operation risk quantitative assessment model includes satellite layer nodes, function layer nodes, subsystem layer nodes and single machine layer nodes from top to bottom;

[0009] S4. According to the set of consequence events in the satellite event tree model, the satellite layer node status is determined; according to the on-orbit failure type of the single machine and the cascade relationship of the nodes in the satellite operation risk quantitative assessment model, the status of other layer nodes in the satellite operation risk quantitative assessment model is set;

[0010] S5. According to the AND gate and OR gate relationship of each event in the fault tree model, the nodes with connection relationship are set up into a conditional probability table according to the series-parallel logic relationship.

[0011] Preferably, the event tree construction process of the satellite is as follows:

[0012] S1.1. Sort out the internal structure of the satellite and identify each satellite failure as the primary cause event;

[0013] S1.2. Starting from the initial event, identify the subsystems and systems to which the failure risk extends step by step as intermediate events;

[0014] S1.3. List the two branch states of whether the primary event and the intermediate event have failed. The different state combinations of the related events form different paths. The different paths will lead to different consequence events in the satellite system, and multiple event chains are obtained, thus forming an event tree model with a single fault as the primary event.

[0015] S1.4. Repeat steps S1.2 to S1.3 for each faulty unit on the satellite, and summarize to obtain a satellite event tree model.

[0016] Preferably, the satellite fault tree model includes bottom events, intermediate events and top events, and the method for constructing the basic structure of the fault tree model is as follows:

[0017] The base event of the satellite fault tree model is the set of primary cause events in the satellite event tree model;

[0018] The intermediate events of the satellite fault tree model are the collection of intermediate events in the satellite event tree model;

[0019] The top event of the satellite fault tree model is the satellite;

[0020] According to the propagation path of event risk in the event tree model, the fault tree model connects the events connected in series in the event chain model into events with component inclusion relationships in a bottom-up order, and connects the component events to the component events;

[0021] If event A or event B is associated with the same event C in two event chain models, then in the fault tree model, event A and event B are in a series relationship with event C, and event A and event B are connected to event C through an OR gate.

[0022] Preferably, a fault tree model with primary events and intermediate events as top events in a backup situation is established according to the redundant backup relationship of a single machine, and the events corresponding to the two single machines of the redundant backup are connected using an AND gate.

[0023] Preferably, in step S3, the process of establishing the satellite operation risk quantitative assessment model is as follows:

[0024] S3.1. Extract the bottom events and intermediate events in the satellite fault tree model as nodes in the Bayesian network, and place and name each event in the Bayesian network according to its level in the satellite fault tree model to form a satellite operation risk assessment model;

[0025] S3.2. According to the risk propagation path in the fault tree model, the nodes with component-inclusion relationship between the various levels of the satellite operation risk assessment model are connected; the component node is defined as the parent node, the component node is defined as the child node, and the parent node points to the child node;

[0026] S3.2. Convert the AND and OR gate relationships in the fault tree model into the series-parallel relationships of the satellite operation risk assessment model, specifically: there is a series relationship between the single-machine node and the subsystem node, between the subsystem node and the functional node, and between the functional node and the satellite node; there is a parallel relationship between the main and backup machines under the same single machine, and there is a parallel relationship between different types of single machines with functional backup in the subsystem layer.

[0027] Preferably, the naming rules of the satellite operation risk assessment model are as follows:

[0028] The satellite layer includes 1 node, which is named according to "satellite number + operational risk";

[0029] The functional layer includes three nodes, named "platform", "payload" and "intersatellite link";

[0030] Subsystem layer: According to the actual configuration of the satellite, select the subsystem under each functional node and name it using the subsystem name;

[0031] The single machine layer selects the single machine under each subsystem node according to the actual configuration of the satellite and names it after the single machine;

[0032] In the case of a redundant backup machine, a specific redundant backup machine is mounted under the machine, and is named with the primary copy + machine name or the backup + machine name.

[0033] Preferably, according to the type of single-machine on-orbit failure, the method for setting the status of each node of the satellite operation risk assessment model is:

[0034] For mechanical, electronic, electrical and comprehensive single machines, the single machine status is divided into two types in the satellite operation risk assessment model according to whether it can be recovered after a fault occurs, namely: Type 1, divided into two states, including state 0: normal operation and state 1: permanent fault; Type 2, divided into three states, including state 0: normal operation, state 1: recoverable fault and state 2: permanent fault;

[0035] For consumable machines, the machines can be divided into three states according to the consumption rate of consumable materials, including state 0: normal operation, state 1: abnormal consumption and state 2: exhaustion;

[0036] At the subsystem layer and the function layer, the status of the subsystem layer nodes and the function layer nodes is set according to the status of the subordinate stand-alone nodes, and is consistent with the status setting of the subordinate nodes.

[0037] The "Satellite Number + Operation Risk" node in the satellite layer is set to 5 states: "Normal operation of satellite", "Important short-term unplanned interruption", "General short-term unplanned interruption", "Important long-term unplanned interruption" and "General long-term unplanned interruption".

[0038] Preferably, the setting method of the setting conditional probability table of the series relationship is:

[0039] All parent nodes and child nodes operate normally. If and only if one parent node fails, the child node fails.

[0040] Preferably, the conditional probability table of the parallel relationship is set as follows: if any parent node operates normally, the child node operates normally; if and only if all parent nodes fail, the child node fails.

[0041] Preferably, for different parent nodes under the same child node, if there is a redundant backup relationship between different parent nodes, the redundant backup includes cold backup and hot backup;

[0042] The conditional probability table of cold backup is set as follows: if any parent node is running normally, the child node is running normally. If and only if all working parent nodes and the parent node for cold backup fail, the child node fails. If and only if the working parent node fails and the parent node for cold backup needs to be switched to work, the child node has a certain failure probability due to different switching switches, among which the failure probability of mechanical switching switches is 0.004; the failure probability of electronic switching switches is 0.003; the failure probability of hybrid switching switches is 0.001.

[0043] The conditional probability table of hot backup is set as follows: if any parent node operates normally, the child node operates normally; if and only if all working parent nodes and the parent node serving as hot backup fail, the child node fails.

[0044] The beneficial effects of the present invention compared with the prior art are:

[0045] (1) The present invention realizes the analysis and sorting of the complex structure of the satellite system by adopting methods such as event chain modeling, fault tree modeling and risk modeling. Compared with the qualitative analysis method in the prior art, the satellite refined modeling process is simplified while ensuring that the satellite configuration information remains unchanged;

[0046] (2) A risk event chain model is constructed by comprehensively using event trees, fault trees and other methods. The Bayesian network is used to complete the model conversion based on comprehensive consideration of factors such as single-machine structure / functional redundancy, node polymorphism and uncertainty expression. A satellite operation risk quantitative assessment model is then constructed, and the setting of the model node status and conditional probability table is completed to provide model support for the quantitative assessment of satellite operation risks.

[0047] (3) By using the Bayesian network to build a satellite operation risk quantitative assessment model, a more accurate quantitative assessment of the risk of a single machine or satellite system can be made by inputting data. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A flow chart is constructed for the satellite operation risk quantification assessment model of the present invention;

[0049] Figure 2 This is an event tree of the atomic clock group according to an embodiment of the present invention;

[0050] Figure 3 This is a fault tree model of an atomic clock group according to an embodiment of the present invention;

[0051] Figure 4 A fault tree model according to an embodiment of the present invention;

[0052] Figure 5 The hot backup gate of the embodiment of the present invention is converted into a Bayesian network;

[0053] Figure 6 The cold backup gate of the embodiment of the present invention is transformed into a Bayesian network;

[0054] Figure 7 Conversion of the functional backup gate to the Bayesian network in the embodiment of the present invention

[0055] Figure 8 The satellite system layer of the satellite operation risk quantitative assessment model according to the embodiment of the present invention;

[0056] Fig. 9It is the inter-satellite link function layer branch of the satellite operation risk quantification assessment model according to the embodiment of the present invention;

[0057] Fig.10 It is a functional layer branch of the satellite operation risk quantification assessment model platform according to an embodiment of the present invention;

[0058] Fig.11 This is a branch of the payload function layer of the satellite operation risk quantification assessment model in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The present invention will be further described below in conjunction with the embodiments.

[0060] Example:

[0061] Taking a navigation satellite as an example, the steps of the present invention are described in detail:

[0062] like Figure 1 As shown, a method for constructing a satellite operation risk quantitative assessment model provided by the present invention comprises the following steps:

[0063] S1. Construct an event tree of the satellite. The event tree of the satellite is a model composed of multiple event chains. The event chain model takes a single machine failure as the initial cause event, the single machine or subsystem affected by the single machine failure as the intermediate event, and the satellite operation consequence state as the consequence event. The event chain model represents the path that will cause different consequence events to occur in the satellite system.

[0064] S2. Constructing the fault tree of the satellite: Summarizing all event tree models in the satellite to form the basic structure of the satellite fault tree model. Based on the basic structure of the satellite fault tree model, the primary event or intermediate event with backup in the satellite event chain is used as the top event to perform separate fault modeling. The separately established fault model is attached to the primary event or intermediate event, and the basic structure of the satellite fault tree model is expanded to obtain a complete satellite fault tree model.

[0065] S3. According to the series-parallel relationship of events in the satellite fault tree model, the satellite fault tree model is converted into a satellite operation risk quantitative assessment model using a Bayesian network modeling tool; the satellite operation risk quantitative assessment model includes satellite layer nodes, function layer nodes, subsystem layer nodes and single machine layer nodes from top to bottom;

[0066] S4. According to the set of consequence events in the satellite event tree model, the satellite layer node status is determined; according to the on-orbit failure type of the single machine and the cascade relationship of the nodes in the satellite operation risk quantitative assessment model, the status of other layer nodes in the satellite operation risk quantitative assessment model is set;

[0067] S5. According to the AND gate and OR gate relationship of each event in the fault tree model, the nodes with connection relationship are set up with a conditional probability table according to the series-parallel logical relationship to complete the model construction.

[0068] 1. Establish an event tree model

[0069] Event chain modeling is an inductive process, which is completed by constructing an event sequence diagram or event tree for each type of primary event. The event sequence diagram can be converted into an event tree, and each different path in the event tree represents a different event chain. The primary event is the beginning of the event chain, which generally refers to an internal system failure or external event that may cause system safety consequences. For each primary event, the sequence and success / failure response of its subsequent events are modeled using an event sequence diagram or event tree. These events are the intermediate events of the event chain, which include preventive control measures that prevent the primary event from developing into potential adverse consequences, involving structures, systems, components, and human behavior. Intermediate events generally occur in a certain order. The consequence state refers to the different results caused by the occurrence or non-occurrence of the primary event and the intermediate event. The top level of the event tree from left to right is the primary event, the intermediate event, and the consequence state. Starting from the primary event at the upper left of the event tree, progressing to the right, you will encounter a branch below the "intermediate event". The path from this point downward represents the failure of the "intermediate event"; the path to the right represents the success of the "intermediate event". Different branches will eventually lead to different consequence states.

[0070] Event chain modeling is mainly divided into two steps: determining the initial cause event and building an event tree.

[0071] (1) Determine the initial cause

[0072] The internal structure of the navigation satellite was sorted out, and the failure of each component of the satellite was taken as the primary cause of the event.

[0073] (2) Constructing an event tree

[0074] The event tree of the satellite is a model composed of multiple event chains. The event chain model takes the faulty single machine as the initial cause event, the single machine or subsystem affected by the single machine failure as the intermediate event, and the satellite operation consequence state as the consequence event; the event chain model represents the path that will lead to different consequence events in the satellite system.

[0075] The event tree construction process of the satellite is as follows:

[0076] S1.1. Sort out the internal structure of the satellite and identify each satellite failure as the primary cause event;

[0077] S1.2. Starting from the initial event, identify the subsystems and systems to which the failure risk extends step by step as intermediate events;

[0078] S1.3. List the two branch states of whether the primary event and the intermediate event have failed. The different state combinations of the related events form different paths. The different paths will lead to different consequence events in the satellite system, and multiple event chains are obtained, thus forming an event tree model with a single fault as the primary event.

[0079] S1.4. Repeat steps S1.2 to S1.3 for each faulty unit on the satellite, and summarize to obtain a satellite event tree model.

[0080] If a single machine fails, the risk will be transmitted from the single machine, subsystem, satellite on-orbit function to the satellite system step by step, and finally affect the satellite on-orbit operation. Different single machine failures will cause the satellite to be in different satellite operation consequence states. The failures of the same type of single machine can be regarded as the same type of primary cause events, and the subsystem and satellite on-orbit function are intermediate events. Each type of primary cause event can construct an event tree model.

[0081] Taking the atomic clock of a navigation satellite as an example, the atomic clock group failure is identified as the primary event. If the atomic clock group fails, the risk will be transmitted upward step by step to the time-frequency subsystem, payload, and satellite system. The time-frequency subsystem and payload are intermediate events, and the operating status of the satellite system is the consequence event. Different paths will lead to different consequence events in the satellite system. The atomic clock event tree is as follows: Figure 2 In the figure, “Y” represents a failure and “N” represents no failure. Each path represents an event chain.

[0082] Other single-machine event trees of navigation satellites can be constructed according to the above method. The navigation satellite event tree model is composed of the event trees of each single machine.

[0083] The satellite operation consequence states include the following five categories:

[0084] “Satellite Normal Operation”, “Major Short-Term Unplanned Outage”, “General Short-Term Unplanned Outage”, “Major Long-Term Unplanned Outage” and “General Long-Term Unplanned Outage”.

[0085] 2. Establish a fault tree model

[0086] A fault tree is a graphical representation of a series of logical relationships. It can express both system-level failures and component-level failures. It is one of the most commonly used methods to link "component-level" failure information with "system-level" failure information. A fault tree can be built on the basis of a combination of basic events with "failure of a certain initial event" or "failure of a certain intermediate event" as the top event. This can transform an event chain described by intermediate events into an event chain described by basic events.

[0087] The fault tree can be used to model the faults of various intermediate events or initial events that need further analysis on the event chain constructed during satellite operation. In the process of decomposing the fault tree step by step, it can be stopped when it is decomposed to the single-machine level. Combined with the satellite event chain, a satellite fault tree model can be finally constructed.

[0088] In this embodiment, all event tree models in the satellite are summarized to form a basic structure of a satellite fault tree model. On the basis of the basic structure of the satellite fault tree model, the primary event or intermediate event with a backup condition in the satellite event chain is used as a top event to perform separate fault modeling, and the separately established fault model is attached to the primary event or intermediate event, and the basic structure of the satellite fault tree model is expanded to obtain a complete satellite fault tree model.

[0089] The satellite fault tree model includes bottom events, intermediate events and top events. The basic structure of the satellite fault tree model is established in the following steps:

[0090] First, for each intermediate event in the event chain that needs further analysis, record the preceding intermediate event and the corresponding initial cause event to determine the initial boundary conditions for event evaluation;

[0091] The base event of the satellite fault tree model is the set of primary cause events in the satellite event tree model;

[0092] The intermediate events of the satellite fault tree model are the collection of intermediate events in the satellite event tree model;

[0093] The top event of the satellite fault tree model is the satellite;

[0094] Secondly, the fault tree and other methods are used to model the faults of each intermediate event in the event chain that needs further analysis. Depending on the different systems or functions being modeled, the fault tree may have multiple levels:

[0095] According to the propagation path of event risk in the event tree model, the fault tree model connects the events connected in series in the event chain model into events with component inclusion relationships in a bottom-up order, and connects the component events to the component events;

[0096] If event A or event B is associated with the same event C in two event chain models, then in the fault tree model, event A and event B are in a series relationship with event C, and event A and event B are connected to event C through an OR gate.

[0097] The fault tree model with the initial cause event and the intermediate event as the top event with the backup situation is established according to the redundant backup relationship of the single machine, and the events corresponding to the two single machines of the redundant backup are connected by an AND gate.

[0098] Finally, associate the top event of the fault tree with the corresponding event on the event tree.

[0099] Taking the navigation satellite atomic clock as an example, since the atomic clock has 4 backups and 3, 1 hot backup, and 2 cold backups, the fault modeling of the atomic clock of the initial event can be carried out according to the redundant backup situation, such as Figure 3 shown.

[0100] In the atomic clock group fault tree, clock 1 is the working clock, clock 2 is the hot backup clock, and clocks 3 and 4 are both cold backup clocks. First, it is determined that both clocks 1 and 2 are faulty before node 1 fails. Therefore, clocks 1 and 2 are connected to node 1 using an AND gate. Similarly, node 1 and clock 3 are connected to node 2 using an AND gate, and node 2 and clock 4 are connected to the atomic clock group using an AND gate. According to the above method, fault modeling can be performed on the initial cause events and intermediate events with backup conditions in the navigation satellite event chain model.

[0101] By summarizing all event trees with different initial events but the same intermediate events and consequence events in navigation satellites, and combining them with the fault tree model constructed with the initial event or intermediate event as the top event, we can finally get the navigation satellite fault tree model, such as Figure 4 shown.

[0102] 3. Establish a quantitative assessment model for satellite operation risks

[0103] According to the series and parallel relationship of events in the satellite fault tree model, the Bayesian network modeling tool is used to convert the satellite fault tree model into a quantitative assessment model for satellite operation risks:

[0104] S3.1. Extract the bottom events and intermediate events in the navigation satellite fault tree model as nodes in the Bayesian network, and place and name the events in the Bayesian network one by one according to the level of the satellite fault tree model, so as to form a satellite operation risk assessment model. The satellite operation risk quantitative assessment model includes satellite layer nodes, function layer nodes, subsystem layer nodes and single machine layer nodes from top to bottom;

[0105] S3.2. According to the risk propagation path in the fault tree model, the nodes with component-inclusion relationship between the various levels of the satellite operation risk assessment model are connected; the component node is defined as the parent node, the component node is defined as the child node, and the parent node points to the child node;

[0106] S3.3. Convert the AND and OR gate relationships in the fault tree model into the series-parallel relationships of the satellite operation risk assessment model, specifically: there is a series relationship between the single machine node and the subsystem node, between the subsystem node and the functional node, and between the functional node and the satellite node; there is a parallel relationship between the main and backup machines under the same single machine, and there is a parallel relationship between different types of single machines with functional backup in the subsystem layer.

[0107] The naming rules of the satellite operation risk assessment model are as follows:

[0108] The satellite layer includes 1 node, which is named according to "satellite number + operational risk";

[0109] The functional layer includes three nodes, named "platform", "payload" and "intersatellite link";

[0110] Subsystem layer: According to the actual configuration of the satellite, select the subsystem under each functional node and name it using the subsystem name;

[0111] The single machine layer selects the single machine under each subsystem node according to the actual configuration of the satellite and names it after the single machine;

[0112] In the case of a redundant backup machine, a specific redundant backup machine is mounted under the machine, and is named with the primary copy + machine name or the backup + machine name.

[0113] In this embodiment, the satellite operation risk quantitative assessment model includes a satellite layer, a functional layer, a subsystem layer, and a single machine layer from top to bottom; the satellite layer includes 1 node, which is named according to "satellite number + operation risk", and the functional layer includes 3 nodes, which are named "platform", "payload", and "intersatellite link" respectively. The subsystem layer is under each functional node, and according to the actual configuration of the satellite, a subsystem or a single machine that can support the satellite to realize the corresponding function is selected. The "Platform" node includes 5 parent nodes, named "Control Subsystem", "Propulsion Subsystem", "Power Subsystem", "Measurement and Control Subsystem" and "Integrated Electronic Subsystem" respectively; the "Payload" node includes 5 parent nodes, named "Injection Subsystem", "Navigation Mission Subsystem", "Broadcast Subsystem", "Antenna Subsystem" and "Time and Frequency Subsystem" respectively; the "Intersatellite Link" node includes 3 parent nodes, named "Intersatellite Transceiver", "Ka Antenna" and "Ka Power Supply" respectively. The single machine layer is under each subsystem node. According to the actual configuration of the satellite, the key single machines that constitute each subsystem are selected, mainly referring to the electronic product type single machines with random failures in orbit, the wear and tear failure type single machines with performance degradation trends, and the comprehensive failure type single machines with random + wear and tear failures; in addition, for the single machines with redundant backups in the single machine layer, it is necessary to hang the corresponding redundant backup single machines below.

[0114] Between each level, if there is a relationship between the upper node and the lower node, a connection line needs to be added from the lower node to the upper node. The relationship includes composition relationship, redundant backup relationship, and uncertain relationship, specifically referring to the baseband synthesizer pointing to the atomic clock in the single machine layer.

[0115] 4. Set the node status of the satellite operation risk quantitative assessment model

[0116] According to the on-orbit fault type of a single machine and the cascade relationship of the nodes in the satellite operation risk quantitative assessment model, the status of all nodes in the satellite operation risk quantitative assessment model is set;

[0117] Set the status of each node in the model according to whether the on-orbit failure of a single machine is recoverable.

[0118] For mechanical, electronic, electrical and comprehensive single machines, the single machine status is divided into two types in the satellite operation risk assessment model according to whether it can be recovered after a fault occurs, namely: Type 1, divided into two states, including state 0: normal operation and state 1: permanent fault; Type 2, divided into three states, including state 0: normal operation, state 1: recoverable fault and state 2: permanent fault;

[0119] For consumable machines, the machines can be divided into three states according to the consumption rate of consumable materials, including state 0: normal operation, state 1: abnormal consumption and state 2: exhaustion;

[0120] At the subsystem layer and the function layer, the status of the subsystem layer nodes and the function layer nodes is set according to the status of the subordinate stand-alone nodes, and is consistent with the status setting of the subordinate nodes.

[0121] Table 1 Single machine failure model

[0122]

[0123] The state of the satellite layer is set to the set of consequence events in the satellite event tree model;

[0124] In this embodiment, the "satellite number + operation risk" node in the satellite layer is set to "normal satellite operation", "important short-term unplanned interruption", "general short-term unplanned interruption", "important long-term unplanned interruption" and "general long-term unplanned interruption" for a total of 5 states;

[0125] 5. Set up the node conditional probability table of the satellite operation risk quantitative assessment model

[0126] According to the AND gate and OR gate relationship of each event in the navigation satellite fault tree model, the nodes with connection relationship are set up with conditional probability tables according to the series and parallel logical relationships.

[0127] The setting method of the conditional probability table for the series relationship is:

[0128] If any parent node operates normally, the child node operates normally. If and only if a parent node fails, the child node fails.

[0129] The conditional probability table of the parallel relationship is set as follows: if any parent node operates normally, the child node operates normally; if and only if all parent nodes fail, the child node fails.

[0130] For different parent nodes under the same child node, if there is a redundant backup relationship between different parent nodes, the redundant backup includes cold backup and hot backup;

[0131] The conditional probability table of cold backup is set as follows: if any parent node is running normally, the child node is running normally. If and only if all working parent nodes and the parent node for cold backup fail, the child node fails. If and only if the working parent node fails and the parent node for cold backup needs to be switched to work, the child node has a certain failure probability due to different switching switches, among which the failure probability of mechanical switching switches is 0.004; the failure probability of electronic switching switches is 0.003; the failure probability of hybrid switching switches is 0.001.

[0132] The conditional probability table of hot backup is set as follows: if any parent node operates normally, the child node operates normally; if and only if all working parent nodes and the parent node serving as hot backup fail, the child node fails.

[0133] In the actual operation of satellites, it is necessary to consider the redundant design of some functions / single machines to increase reliability, the problem of whether different single machines can be recovered when failure occurs, and the influence of the status of different single machines in special subsystems. Therefore, in view of the above phenomenon, in the process of constructing a satellite operation risk assessment model, it is necessary to focus on the following factors, including single machine structural redundancy and functional redundancy, node polymorphism and uncertainty expression.

[0134] The following mainly introduces the modeling process of these three elements, namely, single-machine structure and functional redundancy, node polymorphism, and uncertain expression, using the Bayesian network modeling tool.

[0135] One is in terms of functional redundancy of single-machine structure.

[0136] (1) Single machine redundant backup

[0137] In order to improve the reliability of satellites, in terms of satellite structure design, many key single machines will adopt backup measures, among which dual-machine backup is a common backup method, including cold backup and hot backup. In terms of satellite function design, functional redundancy backup measures will be taken between subsystems / single machines.

[0138] a) Transformation of dual-machine hot backup gate into Bayesian network

[0139] Assume that system A consists of single machine K1 and single machine K2. Single machine K1 is the working single machine, single machine K2 is the backup single machine, and single machine K2 performs hot backup for single machine K1. Then the fault tree of the system and the transformed Bayesian network are as follows: Figure 5 shown.

[0140] Assuming that a single node has two states, the conditional probability table corresponding to its Bayesian network is as follows:

[0141] Table 2 Hot backup gate Bayesian network conditional probability table

[0142]

[0143] b) Transformation of dual-machine cold backup gate into Bayesian network

[0144] Assume that system A consists of single machine K1 and single machine K2, single machine K1 is a working single machine, and single machine K2 performs cold backup for single machine K1. Then the fault tree and transformed Bayesian network of the system are as follows: Figure 6 shown.

[0145] Assuming that a single node is set to two states, the conditional probability table corresponding to its Bayesian network is as follows:

[0146] Table 3 Cold backup door Bayesian network conditional probability table (mechanical switch)

[0147]

[0148] Table 4 Cold backup door Bayesian network conditional probability table (electronic switching switch)

[0149]

[0150] Table 5 Cold backup door Bayesian network conditional probability table (comprehensive switching switch)

[0151]

[0152] (2) Expression of functional backup in Bayesian networks

[0153] When providing services, satellites back up some functions through subsystem / single-machine backup. Considering the satellite's main functions, even if a single machine fails, it will not affect the normal operation or service of the satellite. Instead, it will switch to a different satellite working mode, that is, back up the corresponding functions. However, the change of the corresponding system configuration or working mode will still affect the satellite's working status and reliability.

[0154] Assume that system A consists of a single machine K and a single machine S. Both single machines K and S are working machines and perform the same functions and back up each other. Then the Bayesian network is as follows: Figure 7 shown.

[0155] Assuming that the states of a single node include state 0: normal and state 1: failure, the conditional probability table corresponding to its Bayesian network is as follows:

[0156] Table 6 Function backup gate Bayesian network conditional probability table

[0157]

[0158] The second is in the node polymorphism setting.

[0159] By sorting out the internal structure and failure mechanism of the single machine, the single machine is roughly divided into three categories. One category is the mechanical single machine, which is irrecoverable after a failure. In the model, the single machine node is set to two states, namely state 0: normal operation and state 1: permanent failure.

[0160] Assume that system A consists of a single machine K and a single machine S, and that single machine K, single machine S and system A are all set to two states. Then the node conditional probability table in the Bayesian network is set as follows.

[0161] Table 7 Conditional probability table of system A (single machine K and single machine S are in series relationship)

[0162]

[0163] Table 8 Conditional probability table of system A (single machine K and single machine S are in parallel relationship)

[0164]

[0165]

[0166] The other type is a single machine with both mechanical and electronic parts, that is, there are two types of faults: recoverable faults and non-recoverable faults. In the model, this type of node is set to three states, namely state 0: normal operation, state 1: recoverable fault and state 2: resident fault.

[0167] Assuming that system A consists of a single machine K and a single machine S, and single machine K, single machine S and system A are all set to three states, the node conditional probability table in the Bayesian network is set as follows.

[0168] Table 9 Conditional probability table of system A (single machine K and single machine S are in series relationship)

[0169]

[0170] Table 10 Conditional probability table of system A (single machine K and single machine S are in parallel relationship)

[0171]

[0172] In summary, the child node should be determined according to the polymorphic setting of its parent node, that is, if the single machine under the subsystem has three states, the subsystem should also be set to three states; if the single machines under the subsystem are all in two states, the subsystem should be set to two states.

[0173] The third is the expression of node uncertainty.

[0174] The expression of node uncertainty is determined according to the specific situation of the single machine. Redundant backup is only for single machines with redundant design. Node polymorphism should be determined based on the failure mechanism of the single machine to determine whether a recoverable fault / permanent fault will occur. The expression of uncertainty should be determined based on whether there will be any interactive impact between specific single machines.

[0175] The node uncertainty expression in this implementation refers specifically to the relationship between the baseband synthesizer and the atomic clock.

[0176] Both "base frequency synthesizer" and "atomic clock" are set to four states, namely, state 0: normal operation, state 1: general recoverable fault, state 2: important recoverable fault, and state 3: permanent fault. The method of setting the conditional probability table is as follows: add an auxiliary judgment node, named "autonomous switching module", and set it to two states, namely, state 0: switch, state 1: do not switch; the "base frequency synthesizer" node points to the "autonomous switching module" node, and then the "autonomous switching module" node points to the "atomic clock" node. If and only if the "base frequency synthesizer" node is in the state of "important recoverable fault", the "autonomous switching module" node decides whether the "atomic clock" node switches abnormally from the state of "normal operation" to the state of "general recoverable fault".

[0177] The conditional probability table between the "Autonomous Switching Module" node and the "Baseband Synthesizer" node is set as:

[0178] Table 11 Conditional probability table between the "autonomous switching module" node and the "baseband synthesizer" node

[0179]

[0180] The conditional probability table between the "atomic clock" node and the "autonomous switching module" node is set as:

[0181] Table 12 Conditional probability table settings between the "atomic clock" node and the "autonomous switching module" node

[0182] Autonomous switching module 0 1 Atomic Clock - State 0 1 0 Atomic Clock - State 1 0 1 Atomic Clock - State 2 0 0 Atomic Clock - State 3 0 0

[0183] In summary, this embodiment takes the navigation satellite as the modeling object, uses the Bayesian network modeling tool, completes the conversion to the Bayesian network based on the constructed satellite fault tree model, and constructs the navigation satellite operation risk assessment model as follows: Figure 8 to Figure 11 shown.

[0184] Although the present invention has been disclosed as above in the form of a preferred embodiment, it is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications to the technical solution of the present invention by using the methods and technical contents disclosed above without departing from the spirit and scope of the present invention. Therefore, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope of the technical solution of the present invention.

Claims

1. A method for constructing a satellite operation risk quantitative assessment model, characterized in that The steps include: S1. Construct an event tree of the satellite. The event tree of the satellite is a model composed of multiple event chains. The event chain model takes a single machine failure as the primary cause event, the single machine or subsystem affected by the single machine failure as the intermediate event, and the satellite operation consequence state as the consequence event; The event chain model represents the paths that lead to different consequence events in the satellite system; S2. Constructing the fault tree of the satellite: Summarizing all event tree models in the satellite to form the basic structure of the satellite fault tree model. Based on the basic structure of the satellite fault tree model, the primary event or intermediate event with backup in the satellite event chain is used as the top event to perform separate fault modeling. The separately established fault model is attached to the primary event or intermediate event, and the basic structure of the satellite fault tree model is expanded to obtain a complete satellite fault tree model. S3. Based on the series and parallel relationship of events in the satellite fault tree model, the Bayesian network modeling tool is used to convert the satellite fault tree model into a quantitative assessment model for satellite operation risks; The satellite operation risk quantitative assessment model includes satellite layer nodes, function layer nodes, subsystem layer nodes and single machine layer nodes from top to bottom; S4. According to the set of consequence events in the satellite event tree model, the satellite layer node status is determined; according to the on-orbit failure type of the single machine and the cascade relationship of the nodes in the satellite operation risk quantitative assessment model, the status of other layer nodes in the satellite operation risk quantitative assessment model is set; S5. According to the AND gate and OR gate relationship of each event in the fault tree model, the nodes with connection relationship are set up with a conditional probability table according to the series-parallel logical relationship to complete the model construction.

2. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: The event tree construction process of the satellite is as follows: S1.

1. Sort out the internal structure of the satellite and identify each satellite failure as the primary cause event; S1.

2. Starting from the initial event, identify the subsystems and systems to which the failure risk extends step by step as intermediate events; S1.

3. List the two states of whether the primary event and the intermediate event have failed. The different states of the related events form different paths. The different paths will lead to different consequence events in the satellite system, and multiple event chains are obtained, thus forming an event tree model with a single fault as the primary event. S1.

4. Repeat steps S1.2 to S1.3 for each faulty unit on the satellite, and summarize to obtain a satellite event tree model.

3. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: The satellite fault tree model includes bottom events, intermediate events and top events. The method for constructing the basic structure of the fault tree model is as follows: The base event of the satellite fault tree model is the set of primary cause events in the satellite event tree model; The intermediate events of the satellite fault tree model are the collection of intermediate events in the satellite event tree model; The top event of the satellite fault tree model is the satellite; According to the propagation path of event risk in the event tree model, the fault tree model connects the events connected in series in the event chain model into events with component inclusion relationships in a bottom-up order, and connects the component events to the component events; If event A or event B is associated with the same event C in two event chain models, then in the fault tree model, event A and event B are in a series relationship with event C, and event A and event B are connected to event C through an OR gate.

4. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: The fault tree model with the initial cause event and the intermediate event as the top event with the backup situation is established according to the redundant backup relationship of the single machine, and the events corresponding to the two single machines of the redundant backup are connected by an AND gate.

5. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: In step S3, the process of establishing the satellite operation risk quantitative assessment model is as follows: S3.

1. Extract the bottom events and intermediate events in the satellite fault tree model as nodes in the Bayesian network, and place and name each event in the Bayesian network according to its level in the satellite fault tree model to form a satellite operation risk assessment model; S3.

2. Connect the nodes with component inclusion relationships between the various levels of the satellite operation risk assessment model according to the risk propagation path in the fault tree model; The constituent nodes are defined as parent nodes, the constituent nodes are defined as child nodes, and the parent nodes point to the child nodes; S3.

2. Convert the AND and OR gate relationships in the fault tree model into the series-parallel relationships of the satellite operation risk assessment model, specifically: there is a series relationship between the single-machine node and the subsystem node, between the subsystem node and the functional node, and between the functional node and the satellite node; there is a parallel relationship between the main and backup machines under the same single machine, and there is a parallel relationship between different types of single machines with functional backup in the subsystem layer.

6. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: The naming rules of the satellite operation risk assessment model are as follows: The satellite layer includes 1 node, which is named according to "satellite number + operational risk"; The functional layer includes three nodes, named "platform", "payload" and "intersatellite link"; Subsystem layer: According to the actual configuration of the satellite, select the subsystem under each functional node and name it using the subsystem name; The single machine layer selects the single machine under each subsystem node according to the actual configuration of the satellite and names it after the single machine; In the case of a redundant backup machine, a specific redundant backup machine is mounted under the machine, and is named with the primary copy + machine name or the backup + machine name.

7. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: According to the type of on-orbit fault of a single machine, the method for setting the state of each node of the satellite operation risk assessment model is as follows: for mechanical, electronic, electrical and comprehensive single machines, according to whether they can be recovered after a fault occurs, the state of the single machine is divided into two types in the satellite operation risk assessment model for setting, namely: Type 1, divided into two states, including state 0: normal operation and state 1: permanent fault; Type 2, divided into three states, including state 0: normal operation, state 1: recoverable fault and state 2: permanent fault; For consumable machines, the machines can be divided into three states according to the consumption rate of consumable materials, including state 0: normal operation, state 1: abnormal consumption and state 2: exhaustion; At the subsystem layer and function layer, the status of the subsystem layer node and function layer node is set according to the status of the attached stand-alone node, and is consistent with the status setting of the attached node; The "Satellite number + operation risk" node in the satellite layer is set to 5 states: "Satellite normal operation", "Important short-term unplanned interruption", "General short-term unplanned interruption", "Important long-term unplanned interruption" and "General long-term unplanned interruption".

8. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: The setting method of the conditional probability table for the series relationship is: All parent nodes and child nodes operate normally. If and only if one parent node fails, the child node fails.

9. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: The conditional probability table of the parallel relationship is set as follows: if any parent node operates normally, the child node operates normally; if and only if all parent nodes fail, the child node fails.

10. The method for constructing a satellite operation risk quantitative assessment model according to claim 1, characterized in that: For different parent nodes under the same child node, if there is a redundant backup relationship between different parent nodes, the redundant backup includes cold backup and hot backup; The conditional probability table of cold backup is set as follows: if any parent node is operating normally, the child node is operating normally. If and only if all working parent nodes and the parent node for cold backup fail, the child node fails. If and only if the working parent node fails and the parent node for cold backup needs to be switched to work, the child node has a certain failure probability due to different switching switches. The conditional probability table of hot backup is set as follows: if any parent node operates normally, the child node operates normally; if and only if all working parent nodes and the parent node serving as hot backup fail, the child node fails.

Images