FRAM-based man-machine team safety analysis method considering autonomous level dynamic switching

Abstract

The invention provides an FRAM-based man-machine team security analysis method considering autonomous level dynamic switching. The method comprises the steps of 1, identifying functions of a system; 2, identifying six aspects of the functions; step 3, establishing a function internal nested structure; 4, identifying the variability of the functions: analyzing and identifying the variability of each function under different autonomous levels; step 5, identifying coupling among the functions: analyzing interdependence and influence relations among the functions; and step 6, managing function resonance: making security constraints and mitigation measures by analyzing the potential risks. According to the man-machine team safety analysis method considering autonomous level dynamic switching based on the FRAM, the problems that the autonomous level switching process is difficult to accurately analyze and the influence of the autonomous level switching process on the system safety by a traditional FRAM method are solved, so that the potential risk of the man-machine team system under the dynamic autonomous level is more comprehensively identified and managed; and the safety level of the man-machine team is improved.

Description

Technical Field

[0001] The present invention provides a human-machine team safety analysis method considering dynamic switching of autonomy levels. On the basis of a functional resonance analysis method (FRAM), the present invention proposes a functional hexagonal internal nested structure that describes dynamic autonomy levels, and implants the internal nested structure into task-related functions to describe the process of switching task-related functions between multiple autonomy levels. The present invention is an extension of the existing FRAM method, and realizes risk identification of human-machine teams with dynamic switching of autonomy levels. The present invention belongs to a human-machine system safety analysis method in the field of safety science and engineering technology, and focuses on solving the problem that the traditional FRAM method is difficult to describe "dynamic switching of autonomy levels". Background Art

[0002] With the rapid development of intelligent technology, more and more human-machine teaming systems are applied in various key fields, such as aviation, military, and medical. In these systems, the collaboration between humans and autonomous systems becomes crucial, especially in the field of unmanned aerial vehicles (UAVs). Autonomously controlled UAVs can adjust their own level of autonomy (LoA) according to different situations. Although traditional systemic safety analysis methods, such as the FRAM method, can be used to analyze the variability of functions in the system and the coupling of upstream and downstream functions, they have limitations in dealing with the dynamic switching process of autonomy levels, and it is difficult to describe the impact of this process on the safety of human-machine teaming.

[0003] In the complex mission environment of human-machine teaming, the system often needs to dynamically switch the autonomy level according to the mission requirements and changes in the external environment. Changes in the autonomy level will directly affect the execution and control methods of different functions in the human-machine team. During the dynamic switching of the autonomy level, the conversion between different autonomy levels has a direct impact on the execution method of system functions, resource allocation, control rights and information flow. This change not only affects the execution efficiency of the task, but also significantly affects the safety of the system. Since dynamic switching involves coordination and information transmission between multiple functions, any uncoordinated or delayed switching may lead to system function failure, resource waste, and even serious safety accidents.

[0004] Therefore, it is crucial to accurately identify the potential dangers in the dynamic switching of autonomy levels in human-machine teaming and analyze its impact on system safety. However, the existing FRAM functional hexagon is fixed, and its core is to analyze the safety of the system through the coupling relationship between functions. There are obvious limitations in the description and analysis of dynamic switching of autonomy levels. In particular, FRAM lacks adaptability to the switching of autonomy levels in the system, cannot effectively identify events that trigger switching of autonomy levels, and cannot evaluate potential safety risks during the switching process. This deficiency limits the application of FRAM in human-machine teaming, because the switching of autonomy levels will directly affect the execution mode of functions, the allocation of control rights and information transmission, and thus affect the overall safety of the system.

[0005] The innovative method proposed in this invention introduces the related functions and triggering events of autonomous level switching on the basis of traditional FRAM, and characterizes the dynamic switching of autonomous levels in different functions through the internal nested structure of the functional hexagon. This method can not only identify and analyze the events that trigger the switching of autonomous levels, but also accurately evaluate the impact of the switching process on system safety, thus providing a new analysis tool, which effectively makes up for the deficiency of the traditional FRAM method in analyzing the dynamic switching of autonomous levels, and can discover the functional variation and coupling in the process of dynamic switching of autonomous levels, providing important support for the risk management and safety improvement of human-machine teaming. Summary of the invention

[0006] The purpose of the present invention is to provide a FRAM-based human-machine team safety analysis method that considers the dynamic autonomy level, so as to solve the problem that the existing FRAM method is difficult to accurately analyze the impact of the dynamic switching process of the autonomy level on the safety of the human-machine team. The present invention introduces an autonomy level switching model based on a functional hexagonal nested structure, improves the traditional FRAM method, and more finely describes the changing process of function execution at different autonomy levels, as well as the coupling relationship between functions when the autonomy level is switched. The present invention can more comprehensively analyze, identify and manage the potential risks of human-machine teams at dynamic autonomy levels, thereby improving the safety level of human-machine teams in task execution.

[0007] The present invention is a human-machine team safety analysis method based on FRAM considering dynamic switching of autonomous levels. The flow chart of the method is as follows: Figure 1 As shown, it includes the following six steps:

[0008] Step 1: Identify system functions: Identify the key functions of each task in the system for the human-machine team task execution process. In this step, it is necessary to identify task-related functions and autonomous level switching trigger functions.

[0009] Step 2: Identify the six aspects of the function: For each function in FRAM, further identify its "six aspects": Input (I), Output (O), Preconditions (P), Resources (R), Time (T), Control (C). Both task-related functions and autonomous level switching trigger functions need to be analyzed in this way.

[0010] Step 3: Establish a nested structure within the function: In order to more comprehensively describe the dynamic switching of the system's autonomy level, it is necessary to expand the traditional FRAM and establish a nested structure with multiple autonomy levels within each "functional hexagon". The main purpose of this structure is to describe in detail how each function is executed at different autonomy levels.

[0011] Step 4: Identify the variability of functions: Analyze and identify the variability of each function at different autonomy levels, including changes in inputs and outputs. At the same time, special attention should be paid to the variability of functions that trigger the switching of autonomy levels, because the output variability of these functions is the trigger event that causes the switching of autonomy levels.

[0012] Step 5: Identify coupling between functions: Analyze the interdependence and influence relationship between functions. For example, the output of one function may be used as any one of the input, resources, premise, time, and control of another function. Through the coupling analysis between functions, determine the coupling relationship between upstream and downstream functions.

[0013] Step 6: Manage functional resonance: Assess the impact of functional resonance caused by coupling between functions on system security, especially the unacceptable resonance phenomenon that may be caused during the switching of autonomy levels. By analyzing these potential risks, formulate appropriate safety constraints and mitigation measures to ensure the stable operation of the system under dynamic autonomy levels and reduce the safety risks caused by functional resonance.

[0014] Through the above steps, the FRAM-based human-machine teaming safety analysis method considering the dynamic switching of autonomy levels is adopted to solve the problem that the traditional FRAM method is difficult to accurately analyze the autonomy level switching process and its impact on system safety, thereby more comprehensively identifying and managing the potential risks of the human-machine teaming system under dynamic autonomy levels and improving the safety level of human-machine teaming.

[0015] The “function of the identification system” described in step 1 is described as follows:

[0016] (1) Identify task-related functions

[0017] The daily task flow of the system is identified as a set of "functions". Functions related to the execution of system tasks are called "task-related functions". It is used to describe the tasks or activities that need to be performed in the system. These tasks and activities are usually the core components of the system operation and are necessary to achieve the system goals. Task-related functions include the activities that the system needs to perform to complete routine tasks, and their operation has a direct impact on the status of the task;

[0018] (2) Identify all possible levels of autonomy of the function

[0019] A function may be executed at multiple different autonomy levels. At different autonomy levels, the function execution process and the required resources and conditions may be different. In this step, based on the actual situation of task execution, identify the autonomy level of each task-related function during actual execution. For the human-machine teaming system, the drone includes four autonomy levels: manual operation, consent management, exception management, and high autonomy. In the present invention, considering that the high autonomy mode of drones has not yet been achieved in actual combat, only the first three autonomy levels are considered. Each task-related function can work at different autonomy levels, so it is necessary to identify all autonomy levels of the function;

[0020] (3) Identify the autonomous level switching trigger function

[0021] The switching of the autonomy level of the system is caused by triggering events. Triggering events have two sources: internal system stimuli and external stimuli. Internal stimuli include events within the autonomous system, and external stimuli include events in the surrounding environment. The triggering event is the result of the execution of the "triggering autonomy level switching function", that is, the output of these functions. Therefore, in this step, it is necessary to study how the triggering events are generated, that is, to identify these autonomy level switching triggering functions. For human-machine teaming systems, these functions include updates to the mission phase, system communications, detection of air defense firepower, and so on.

[0022] The "six aspects of identification function" described in step 2 are described as follows:

[0023] (1) Identify six aspects of task-related functions

[0024] For the task-related functions identified in step one, conduct a detailed analysis of the six aspects of "task-related functions" to identify the input, output, premise, resources, time and control of the function. When performing the analysis, follow FRAM's definition of the six aspects of the function: input is the condition or event that triggers the execution of the function; output is the result after the function is executed, which affects the subsequent system status or other functions; premise is the condition or resource that must be met before the function is executed; resources are the support or tools required for the execution of the function; time involves the execution time of the function and its scheduling in time; control refers to the mechanism and constraints that regulate the behavior of the function. This analysis step can be performed using a tabular method or other appropriate method;

[0025] (2) Identify six aspects of autonomous level switching triggering functions

[0026] For the autonomous level switching trigger function identified in step 1, follow the definition of the six aspects of the function in FRAM, and conduct a detailed analysis of the six aspects of the "autonomous level switching trigger function" to identify the input, output, premise, resource, time and control of the function. Similarly, this analysis step can be performed using a table method or other appropriate method;

[0027] The contents of "Establishing a nested structure within a function" in step 3 are as follows:

[0028] (1) Identify nested functions at all levels of autonomy

[0029] First, for all autonomous levels of task-related functions, it is necessary to identify the nested functions under all autonomous levels according to the needs of task execution. These nested functions constitute the main body of the nested structure within the task-related functions. Figure 2 As shown, in the functional hexagon of FRAM, according to the two aspects of control and execution, the control of the function is subdivided into three different autonomy levels: LoA1, LoA2, and LoA3, corresponding to the three functions of "pilot control (LoA1)", "autonomous control module (LoA2)" and "autonomous control module (LoA3)", among which the autonomous control module (LoA2) requires "human approval" and the autonomous control module (LoA3) is subject to "human supervision"; the execution of the function is divided into "flight control platform" and "mission platform".

[0030] (2) Determine the coupling relationship between nested functions

[0031] After identifying all the internally nested functions, it is necessary to determine the coupling relationship between these functions, that is, the connection relationship between the six aspects of the function. Figure 2 shown.

[0032] Under LoA1, the UAV is manually controlled by the pilot, who gives instructions to the UAV. The UAV's "flight control platform" plans the flight route and adjusts the aircraft's attitude according to the instructions; the "mission platform" performs specific tasks according to the instructions, such as photographing targets, launching missiles, etc. Therefore, the output (O) of "pilot control (LoA1)" is connected to the input (I) of the "flight control platform" and "mission platform".

[0033] At LoA2, the drone controls the flight and performs the mission autonomously, and the pilot supervises the drone's behavior. At this level of autonomy, the drone sends requests to the crew and requires human approval to perform planned critical actions, such as launching a missile. Therefore, the output (O) of the "Autonomous Control Module (LoA2)" is connected to the input (I) of the "Flight Control Platform" and the "Mission Platform". The output (O) of "Human Approval" is connected to the control (C) of the "Autonomous Control Module (LoA2)".

[0034] Under LoA3, the drone has a high degree of autonomy and can achieve fully autonomous flight and mission execution without human approval. Only in an emergency will a warning message be sent to the pilot, who can veto the drone's actions or take over control. Therefore, the output (O) of the "autonomous control module (LoA3)" is connected to the input (I) of the "flight control platform" and "mission platform". The output (O) of "human supervision" is connected to the control (C) of the "autonomous control module (LoA3)".

[0035] (3) Identify the correspondence between the six aspects of task-related functions and nested functions

[0036] After determining the "six aspects" of the functional hexagon and the internal nested structure of the function, it is necessary to connect the internal nested structure with the external functional hexagon. According to the actual situation of the task, the I, O, P, R, T, C of the external functional hexagon should be matched with the six aspects of the function at different autonomy levels. Figure 2 In the figure, the input (I) of the external function hexagon is connected to the input (I) of "autonomous control module (LoA2)", "autonomous control module (LoA3)", and "pilot control (LoA1)"; the premise (P) of the external function hexagon is connected to the premise (P) of "autonomous control module (LoA2)", "autonomous control module (LoA3)", and "pilot control (LoA1)"; the output (O) of the external function hexagon is connected to the output (O) of "flight control platform" and "mission platform".

[0037] The “variability of identification function” described in step 4 is described as follows:

[0038] (1) Identify task-related functional output variability

[0039] Variability refers to the deviation, change or inconsistency that may occur during the execution of a function. In this step, it is necessary to determine the output variability of task-related functions. The output of task-related functions may be affected by upstream functions or deviations in the execution of their own functions, resulting in variability, that is, the output results are inconsistent with expectations. Carefully check the output of each task-related function, analyze and describe the output results that may not meet expectations, that is, output variability.

[0040] (2) Identifying the variability of the output of the autonomous level switching trigger function

[0041] In this step, you need to identify the output variability of all autonomous level switching trigger functions. The unexpected output results generated by the "autonomous level switching trigger function" during execution are the "trigger events" that cause autonomous level switching. Carefully check the output of each autonomous level switching trigger function, analyze and describe the unexpected output results that the function may produce.

[0042] The contents of “identifying coupling between functions” described in step 5 are as follows:

[0043] (1) Identify the coupling between task-related functions

[0044] FRAM inter-functional coupling is a qualitative representation of how different functions affect each other, or in some cases, the execution of one function may change the input, output, or other aspects of another function. In this step, carefully check all task-related functions, analyze and determine the coupling relationship between each task-related function. For example, if the output of one function is a resource of another function, then a line is established between these two elements to represent this coupling relationship.

[0045] (2) Coupling between identification task-related functions and autonomous level switching trigger functions

[0046] The autonomous level switching trigger function affects the task-related functions by outputting trigger events, which is mainly reflected in causing the autonomous level switching. On the other hand, the task-related functions will also affect the autonomous level switching trigger function. Therefore, in this step, it is necessary to establish a connection between the task-related functions and the autonomous level switching trigger function to represent this coupling relationship. In particular, the trigger event serves as a prerequisite (P) for the task function, which means that the autonomous level will only switch after the trigger event occurs.

[0047] The “management function resonance” described in step 6 is described as follows:

[0048] (1) Analyze safety-critical coupling

[0049] This step aims to identify and analyze the coupling relationships that are critical to safety in the system. These coupling relationships refer to the key dependencies and interactions between two or more functions in the system. If these relationships fail or have problems, they may have a significant impact on the overall safety of the system. By analyzing these critical couplings, potential safety hazards can be identified and preventive measures can be taken against them.

[0050] (2) Propose measures to reduce functional resonance

[0051] Once potential functional resonance effects have been identified, this step involves proposing specific measures to reduce or eliminate these resonance effects. Measures may include technical improvements, management improvements, and training and cultural improvements.

[0052] Technical improvement measures may include: system redundancy design, introducing backup mechanisms (such as hardware or software redundancy) for key functions to reduce the risk of single point failure; reducing the variability of human operations through automated systems; deploying information monitoring and early warning systems to continuously monitor key parameters of functions, etc. Management improvement measures may include: clarifying roles and responsibilities, assigning clear responsibilities and authorities within the team, and ensuring that each function has a clear person in charge when it is executed; conducting regular risk assessments to identify high-risk functional resonance effects and formulate targeted emergency plans; optimizing the allocation and use of system resources to avoid multi-function dependence on the same resources, etc. Training and cultural improvement measures may include: providing system operators with training on system working principles, functional interactions and potential risks; enhancing personnel's awareness of resonance effects and system failure modes through risk awareness training, etc.

[0053] The purpose of this step is to reduce or eliminate the negative impact of functional resonance on the system through these measures, and enhance the stability and security of the system.

[0054] (3) Analysis of the variability of autonomous level switching

[0055] This step focuses on analyzing and identifying unexpected LoA switching behaviors that may occur when the system switches between different levels of autonomy (LoA). LoA switching refers to the process of the system switching from one autonomous operation level to another. Autonomy level switching can mutate into three different types: providing incorrect LoA switching instructions, not providing LoA switching instructions, and providing LoA switching instructions too early / too late. The results of these three variations may cause risks to the system. For example, not providing LoA switching instructions or providing incorrect LoA switching instructions may cause LoA to not match actual requirements, and providing LoA switching instructions too early or too late may cause task delays or early interruptions. The variability of LoA switching can be analyzed using a tabular method. Analyze and list each LoA switching process, the corresponding variation type, and the variation of LoA switching behaviors of personnel and autonomous control modules. These identified variation LoA switching behaviors are the focus of attention, and effective safety constraints need to be proposed to restrict them to ensure the safety of system operation.

[0056] (4) Propose safety constraints for autonomous level switching

[0057] Based on the results of the variability analysis of the autonomous level switching, specific safety constraints (SC) are proposed to ensure the safety of the autonomous level switching process. Safety constraints refer to specific restrictions established during the system design, operation and management process to prevent danger, reduce risks and ultimately avoid accidents or losses. These restrictions may include conditions that need to be met during the switching process (such as environmental parameters, system status), standardization of operating steps (such as detailed switching procedures), and personnel training and qualification certification (such as ensuring that operators have the necessary skills and knowledge).

[0058] The conditions that need to be met for autonomous level switching can be analyzed by analyzing past operation data and accident reports, combined with interviews with system designers, operators, and experts in related fields, to identify common problems and related environmental conditions or system states during the switching process. By identifying these potential risk factors, the safety constraints of the environmental conditions and system states that need to be met for autonomous level switching can be clarified.

[0059] The operation steps can be standardized by analyzing the autonomous level switching process in detail to sort out the key operation steps and the conditions that need to be ensured. Each step of the switching process can be clarified by drawing a flowchart or establishing a state transition diagram to ensure that the sequence and conditions of the operation steps meet the requirements.

[0060] The training and qualification certification requirements for personnel can clarify the specific skills and knowledge that operators need to have during the switching process based on the complexity and criticality of the autonomous level switching tasks. For example, what environmental parameters need to be understood, how to identify the system status, how to deal with switching failures, etc. Based on the task requirements, the competency standards for operators are formulated, and a certification mechanism is established to ensure that only personnel with the corresponding skills and knowledge can perform autonomous level switching operations. For example, operators can be required to pass specific assessments and certifications to confirm that they have the required technical level. In addition, regular skill training and switching process simulations can be carried out to familiarize operators with the switching process under different conditions.

[0061] The purpose of this step is to limit the negative impact of the variability of autonomy level switching on the system by proposing safety constraints for system autonomy level switching, and to ensure that the system can operate stably and reliably under dynamic autonomy levels.

[0062] The effects and advantages of the present invention are:

[0063] Based on the FRAM method, the present invention proposes a safety analysis method for dynamic autonomy level human-machine team, which can effectively identify and manage system safety risks caused by autonomy level switching and functional variability. By introducing dynamic change analysis of autonomy level, the safety of the system under complex tasks and different autonomy levels is improved, and specific safety improvement measures are proposed to enhance the stability of the system and the safety guarantee of task execution. The safety analysis method described in the present invention is scientific, has good processability, and has broad promotion and application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 This is a flow chart of the FRAM-based dynamic autonomy level human-machine team safety analysis method described in the present invention.

[0065] Figure 2 This is a diagram of the internal nested structure of the functional hexagon with three autonomous levels as described in the present invention.

[0066] Figure 3 This is the internal nested structure of the manned / unmanned aircraft formation FRAM task related functions described in the present invention.

[0067] Figure 4 This is the FRAM model of the manned / unmanned aircraft formation described in the present invention.

[0068] The foreign symbols and codes involved in this manual are summarized as follows:

[0069] Functional Resonance Analysis Method, FRAM——Functional Resonance Analysis Method;

[0070] Level of Automation, LoA——Level of autonomy;

[0071] Unmanned Aerial Vehicle, UAV

[0072] Multi-Purpose Displays, MPDs

[0073] Keyboard Unit, KU——keyboard unit;

[0074] Mission Control Grip, MCG——Mission Control Grip;

[0075] Tactical Common Data Link, TCDL

[0076] Global Positioning System, GPS——Global Positioning System;

[0077] Modernized Target Acquisition Designation Sight, MTADS

[0078] Safety Constraints, SC——Safety constraints. DETAILED DESCRIPTION

[0079] The present invention is a safety analysis method for human-machine teaming with dynamic autonomy level based on FRAM. The process is explained by taking a human-machine team (man-machine / unmanned aerial vehicle formation) formed by a helicopter and a UAV to perform a task of attacking enemy ground targets as an example. The mission of a human-machine team attacking enemy targets has typical multi-stage mission characteristics, which is mainly divided into four stages: reconnaissance, formulation of combat plans, attack on targets, and re-formation. The autonomy level of the UAV changes dynamically during the mission, which brings about the problem of dynamic switching of the autonomy level, thereby increasing the risk of accidents in the system.

[0080] In the collaborative combat mission process of human-machine teaming, drones perform tasks at different levels of autonomy. In the reconnaissance phase, if the drone enters a dangerous area and is locked by the enemy's fire control radar, it will switch to LoA1 and be manually controlled by the pilot to conduct electronic countermeasures; otherwise, it will autonomously complete the reconnaissance mission under LoA3, providing target reference points and battlefield terrain. Subsequently, in the stage of formulating combat plans, the drone will autonomously plan under LoA2 and request approval from the pilot. If the battlefield is urgent, it will switch to LoA3 to autonomously formulate and execute plans. The target strike phase usually requires LoA2, and the pilot approves the attack, but in complex situations, it switches to LoA3 for the drone to autonomously control the strike. Finally, in the re-formation phase, the drone needs to leave the battlefield under LoA1 or LoA3, depending on the enemy threat.

[0081] In the manned / unmanned aerial vehicle formation coordinated combat mission, some key units on the helicopter are crucial in the manned / unmanned aerial vehicle coordination, including: Tactical Common Data Link (TCDL), Keyboard Unit (KU), Mission Control Grip (MCG), Multi-Purpose Displays (MPDs), Global Positioning System (GPS) and Modernized Target Acquisition Designation Sight (MTADS). These units, as the "resources" in the FRAM functional hexagon, play a key role in the execution of the function.

[0082] The present invention is a human-machine team safety analysis method based on FRAM considering the dynamic switching of autonomy level. The process of dynamic change of UAV autonomy level in the above human-machine team mission is analyzed in detail. The flow chart of the method is as follows: Figure 1 As shown, the method includes the following five steps:

[0083] Step 1: Identify the system's functionality

[0084] (1) Identify task-related functions

[0085] Four mission-related functions of human-machine teaming FRAM are identified as: reconnaissance, operational planning, targeting, and reorganization.

[0086] (2) Identify all possible levels of autonomy of the function

[0087] According to the analysis of the human-machine teaming mission, the autonomy levels of the four mission stages are identified as follows: the UAV autonomy levels in the reconnaissance phase are LoA1 and LoA3, the UAV autonomy levels in the combat plan formulation phase are LoA2 and LoA3, the UAV autonomy levels in the target strike phase are LoA2 and LoA3, and the UAV autonomy levels in the re-formation phase are LoA1 and LoA3.

[0088] (3) Identify the autonomous level switching trigger function

[0089] The five autonomous level switching trigger functions are: enemy radar lock detection, manned / unmanned aircraft communication, mission phase update, air defense fire detection, and combat situation analysis.

[0090] Step 2: Identify the six aspects of functionality

[0091] (1) Identify six aspects of task-related functions

[0092] Six aspects of FRAM task-related functions are identified and presented in a table format. Tables 1 to 4 perform FRAM analysis on four task-related functions and identify six aspects of functions, namely I, O, P, R, T and C.

[0093] Table 1 Six aspects of the investigation phase

[0094]

[0095]

[0096] Table 2 Six aspects of the operational planning function

[0097]

[0098]

[0099] Table 3 Six aspects of the function of attacking the target

[0100]

[0101] Table 4 Six aspects of the re-formation function

[0102]

[0103]

[0104] (2) Identify six aspects of autonomous level switching triggering functions

[0105] Table 5 presents a FRAM analysis of the five autonomous level switching trigger functions, identifying six aspects of the functions.

[0106] Table 5 Six aspects of autonomous level switching trigger function

[0107]

[0108] Step 3: Create a nested structure within the function

[0109] (1) Identify nested functions at all levels of autonomy

[0110] The two mission-related functions, “reconnaissance” and “re-formation”, may be at the autonomy level of LoA1 or LoA3. Therefore, their internal nested functions include: pilot control (LoA1), autonomous control module (LoA3), human supervision, flight control platform and mission platform.

[0111] The two mission-related functions of “formulating combat plans” and “attacking targets” may be at the autonomy level of LoA2 or LoA3. Therefore, their internal nested functions include: autonomous control module (LoA2), autonomous control module (LoA3), human approval, human supervision, flight control platform and mission platform.

[0112] (2) Determine the coupling relationship between nested functions

[0113] In the human-machine team FRAM functional hexagonal nested structure ( Figure 2 ), for the four specific task stages, the internal nested structure of each task-related function is determined, such as Figure 3 For the two functions of "reconnaissance" and "re-formation", they do not include the two nested functions of "autonomy control module (LoA2)" and "human approval", so Figure 2 On the basis of , removing these two nested functions and the coupling lines related to them, the coupling relationship between the nested functions of "reconnaissance" and "reorganization" is formed. For the two functions of "formulating combat plans" and "attacking targets", they do not include the nested function of "pilot control (LoA1)". Therefore, in Figure 2 On this basis, removing this nested function and the coupling lines related to it constitutes the coupling relationship between the nested functions of "formulating combat plans" and "attacking targets".

[0114] (3) Identify the correspondence between the six aspects of task-related functions and nested functions

[0115] After determining the internal nested functions and their coupling relationships, it is necessary to match the six aspects of the task-related functions with the six aspects of the nested functions. Analyze the four task-related functions in detail to find out the inputs, outputs, resources, prerequisites, time, and control required for task execution at different levels of autonomy. Tables 1 to 4 allocate the six aspects of the task-related functions to their internal nested functions.

[0116] Step 4: Identify functional variability

[0117] (1) Identify task-related functional output variability

[0118] In a human-machine teaming system with a dynamic level of autonomy, the execution of functions is not only affected by triggering events, but also by the variability of outputs due to changes within the functions. In order to more fully understand and control the impact of these variabilities on the overall performance and safety of the system, the variability of each function must be identified and analyzed in detail. Table 6 provides a detailed analysis of the variability of task-related functions in the human-machine teaming FRAM.

[0119] Table 6 Variability of task-related function outputs

[0120]

[0121]

[0122] (2) Identifying the variability of the output of the autonomous level switching trigger function

[0123] According to the functional variability analysis in Table 7, the variability of the output of the autonomous level switching trigger function is the “trigger event” that causes the autonomous level switching of the UAV, which includes: the UAV is locked by the enemy’s fire control radar, communication interruption, switching command error, switching command delay, fierce air defense firepower, and urgent battlefield situation.

[0124] Table 7 Variability of output of autonomous level switching trigger function

[0125]

[0126]

[0127] Step 5: Identify coupling between functions

[0128] (1) Identify the coupling between task-related functions

[0129] According to Tables 1 to 4, the coupling relationship between functions can be determined. The coupling relationship of task-related functions is as follows: the output of the reconnaissance phase (target reference point and battlefield terrain) is used as the input of the combat plan formulation phase; the output of the combat plan formulation phase (attack mode, flight route) is used as the input of the target strike phase; the output of the target strike phase (target destruction confirmation) is the input of the reorganization phase.

[0130] (2) Coupling between identification task-related functions and autonomous level switching trigger functions

[0131] The coupling relationship between the mission-related functions and the autonomous level switching trigger function is as follows: the output of enemy radar lock detection (UAV is locked by the enemy fire control radar) serves as a prerequisite for the reconnaissance phase and the re-formation phase; the output of manned / unmanned aircraft communication (communication data) serves as a prerequisite for the reconnaissance phase and the re-formation phase; the updated output of the mission phase (autonomy level switching instructions) serves as a prerequisite for the reconnaissance phase, the combat plan formulation phase and the target strike phase; the output of air defense fire detection (air defense fire density) serves as a prerequisite for the combat plan formulation phase; the output of combat situation analysis (combat situation data) is a prerequisite for the target strike phase.

[0132] Based on steps 1 to 5, the FRAM model of manned / unmanned aircraft formation is established according to the FRAM functions of man-machine teaming, the internal nested structure of task-related functions, and the coupling relationship between functions, such as Figure 4 shown.

[0133] Step 6: Manage Functional Resonance

[0134] (1) Analyze safety-critical coupling

[0135] In manned / unmanned aircraft formation missions, multiple functions in the reconnaissance, target-strike, and re-formation phases have a direct impact on system-level hazards. Among them, the output of the "F6-pilot control" function in the reconnaissance phase plays a key role in drone crashes and mission failures, the output of the "F22-mission platform" in the target-strike phase affects mission failures, and the "F23-pilot control" function in the re-formation phase also affects mission failures. The variability of these functions mainly comes from the output of upstream functions, especially in the reconnaissance phase, where enemy radar lock information is crucial for pilots to respond quickly.

[0136] (2) Propose measures to reduce functional resonance

[0137] In order to effectively deal with the functional resonance caused by the key coupling relationship of FRAM and ensure the safety and reliability of the system in a complex combat environment, a series of management measures must be formulated and implemented. These measures will target the reliability of information transmission, redundancy and automation of functions, coordination and synchronization between functions, and decision support and training for pilots, aiming to reduce or eliminate potential functional resonance risks and thus improve the overall performance of the system. The proposed improvement measures are as follows:

[0138] (a) Improve the reliability and timeliness of information transmission: Enhance the transmission channel of radar lock information, ensure that the "UAV locked status" is transmitted to the pilot in a timely manner through redundant channels, and introduce an automatic alarm mechanism. Set priorities for key battlefield information to ensure that information is transmitted first and reduce delays.

[0139] (b) Increase functional redundancy and automated response: Increase the redundant design of pilot tasks. When the pilot fails to respond in time, the system automatically switches the UAV to manual operation and performs preliminary electronic countermeasures. Enhance the automation capability of the autonomous control module, automatically analyze inputs and make decisions quickly, and reduce human intervention.

[0140] (c) Enhance coordination and synchronization between functions: Ensure functional synchronization of mission phases and add a task completion prompt function so that pilots can accurately adjust their strategies. Optimize cross-phase functional connection, standardize data transmission, and avoid resonance caused by information delay or loss.

[0141] (d) Pilot decision support and training: Provide real-time decision support tools, dynamically assess system risks and provide response suggestions. Conduct simulation exercises regularly to improve pilots' ability to respond to information delays and autonomous level switching risks.

[0142] (3) Analysis of the variability of autonomous level switching

[0143] In manned / unmanned aerial vehicle (UAV) coordinated combat missions, there is a switching of autonomy levels within each individual mission phase, and there is also a switching of autonomy levels between two adjacent mission phases. The switching of autonomy levels can mutate into three different types: providing incorrect switching instructions for LoA, not providing LoA switching instructions, and providing LoA switching instructions too early / too late. The results of these three variations may pose risks to the system. Table 8 lists the variability analysis of the switching of autonomy levels in manned / unmanned aerial vehicle formations. The table describes each LoA switching behavior, determines the variation type of the LoA switching behavior, identifies the variation of the LoA switching behavior of the pilot and the UAV, and provides a basis for the subsequent proposal of safety constraints to limit the variation of the switching of autonomy levels.

[0144] Table 8 Analysis of variability in autonomous level switching

[0145]

[0146]

[0147] (4) Propose safety constraints for autonomous level switching

[0148] Safety constraints refer to specific restrictions established during system design, operation, and management to prevent danger, reduce risks, and ultimately avoid accidents or losses. These constraints can cover various aspects, including the structure, function, operation process, and personnel behavior of the system, and are intended to ensure the safety of the system under normal operation and abnormal conditions. For the UAV's autonomous level switching behavior in the human-machine teaming case, the corresponding safety constraints are proposed in Table 9, which are intended to prevent danger and ultimately avoid losses.

[0149] Table 9 Safety constraints for human-machine team collaborative combat missions

[0150]

Claims

1. A human-machine team safety analysis method based on FRAM considering dynamic switching of autonomy levels, characterized in that: The steps include: Step 1: Identify system functions: Identify the key functions of each task in the system during the human-machine team task execution process. In this step, it is necessary to identify task-related functions and autonomous level switching trigger functions. Step 2: Identify the six aspects of the function: Input (I), Output (O), Preconditions (P), Resources (R), Time (T), and Control (C); Step 3: Establish a nested structure within the function: Expand the traditional FRAM and establish a nested structure with multiple levels of autonomy within each function hexagon; describe in detail how each function is executed at different levels of autonomy; Step 4: Identify the variability of functions: Analyze and identify the variability of each function at different autonomy levels, including changes in inputs and outputs; focus on the variability of functions that trigger the switching of autonomy levels; Step 5: Identify coupling between functions: Analyze the interdependence and influence relationship between functions; the output of one function will be used as any one of the input, resources, premise, time, and control of another function; through the coupling analysis between functions, determine the coupling relationship between upstream and downstream functions; Step 6: Manage functional resonance: Assess the impact of functional resonance caused by coupling between functions on system security, and the unacceptable resonance phenomenon that may be caused during the switching of autonomy levels; by analyzing these potential risks, formulate safety constraints and mitigation measures to ensure the stable operation of the system under dynamic autonomy levels and reduce the safety risks caused by functional resonance.

2. According to claim 1, a FRAM-based human-machine team safety analysis method considering dynamic switching of autonomy levels is characterized by: The functions of the identification system described in step 1 are specifically: (1) Identify task-related functions The daily task flow of the system is identified as a set of functions. Functions related to the execution of system tasks are called task-related functions; they are used to describe the tasks or activities that need to be performed in the system; task-related functions include the activities that the system needs to perform to complete routine tasks, and their operation has a direct impact on the status of the task; (2) Identify all possible levels of autonomy of the function A function may be executed at multiple different autonomy levels; at different autonomy levels, the process of function execution and the resources and conditions required are different; according to the actual situation of task execution, identify the autonomy level of each task-related function during actual execution; for human-machine teaming systems, drones include four autonomy levels: manual operation, consent management, exception management, and high autonomy, and only the first three autonomy levels are considered here; each task-related function can work at different autonomy levels, so it is necessary to identify all the autonomy levels of the function; (3) Identify the autonomous level switching trigger function The switching of the autonomy level of the system is caused by triggering events. Triggering events have two sources: internal stimuli and external stimuli. Internal stimuli include events within the autonomous system, and external stimuli include events in the surrounding environment. Triggering events are the results of triggering the execution of the autonomy level switching functions, that is, the output of these functions. Therefore, it is necessary to identify these autonomy level switching triggering functions. For human-machine teaming systems, these functions include updating of mission phases, system communications, and detection of air defense firepower.

3. A human-machine team safety analysis method based on FRAM considering dynamic switching of autonomy levels according to claim 1 or 2, characterized in that: The six aspects of the identification function described in step 2 are: (1) Identify six aspects of task-related functions For the task-related functions identified in step 1, the six aspects of the task-related functions are analyzed in detail to identify the input, output, premise, resource, time and control of the function; when performing the analysis, follow the FRAM definition of the six aspects of the function: input is the condition or event that triggers the execution of the function; output is the result after the function is executed, which affects the subsequent system status; premise is the condition or resource that must be met before the function is executed; resource is the support or tool required for the execution of the function; time involves the execution time of the function and its scheduling in time; control refers to the mechanism and constraints that regulate the behavior of the function; use the table method to perform this analysis step; (2) Identify six aspects of autonomous level switching triggering functions For the autonomous level switching trigger function identified in step one, in accordance with FRAM's definition of the six aspects of the function, the six aspects of the autonomous level switching trigger function are analyzed in detail to identify the input, output, premise, resource, time and control of the function; similarly, this analysis step is performed using a tabular method or other appropriate method.

4. The method for analyzing the safety of human-machine teaming based on FRAM and considering dynamic switching of autonomy levels according to claim 1, characterized in that: The establishment of the internal nested structure of the function described in step 3 is as follows: (1) Identify nested functions at all levels of autonomy First, for all autonomy levels of mission-related functions, it is necessary to identify the nested functions under all autonomy levels according to the needs of mission execution. These nested functions constitute the main body of the internal nested structure of mission-related functions. In the functional hexagon of FRAM, according to the two aspects of control and execution, the control of functions is subdivided into three different autonomy levels: LoA1, LoA2, and LoA3, corresponding to the three functions of pilot control (LoA1), autonomous control module (LoA2), and autonomous control module (LoA3), respectively. The autonomous control module (LoA2) requires human approval, while the autonomous control module (LoA3) is supervised by humans. The execution of functions is divided into the flight control platform and the mission platform. (2) Determine the coupling relationship between nested functions After identifying all the internally nested functions, it is necessary to determine the coupling relationship between these functions, that is, the connection relationship between the six aspects of the functions; (3) Identify the correspondence between the six aspects of task-related functions and nested functions After determining the six aspects of the functional hexagon and the internal nested structure of the function, it is necessary to connect the internal nested structure with the external functional hexagon; according to the actual situation of the task, correspond the I, O, P, R, T, and C of the external functional hexagon to the six aspects of the function at different autonomy levels; the input (I) of the external functional hexagon is connected to the input (I) of the autonomous control module (LoA2), autonomous control module (LoA3), and pilot control (LoA1); the premise (P) of the external functional hexagon is connected to the premise (P) of the autonomous control module (LoA2), autonomous control module (LoA3), and pilot control (LoA1); the output (O) of the external functional hexagon is connected to the output (O) of the flight control platform and the mission platform.

5. The method for human-machine team safety analysis based on FRAM and considering dynamic switching of autonomy levels according to claim 4, characterized in that: Under LoA1, the UAV is manually controlled by the pilot, who issues commands to the UAV. The flight control platform of the UAV plans the flight route and adjusts the aircraft attitude according to the commands. The mission platform performs specific tasks according to the commands, including photographing targets and launching missiles. The output (O) of the pilot control (LoA1) is connected to the input (I) of the flight control platform and the mission platform. At LoA2, the UAV controls the flight and performs the mission autonomously, and the pilot supervises the UAV's behavior. At this level of autonomy, the UAV sends requests to the crew and needs the pilot's approval to perform planned key actions, including launching missiles. Therefore, the output (O) of the autonomous control module (LoA2) is connected to the input (I) of the flight control platform and the mission platform; the output (O) of the pilot's approval is connected to the control (C) of the autonomous control module (LoA2). Under LoA3, the UAV has a high degree of autonomy and can achieve fully autonomous flight and mission execution without the pilot's approval. It will only send a warning message to the pilot in an emergency, and the pilot can veto the UAV's actions or take over control. Therefore, the output (O) of the autonomous control module (LoA3) is connected to the input (I) of the flight control platform and the mission platform; the output (O) of the pilot's supervision is connected to the control (C) of the autonomous control module (LoA3).

6. The method for human-machine team safety analysis based on FRAM and considering dynamic switching of autonomy levels according to claim 1, characterized in that: The variability of the identification function described in step 4 is specifically: (1) Identify task-related functional output variability Variability refers to the deviation, change or inconsistency that may occur during the execution of a function. It is necessary to determine the output variability of task-related functions. The output of task-related functions may be affected by upstream functions or deviations in the execution of their own functions, resulting in variability, that is, the output results are inconsistent with expectations. Carefully check the output of each task-related function, analyze and describe the output results that may not meet expectations, that is, output variability. (2) Identifying the variability of the output of the autonomous level switching trigger function The output variability of all autonomous level switching trigger functions needs to be identified; The unexpected output results generated during the execution of the autonomous level switching trigger function lead to the trigger event of the autonomous level switching; carefully check the output of each autonomous level switching trigger function, analyze and describe the unexpected output results that the function may produce.

7. The method for human-machine team safety analysis based on FRAM considering dynamic switching of autonomy levels according to claim 1, characterized in that: The identification function coupling described in step 5 is specifically: (1) Identify the coupling between task-related functions Carefully examine all task-related functions, analyze and determine the coupling relationship between each task-related function; if the output of one function is a resource for another function, then establish a connection between the two elements to represent this coupling relationship; (2) Coupling between identification task-related functions and autonomous level switching trigger functions The autonomous level switching trigger function affects the task-related functions by outputting trigger events, and the task-related functions also affect the autonomous level switching trigger function; therefore, it is necessary to establish a connection between the task-related functions and the autonomous level switching trigger function to represent this coupling relationship; the trigger event serves as a prerequisite (P) for the task function, which means that the autonomous level will only switch after the trigger event occurs.

8. The method for human-machine team safety analysis based on FRAM and considering dynamic switching of autonomy levels according to claim 1, characterized in that: The management function resonance described in step six is ​​specifically: (1) Analyze safety-critical coupling Coupling relationships refer to the key dependencies and interactions between two or more functions in a system. If these relationships fail or have problems, they may have a significant impact on the overall security of the system. By analyzing these key couplings, potential safety hazards can be identified and preventive measures can be taken against them. (2) Propose measures to reduce functional resonance Once the potential functional resonance effects are identified, specific measures are taken to reduce or eliminate them through technical improvements, management improvements, and training and cultural improvements; (3) Analysis of the variability of autonomous level switching LoA switching refers to the process of the system switching from one autonomous operation level to another. Autonomous level switching can mutate into three different types: providing incorrect LoA switching instructions, not providing LoA switching instructions, and providing LoA switching instructions too early / too late. The results of these three variations may cause risks to the system. Not providing LoA switching instructions or providing incorrect LoA switching instructions may cause the LoA to not match the actual needs. Providing LoA switching instructions too early or too late may cause delays or early interruptions to the task. Use the table method to analyze the variability of LoA switching. Analyze and list each LoA switching process, the corresponding mutation type, and the LoA switching behavior of human and autonomous control module mutations; These identified variant LoA switching behaviors are the focus of attention, and effective safety constraints need to be proposed to limit them to ensure the safety of system operation; (4) Propose safety constraints for autonomous level switching Safety constraints are specific restrictions established during system design, operation and management to prevent hazards, reduce risks and ultimately avoid accidents or losses; these restrictions may include conditions that need to be met during switching, standardization of operating procedures, and training and qualification of personnel.

9. The method for analyzing human-machine team safety based on FRAM and considering dynamic switching of autonomy levels according to claim 8, characterized in that: Technical improvement measures include: system redundancy design, introducing backup mechanisms for key functions to reduce the risk of single point failure; reducing the variability of human operations through automated systems; deploying information monitoring and early warning systems to continuously monitor key parameters of functions; Management improvement measures include: clarifying roles and responsibilities, assigning clear responsibilities and authorities within the team, and ensuring that each function has a clear person in charge when it is executed; conducting regular risk assessments, identifying high-risk functional resonance effects, and developing targeted emergency plans; optimizing the allocation and use of system resources to avoid multiple functions relying on the same resources; Training and cultural improvement measures include: providing system operators with training on system working principles, functional interactions and potential risks; and enhancing personnel's awareness of resonance effects and system failure modes through risk awareness training.

10. The method for human-machine team safety analysis based on FRAM and considering dynamic switching of autonomy levels according to claim 8, characterized in that: The conditions that need to be met for autonomous level switching. By analyzing past operation data and accident reports and combining interviews with system designers, operators and experts in related fields, we can identify common problems and related environmental conditions or system states during the switching process. By identifying these potential risk factors, we can clarify the environmental conditions and safety constraints of the system states that need to be met for autonomous level switching. Standardize the operation steps, and sort out the key operation steps and conditions that need to be ensured through detailed analysis of the autonomous level switching process; Clarify each step of the switching process by drawing a flowchart or establishing a state transition diagram to ensure that the sequence and conditions of the operation steps meet the requirements; Personnel training and qualification certification requirements should clarify the specific skills and knowledge that operators need to have during the switching process based on the complexity and criticality of the autonomous level switching tasks; formulate operator competency standards based on task requirements and establish a certification mechanism to ensure that only personnel with the corresponding skills and knowledge can perform autonomous level switching operations; require operators to pass specific assessments and certifications to confirm that they have the required technical level; in addition, conduct regular skill training and switching process simulations to familiarize operators with the switching process under different conditions.

Images