Redundancy management method for dual-redundancy discrete signals of airborne equipment

Abstract

The invention provides a redundancy management method for dual-redundancy discrete signals of airborne equipment, and belongs to the technical field of redundancy management of civil aircrafts, and the method specifically comprises the steps: carrying out the time synchronization processing of data received by a receiving end for two dual-redundancy channels according to the sending period of a data sending end, judging the validity of the data of the two channels, and carrying out the verification of the validity of the data of the two channels; performing comparative monitoring and voting on the two pieces of data with the same time label according to the data validity of the two channels; and recording and judging transient faults and continuous faults of the channels, continuing to monitor the channels which are judged as the continuous faults, and selecting to re-start the channels according to the effective recovery times of the channel data. Through the processing scheme provided by the invention, the problem that the dual-redundancy discrete input signal in the current airborne equipment cannot well position and recover the fault is solved, the task reliability of one-time fault safety can be realized, and the utilization rate of redundancy resources is improved.

Description

Technical Field

[0001] The present application relates to the field of redundancy management of civil aircraft, and in particular to a redundancy management method for dual-redundancy discrete signals of airborne equipment. Background Art

[0002] Dual redundancy management refers to selecting the signal for equipment operation from two signals with the same name through monitoring and voting to improve the mission reliability and safety of airborne equipment. Discrete signals are signals composed of more than two finite numbers of discrete values, such as flight phases, warning feedback, equipment working modes, etc.

[0003] In the related art, the dual-redundancy signals are compared and monitored, and the voting value to be output is selected according to the voting principle. When two valid signals are inconsistent and the cumulative number of times exceeds the fault counter threshold, the two signals will be simultaneously judged as permanent faults and isolated. At this time, the value of the previous cycle is often taken as the fail-safe value output to ensure the minimum safe operation performance of the system.

[0004] This fault handling method of isolating permanent faults and no longer monitoring them lacks a monitoring and recovery mechanism for fault signals, thus limiting the availability of signals and causing a waste of redundancy resources. In addition, selecting the previous cycle value as the fail-safe value output is difficult to adapt to scenarios where signals change continuously, and may provide erroneous signals to other related systems. Summary of the invention

[0005] In view of this, the present application provides a redundancy management method for dual-redundancy discrete signals of airborne equipment, which solves the problem that dual-redundancy discrete input signals in current airborne equipment cannot locate and recover faults well, can achieve single-failure safety mission reliability, and improve the utilization rate of redundancy resources.

[0006] The present application provides a method for redundancy management of dual-redundancy discrete signals of airborne equipment using the following technical solutions:

[0007] A redundancy management method for dual-redundancy discrete signals of airborne equipment comprises the following steps:

[0008] The two channels of dual redundancy perform time synchronization processing on the data received by the receiving end according to the sending cycle of the data sending end, and the data in the same sending cycle are given the same time tag;

[0009] Determine the validity of the two channel data;

[0010] Comparative monitoring and voting of two data with the same time tag according to the data validity of the two channels;

[0011] If the data of both channels are valid, compare whether the two data are equal. If they are equal, then the comparison monitoring is performed and the equal value is taken as the voting value. If they are not equal, the data of one channel is selected as the fail-safe value, and the other channel is recorded as a comparison monitoring instantaneous fault. The number of channel comparison monitoring instantaneous faults is counted. When the number exceeds the threshold, both channels are recorded as comparison monitoring continuous faults.

[0012] If the data of only one channel is valid, the data of the valid channel is directly taken as the voting value; the other channel is recorded as a self-monitoring instantaneous fault, and the number of self-monitoring instantaneous faults of the channel is counted; when the number of faults exceeds the threshold, the channel is recorded as a self-monitoring continuous fault;

[0013] If the data of both channels are invalid, one of the channels is selected as the fail-safe value, and both channels are recorded as self-monitoring instantaneous faults, and the number of self-monitoring channel failures is counted. When the number exceeds the threshold, both channels are recorded as self-monitoring continuous faults.

[0014] For channels that have been determined to have persistent faults, continue monitoring and choose to re-enable the channel based on the number of times the channel data is restored to validity.

[0015] Optionally, the method of counting the number of channel comparison monitoring instantaneous faults and recording both channels as comparison monitoring continuous faults when the number exceeds a threshold includes:

[0016] A comparison monitoring fault counter is set to count the number of times a comparison monitoring instantaneous fault occurs. After the sending end sends data each time, if a comparison monitoring instantaneous fault occurs, the comparison monitoring fault counter is increased by 1. If no comparison monitoring instantaneous fault occurs, the comparison monitoring fault counter is reduced by 1. When the count of the comparison monitoring fault counter exceeds the first preset value, it is recorded that both channels have a comparison monitoring continuous fault.

[0017] Optionally, the self-monitoring instantaneous fault includes a communication instantaneous fault and a data verification instantaneous fault; the method for determining the validity of the channel data includes:

[0018] Monitor the receiving frequency of the receiving end to determine whether there is a transient communication failure in the channel data;

[0019] Verify the received data to determine whether there is a data verification transient fault in the received data;

[0020] If there is no communication transient fault in the channel and no verification transient fault in the data, the channel data is valid.

[0021] Optionally, a communication fault counter and a verification fault counter are set on both channels;

[0022] The communication fault counter counts the instantaneous communication faults of the channel. Each time the sending end sends data and the receiving end does not receive the data, the communication fault counter increases by 1. When the receiving end receives the data normally, the communication fault counter decreases by 1. When the count of the communication fault counter exceeds the second preset value, the channel is recorded as a continuous communication fault.

[0023] The verification fault counter counts the instantaneous data verification faults. Each time the sending end sends data, the verification fault counter increases by 1 when the receiving end receives the data and there is an instantaneous data verification fault. The verification fault counter decreases by 1 when the data received by the receiving end is normal. When the count of the communication fault counter exceeds the third preset value, the channel is recorded as a continuous data verification fault.

[0024] Optionally, for a channel that has been determined to be in a persistent fault, the monitoring is continued, and the steps of selecting to re-enable the channel according to the number of times the channel data is restored to be valid include:

[0025] Each channel is provided with a first fault recovery counter, when the receiving end receives data normally, the first fault recovery counter is increased by 1, when the receiving end does not receive data, the first fault recovery counter is decreased by 1, when the first fault recovery counter exceeds a fourth preset value, the communication continuous fault is cancelled;

[0026] A second fault recovery counter is set for each channel. When the data received by the receiving end passes the data verification, the second fault recovery counter is increased by 1, otherwise the second fault recovery counter is decreased by 1. When the second fault recovery counter exceeds a fifth preset value, the data verification continuous fault is cancelled;

[0027] A third fault recovery counter is set for each channel. The third fault recovery counter is increased by 1 when the channel passes comparative monitoring. The third fault recovery counter is reduced by 1 when a comparative instantaneous monitoring fault occurs in the channel. When the fault recovery counter exceeds the sixth preset value, the comparative monitoring continuous fault is cancelled.

[0028] Optionally, when the values ​​of the first fault recovery counter, the second fault recovery counter and the third fault recovery counter are 0, they are only increased but not decreased.

[0029] Optionally, when the same time tag is assigned to data, the time is the end time of the sending cycle.

[0030] In summary, this application includes the following beneficial technical effects:

[0031] The present application provides a redundancy management method for airborne equipment that receives dual redundant signals, which can switch to another valid state channel in time when a single signal fails, that is, can achieve one-time fail-safe mission reliability.

[0032] This application sets up separate fault counters for monitoring possible faults in self-monitoring and comparative monitoring. While accurately locating the fault, it can effectively avoid frequent false triggering of voters caused by signal jumps at multiple nodes, thereby improving the robustness of the system.

[0033] This application eliminates the traditional method of isolating permanent faults, and proposes to judge the channel whose fault times exceed the fault counter as a continuous fault and continuously monitor it. The monitoring means is a fault recovery counter. When the channel is restored to validity, the channel is re-enabled. This fault monitoring and recovery mechanism improves the availability of redundancy signals. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 This is a schematic diagram of the comparative monitoring process in the embodiment of the present application;

[0036] Figure 2 This is the fault counter processing flow chart for this application;

[0037] Figure 3 This is a self-monitoring flow chart in the embodiment of this application

[0038] Figure 4 This is an example diagram of the reception time of two channel signals in this application. DETAILED DESCRIPTION

[0039] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0040] The following describes the implementation methods of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The present application can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that, in the absence of conflict, the following embodiments and the features in the embodiments can be combined with each other. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work belong to the scope of protection of the present application.

[0041] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present application, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0042] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application. The illustrations only show the components related to the present application rather than being drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed at will, and the component layout may also be more complicated.

[0043] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0044] An embodiment of the present application provides a redundancy management method for dual-redundancy discrete signals of airborne equipment.

[0045] A redundancy management method for dual-redundancy discrete signals of airborne equipment comprises the following steps:

[0046] like Figure 1 As shown, the two channels of dual redundancy perform time synchronization processing on the data received by the receiving end according to the sending cycle of the data sending end, and the data in the same sending cycle are given the same time tag.

[0047] Determine the validity of the two channel data.

[0048] Two data with the same time stamp are compared, monitored and voted on according to the data validity of the two channels.

[0049] If the data of both channels are valid, compare whether the two data are equal. If they are equal, then compare and monitor them, and take the equal value as the voting value. If they are not equal, select the data of one of the channels as the fail-safe value, and record the other channel as a comparison monitoring instantaneous fault. Count the number of channel comparison monitoring instantaneous faults, and when the number exceeds the threshold, record both channels as comparison monitoring continuous faults.

[0050] If the data of only one channel is valid, the data of the channel with valid data is directly taken as the voting value; the other channel is recorded as a self-monitoring instantaneous fault, and the number of self-monitoring instantaneous faults of the channel is counted; when the number of faults exceeds the threshold, the channel is recorded as a self-monitoring continuous fault.

[0051] If the data of both channels are invalid, one of the channels is selected as the fail-safe value, and both channels are recorded as self-monitoring instantaneous faults. The number of self-monitoring channel failures is counted, and when the number exceeds the threshold, both channels are recorded as self-monitoring continuous faults.

[0052] For channels that have been determined to have persistent faults, continue monitoring and choose to re-enable the channel based on the number of times the channel data is restored to validity.

[0053] Specific:

[0054] like Figure 2 As shown, the method for counting the number of channel comparison monitoring instantaneous faults and recording both channels as comparison monitoring continuous faults when the number exceeds a threshold includes: setting a comparison monitoring fault counter to record the number of comparison monitoring instantaneous faults, after the sending end sends data each time, when a comparison monitoring instantaneous fault occurs, the comparison monitoring fault counter is increased by 1, and when no comparison monitoring instantaneous fault occurs, the comparison monitoring fault counter is reduced by 1, and when the count of the comparison monitoring fault counter exceeds a first preset value, it is recorded that both channels are comparison monitoring continuous faults.

[0055] Self-monitoring instantaneous faults include communication instantaneous faults and data verification instantaneous faults; the method for determining the validity of channel data includes: monitoring the receiving frequency of the receiving end to determine whether the channel data has a communication instantaneous fault; verifying the received data to determine whether the received data has a data verification instantaneous fault; if the channel does not have a communication instantaneous fault and the data does not have a verification instantaneous fault, the channel data is valid.

[0056] like Figure 3 As shown, the CRC check bit, function status bit, parity check and SSM are used to determine whether the data has a data check transient fault, and the validity of the ARI NC 664 bus signal is monitored and determined. The specific steps are as follows:

[0057] S1, CRC check: First determine whether the message to which the signal belongs contains a CRC check bit. If it does not contain a CRC check bit, perform a function status bit judgment on the data set: If the function status of the data set to which the signal belongs is "NO" or "FT", the signal meets the self-judgment of validity and enters step S2; if it is "ND" or "NCD", it is determined that the bit data check instantaneous failure. If it contains a CRC check bit, further determine whether the CRC check passes, which is divided into two cases: 1) If the CRC check fails, the signal is determined to be faulty and passes Figure 2 The fault counter of the data set determines whether it is a transient fault or a continuous fault; 2) If the CRC check passes, the function status bit of the data set is determined. The definition of the function status bit is shown in Table 1.

[0058] Table 1 Function status bit definition

[0059]

[0060] S2, parity check and SSM bit judgment: For the 429-word signal type, parity check and SSM bit judgment are performed successively. When the parity check passes and the SSM bit is judged to be valid, the channel data is considered to be a valid signal, otherwise it is judged to be a data check instantaneous fault.

[0061] A communication fault counter and a verification fault counter are set on both channels; the communication fault counter counts the instantaneous communication faults of the channel. Each time the sending end sends data and the receiving end does not receive the data, the communication fault counter is increased by 1, and when the receiving end receives the data normally, the communication fault counter is reduced by 1. When the count of the communication fault counter exceeds the second preset value, the channel is recorded as a continuous communication fault; the verification fault counter counts the instantaneous data verification faults. Each time the sending end sends data and the receiving end receives the data and there is a data verification instantaneous fault, the verification fault counter is increased by 1, and when the data received by the receiving end is normal, the verification fault counter is reduced by 1. When the count of the communication fault counter exceeds the third preset value, the channel is recorded as a continuous data verification fault.

[0062] For channels that have been identified as having a persistent fault, continue to monitor them. Based on the number of times the channel data is restored to validity, the steps for selecting to re-enable the channel include:

[0063] A first fault recovery counter is set for each channel. Starting from the next sending cycle when the channel is judged to be a continuous communication fault, the communication fault counter stops running and the first fault recovery counter is enabled. When the receiving end receives data normally, the first fault recovery counter is increased by 1. When the receiving end does not receive data, the first fault recovery counter is reduced by 1. When the first fault recovery counter exceeds the fourth preset value, the continuous communication fault is canceled.

[0064] A second fault recovery counter is set for each channel. Starting from the next sending cycle when the channel is judged to be a continuous communication fault, the verification fault counter stops running and the second fault recovery counter is enabled. When the data received by the receiving end passes the data verification, the second fault recovery counter is increased by 1, otherwise the second fault recovery counter is reduced by 1. When the second fault recovery counter exceeds the fifth preset value, the data verification continuous fault is canceled.

[0065] A third fault recovery counter is set for each channel. Starting from the next sending cycle when the channel is judged to be a continuous communication fault, the comparison monitoring fault counter stops running and the third fault recovery counter is enabled. The third fault recovery counter is increased by 1 when the channel passes the comparison monitoring. The third fault recovery counter is reduced by 1 when a comparison instantaneous monitoring fault occurs in the channel. When the fault recovery counter exceeds the sixth preset value, the comparison monitoring continuous fault is cancelled.

[0066] In the embodiment of the present application, the first preset value, the second preset value, the third preset value, the fourth preset value, the fifth preset value, and the sixth preset value are all 10. In other embodiments, each preset value can be set according to requirements. When the values ​​of the comparison monitoring fault counter, the communication fault counter, the verification fault counter, the first fault recovery counter, the second fault recovery counter, and the third fault recovery counter are 0, only addition is performed but no subtraction is performed.

[0067] like Figure 4 As shown, when the same time tag is assigned to the data, the time is taken as the end moment of the sending cycle; the redundancy signal received by the airborne equipment usually has no time tag. In order to compare and vote between signals, the received redundancy signal should be synchronized. The present application uses the redundancy signal sending period as the time window to group the redundancy signals. Usually in the data transmission process, the transmitter sends data to the receiver at a fixed sending period, and the sending periods of the two channels are the same and synchronized, such as the first period: the signal received in the first sending period is defined as the first group of signals, and the same time tag is assigned, and the time is taken as the end moment of the first sending period; the second period: the signal received in the second sending period is defined as the second group of signals, and the same time tag is assigned, and the time is taken as the end moment of the second sending period; according to this rule, the time tag is updated periodically, and the time is taken as the end moment of the period.

[0068] The method of the present application can be used for redundancy management of dual-redundancy signals of airborne equipment such as flight control systems, integrated monitoring systems, flight management systems, etc. that access an aircraft data network via an ARINC 664 bus.

[0069] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A redundancy management method for dual-redundancy discrete signals of airborne equipment, characterized in that: The steps include: The two channels of dual redundancy perform time synchronization processing on the data received by the receiving end according to the sending cycle of the data sending end, and the data in the same sending cycle are given the same time tag; Determine the validity of the two channel data; Comparative monitoring and voting of two data with the same time tag according to the data validity of the two channels; If the data of both channels are valid, compare whether the two data are equal. If they are equal, then the comparison monitoring is performed and the equal value is taken as the voting value. If they are not equal, the data of one channel is selected as the fail-safe value, and the other channel is recorded as a comparison monitoring instantaneous fault. The number of channel comparison monitoring instantaneous faults is counted. When the number exceeds the threshold, both channels are recorded as comparison monitoring continuous faults. If the data of only one channel is valid, the data of the valid channel is directly taken as the voting value; the other channel is recorded as a self-monitoring instantaneous fault, and the number of self-monitoring instantaneous faults of the channel is counted; when the number of faults exceeds the threshold, the channel is recorded as a self-monitoring continuous fault; If the data of both channels are invalid, one of the channels is selected as the fail-safe value, and both channels are recorded as self-monitoring instantaneous faults, and the number of self-monitoring channel failures is counted. When the number exceeds the threshold, both channels are recorded as self-monitoring continuous faults. For channels that have been determined to have persistent faults, continue monitoring and choose to re-enable the channel based on the number of times the channel data is restored to validity.

2. The redundancy management method for dual-redundancy discrete signals of airborne equipment according to claim 1, characterized in that: The method of counting the number of channel comparison monitoring instantaneous faults and recording both channels as comparison monitoring continuous faults when the number exceeds a threshold includes: A comparison monitoring fault counter is set to count the number of times a comparison monitoring instantaneous fault occurs. After the sending end sends data each time, if a comparison monitoring instantaneous fault occurs, the comparison monitoring fault counter is increased by 1. If no comparison monitoring instantaneous fault occurs, the comparison monitoring fault counter is reduced by 1. When the count of the comparison monitoring fault counter exceeds the first preset value, it is recorded that both channels have a comparison monitoring continuous fault.

3. The redundancy management method for dual-redundancy discrete signals of airborne equipment according to claim 1, characterized in that: Self-monitoring instantaneous faults include communication instantaneous faults and data verification instantaneous faults; methods for judging the validity of channel data include: Monitor the receiving frequency of the receiving end to determine whether there is a transient communication failure in the channel data; Verify the received data to determine whether there is a data verification transient fault in the received data; If there is no communication transient fault in the channel and no verification transient fault in the data, the channel data is valid.

4. The redundancy management method for dual-redundancy discrete signals of airborne equipment according to claim 3, characterized in that: Set up communication fault counters and verification fault counters on both channels; The communication fault counter counts the instantaneous communication faults of the channel. Each time the sending end sends data and the receiving end does not receive the data, the communication fault counter increases by 1. When the receiving end receives the data normally, the communication fault counter decreases by 1. When the count of the communication fault counter exceeds the second preset value, the channel is recorded as a continuous communication fault. The verification fault counter counts the instantaneous data verification faults. Each time the sending end sends data, the verification fault counter increases by 1 when the receiving end receives the data and there is an instantaneous data verification fault. The verification fault counter decreases by 1 when the data received by the receiving end is normal. When the count of the communication fault counter exceeds the third preset value, the channel is recorded as a continuous data verification fault.

5. The redundancy management method for dual-redundancy discrete signals of airborne equipment according to claim 4, characterized in that: For channels that have been identified as having a persistent fault, continue to monitor them. Based on the number of times the channel data is restored to validity, the steps for selecting to re-enable the channel include: Each channel is provided with a first fault recovery counter, when the receiving end receives data normally, the first fault recovery counter is increased by 1, when the receiving end does not receive data, the first fault recovery counter is decreased by 1, when the first fault recovery counter exceeds a fourth preset value, the communication continuous fault is cancelled; A second fault recovery counter is set for each channel. When the data received by the receiving end passes the data verification, the second fault recovery counter is increased by 1, otherwise the second fault recovery counter is decreased by 1. When the second fault recovery counter exceeds a fifth preset value, the data verification continuous fault is cancelled; A third fault recovery counter is set for each channel. The third fault recovery counter is increased by 1 when the channel passes comparative monitoring. The third fault recovery counter is reduced by 1 when a comparative instantaneous monitoring fault occurs in the channel. When the fault recovery counter exceeds the sixth preset value, the comparative monitoring continuous fault is cancelled.

6. The redundancy management method for dual-redundancy discrete signals of airborne equipment according to claim 5, characterized in that: When the values ​​of the first fault recovery counter, the second fault recovery counter and the third fault recovery counter are 0, they are only increased but not decreased.

7. The redundancy management method for dual-redundancy discrete signals of airborne equipment according to claim 1, characterized in that: When the same time tag is given to data, the time is the end time of the transmission cycle.

Images