A man-machine platoon safety analysis method considering autonomous level dynamic switching based on FRAM

Abstract

The application provides a man-machine team safety analysis method based on FRAM and considering autonomous level dynamic switching, which comprises the following steps: step 1, identifying the function of the system; step 2, identifying six aspects of the function; step 3, establishing the internal nested structure of the function; step 4, identifying the variability of the function; analyzing and identifying the variability of each function under different autonomous levels; step 5, identifying the coupling between functions; analyzing the mutual dependence and influence relationship between functions; step 6, managing function resonance; by analyzing these potential risks, safety constraints and mitigation measures are developed. The man-machine team safety analysis method based on FRAM and considering autonomous level dynamic switching solves the problem that the traditional FRAM method cannot accurately analyze the autonomous level switching process and its influence on system safety, so that the potential risks of the man-machine team system under the dynamic autonomous level are more comprehensively identified and managed, and the safety level of the man-machine team is improved.

Description

TECHNICAL FIELD

[0001] The application provides a man-machine team safety analysis method considering dynamic switching of autonomous levels, which is based on the Functional Resonance Analysis Method (FRAM) and proposes a nested structure inside the function hexagon to describe the dynamic autonomous levels. The nested structure is implanted into the task-related functions to describe the switching process of the task-related functions between multiple autonomous levels. It is an extension of the existing FRAM method and realizes the risk identification of man-machine teams with dynamic switching of autonomous levels. It belongs to the field of safety science and engineering technology and focuses on solving the problem that the traditional FRAM method cannot describe the dynamic switching of autonomous levels. BACKGROUND

[0002] With the rapid development of intelligent technology, more and more man-machine team systems are applied in various critical fields such as aviation, military, medical treatment, etc. In these systems, the cooperation between humans and autonomous systems becomes crucial, especially in the field of unmanned aerial vehicles (UAVs), where autonomous control of UAVs can adjust their level of autonomy (LoA) according to different situations. Traditional systematic safety analysis methods, such as the FRAM method, can be used to analyze the variability of functions in the system and the coupling effect of upstream and downstream functions, but they have limitations in handling the process of dynamic switching of autonomous levels and are difficult to describe the impact of this process on the safety of man-machine teams.

[0003] In the complex task environment of man-machine teams, the system often needs to switch the autonomous level dynamically according to the task demand and external environmental changes. The change of autonomous level will directly affect the execution and control mode of different functions in the man-machine team. During the process of dynamic switching of autonomous levels, the conversion between different autonomous levels has a direct impact on the execution mode, resource allocation, control right and information flow of system functions. This change not only affects the execution efficiency of the task, but also significantly affects the safety of the system. Since dynamic switching involves coordination and information transmission between multiple functions, any uncoordinated or delayed switching can lead to system function failure, resource waste, and even serious safety accidents.

[0004] Therefore, it is crucial to accurately identify potential hazards in the dynamic switching of human-robot team autonomy levels and analyze their impact on system safety. However, existing FRAM functions hexagons are fixed, and their core lies in analyzing the safety of the system through inter-functional coupling relationships, which has obvious limitations in describing and analyzing the dynamic switching of autonomy levels. In particular, FRAM lacks adaptability to the switching of autonomy levels in the system, and cannot effectively identify events that trigger the switching of autonomy levels, nor can it assess potential safety risks during the switching process. This deficiency limits the application of FRAM in human-robot teams, because the switching of autonomy levels directly affects the way functions are executed, the allocation of control rights, and the transfer of information, which in turn affects the overall safety of the system.

[0005] The innovative method proposed in the present application introduces the related functions and triggering events of autonomy level switching based on traditional FRAM, and represents the dynamic switching of autonomy levels in different functions through the internal nested structure of the functional hexagon. This method not only identifies and analyzes the events that trigger the switching of autonomy levels, but also accurately assesses the impact of the switching process on system safety, thereby providing a new analysis tool that effectively addresses the shortcomings of traditional FRAM methods in analyzing dynamic switching of autonomy levels, and enabling the discovery of functional variations and coupling during the dynamic switching of autonomy levels, providing important support for human-robot team risk management and safety improvement. SUMMARY

[0006] The present application aims to provide a FRAM-based human-robot team safety analysis method that considers dynamic autonomy levels, to address the problem that existing FRAM methods cannot accurately analyze the impact of dynamic switching of autonomy levels on human-robot team safety. The present application introduces a self-level switching model based on the nested structure of the functional hexagon, improving the traditional FRAM method to more finely describe the changing process of function execution under different autonomy levels, as well as the coupling relationship between functions during the switching of autonomy levels. The present application can more comprehensively analyze, identify, and manage potential risks of human-robot teams under dynamic autonomy levels, thereby improving the safety level of human-robot teams during task execution.

[0007] The present application is a FRAM-based human-robot team safety analysis method that considers dynamic switching of autonomy levels, as shown in the flowchart of Figure 1 The method comprises the following six steps:

[0008] Step one: Identify the functions of the system: For the task execution process of the human-robot team, identify the key functions of each task in the system. In this step, task-related functions and autonomy level switching trigger functions need to be identified.

[0009] Step two: Identify the six aspects of a function: For each function in the FRAM, further identify its "six aspects": Input (I), Output (O), Preconditions (P), Resources (R), Time (T), Control (C). Both task-related functions and autonomous level switching trigger functions need to be analyzed in this way.

[0010] Step three: Establish the nested structure of functions: To more comprehensively describe the dynamic switching of autonomous levels in the system, the traditional FRAM needs to be expanded to establish a nested structure of multiple autonomous levels within each "function hexagon". The main purpose of this structure is to describe in detail how each function is executed at different autonomous levels.

[0011] Step four: Identify the variability of functions: Analyze and identify the variability of each function at different autonomous levels, including changes in input and output. At the same time, special attention should be paid to the variability of autonomous level switching trigger functions, as the output variability of these functions is the trigger event that leads to autonomous level switching.

[0012] Step five: Identify inter-function coupling: Analyze the interdependence and influence between functions. For example, the output of one function may serve as any of the input, resource, precondition, time, or control of another function. Through inter-function coupling analysis, determine the coupling relationship between upstream and downstream functions.

[0013] Step six: Manage function resonance: Evaluate the impact of function resonance caused by inter-function coupling on system safety, especially during the autonomous level switching process, which may trigger unacceptable resonance phenomena. By analyzing these potential risks, develop appropriate safety constraints and mitigation measures to ensure stable operation of the system at dynamic autonomous levels and reduce safety hazards caused by function resonance.

[0014] Through the above steps, the FRAM-based human-machine team safety analysis method considering dynamic autonomous level switching solves the problem that traditional FRAM methods cannot accurately analyze the autonomous level switching process and its impact on system safety, thereby more comprehensively identifying and managing potential risks in human-machine team systems at dynamic autonomous levels, and improving the safety level of human-machine teams.

[0015] Among them, the "identification of system functions" described in step one is explained as follows:

[0016] (1) Identify task-related functions

[0017] The daily task flow of the system is identified as a set of "functions", and the functions related to the execution of system tasks are called "task-related functions". It is used to describe the tasks or activities that need to be performed in the system, which are usually the core components of system operation and are necessary to achieve the system goals. Task-related functions include activities that need to be performed to complete routine tasks, and their operation has a direct impact on the status of the task;

[0018] (2) Identify all possible autonomous levels of functions

[0019] A function can be executed at multiple different autonomous levels. At different autonomous levels, the process of function execution and the resources and conditions required may differ. In this step, according to the actual situation of task execution, the autonomous level at which each task-related function is actually executed is identified. For the human-machine teaming system, the unmanned aerial vehicle includes four autonomous levels: manual operation, consent management, exception management, and high autonomy. In this invention, considering that the high autonomy mode of the unmanned aerial vehicle has not yet been achieved in actual combat, only the first three autonomous levels are considered. Each task-related function can work at different autonomous levels, so it is necessary to identify all autonomous levels of the function;

[0020] (3) Identify autonomous level switching trigger functions

[0021] The autonomous level switching of the system is caused by trigger events. Trigger events have two sources: internal stimuli and external stimuli. Internal stimuli include events within the autonomous system, and external stimuli include events in the surrounding environment. And the trigger event is the result of "triggering autonomous level switching functions", that is, the output of these functions. Therefore, in this step, it is necessary to study how trigger events are generated, that is, to identify these autonomous level switching trigger functions. For the human-machine teaming system, these functions include task phase updating, system communication, detection of air defense firepower, etc.

[0022] Among them, the "six aspects of identifying functions" described in step two are as follows:

[0023] (1) Identify the six aspects of task-related functions

[0024] For the task-related function identified in step one, the six aspects of "task-related function" are analyzed in detail, and the input, output, premise, resource, time and control of the function are identified. In the execution analysis, the definition of FRAM for the six aspects of the function is followed: the input is the condition or event that triggers the execution of the function; the output is the result generated after the execution of the function, which affects the subsequent system state or other functions; the premise is the condition or resource that must be met before the function is executed; the resource is the support or tool required for the execution of the function; the time relates to the execution time of the function and its scheduling in time; the control refers to the mechanism and constraint conditions for regulating the behavior of the function. This analysis step can be performed by table method or other suitable methods;

[0025] (2) Identify the six aspects of the autonomous level switching trigger function

[0026] For the autonomous level switching trigger function identified in step one, the definition of FRAM for the six aspects of the function is followed, and the six aspects of "autonomous level switching trigger function" are analyzed in detail, and the input, output, premise, resource, time and control of the function are identified. Similarly, this analysis step can be performed by table method or other suitable methods;

[0027] Among them, the "establishment of the internal nested structure of the function" in step three is described as follows:

[0028] (1) Identify all nested functions at all autonomous levels

[0029] First, for all autonomous levels of the task-related function, according to the needs of task execution, all nested functions at all autonomous levels are identified, which constitute the main body of the internal nested structure of the task-related function. As shown in Figure 2 In the FRAM function hexagon, according to the two aspects of control and execution, the control of the function is divided into three different autonomous levels: LoA1, LoA2, LoA3, which correspond to three functions "pilot control (LoA1)", "autonomous control module (LoA2)" and "autonomous control module (LoA3)", respectively, among which the autonomous control module (LoA2) needs "human approval", and the autonomous control module (LoA3) is supervised by "human"; the execution of the function is divided into "flight control platform" and "task platform".

[0030] (2) Determine the coupling relationship between nested functions

[0031] After identifying all internal nested functions, the coupling relationship between these functions needs to be determined, that is, the connection relationship between the six aspects of the function. The coupling relationship between the internal nested functions is shown in Figure 2

[0032] ​Under LoAl, the UAV is manually controlled by the pilot, who gives the UAV instructions, which the "flight control platform" of the UAV follows to plan the flight path and adjust the aircraft's attitude. The "mission platform" follows the instructions to perform specific tasks, such as taking pictures of the target or launching a missile. Therefore, the output (O) of the "pilot control (LoAl)" is connected to the input (I) of the "flight control platform" and the "mission platform".

[0033] Under LoA2, the UAV autonomously controls the flight and performs the tasks, while the pilot supervises the UAV's behavior. Under this autonomy level, the UAV sends requests to the crew and needs human approval to perform planned key actions, such as launching a missile. Therefore, the output (O) of the "autonomous control module (LoA2)" is connected to the input (I) of the "flight control platform" and the "mission platform". The output (O) of the "human approval" is connected to the control (C) of the "autonomous control module (LoA2)".

[0034] Under LoA3, the UAV has a high degree of autonomy and can achieve fully autonomous control of flight and task execution without human approval, except in emergency situations, when the pilot is sent an alert message, who can veto the UAV's actions or take over control. Therefore, the output (O) of the "autonomous control module (LoA3)" is connected to the input (I) of the "flight control platform" and the "mission platform". The output (O) of the "human supervision" is connected to the control (C) of the "autonomous control module (LoA3)".

[0035] (3) Identify the corresponding relationship between task-related functions and nested functions in six aspects

[0036] After determining the "six aspects" of the functional hexagon and the internal nested structure of the functions, the internal nested structure and the external functional hexagon need to be connected. According to the actual situation of the task, the I, O, P, R, T, and C of the external functional hexagon are connected to the six aspects of the functions under different autonomy levels. Figure 2 In the "autonomous control module (LoA2)", the input (I) of the external functional hexagon is connected to the input (I) of the "autonomous control module (LoA2)", the "autonomous control module (LoA3)", and the "pilot control (LoAl)". The premise (P) of the external functional hexagon is connected to the premise (P) of the "autonomous control module (LoA2)", the "autonomous control module (LoA3)", and the "pilot control (LoAl)". The output (O) of the external functional hexagon is connected to the output (O) of the "flight control platform" and the "mission platform".

[0037] In step four, the "identification of the variability of the functions" is described as follows:

[0038] (1) Identify the variability of the output of the task-related functions

[0039] Variability refers to the deviation, change or inconsistency that can occur in the execution of a function. In this step, the output variability of the task-related function needs to be determined, which can be affected by the upstream function or the deviation in the execution of the function itself, resulting in variability, i.e. the output result is inconsistent with the expectation. Carefully check the output of each task-related function, analyze and describe the unexpected output result that the function may produce, i.e. the output variability.

[0040] (2) Identify the output variability of the autonomous level switching trigger function

[0041] In this step, the output variability of all autonomous level switching trigger functions needs to be identified. The unexpected output result produced by the execution of the "autonomous level switching trigger function" is the "trigger event" that leads to the autonomous level switching. Carefully check the output of each autonomous level switching trigger function, analyze and describe the unexpected output result that the function may produce.

[0042] Among them, the "identification of function coupling" described in step five is as follows:

[0043] (1) Identify the coupling between task-related functions

[0044] As a qualitative representation, FRAM function coupling represents how different functions affect each other, or in some cases, the execution of one function may change the input, output or other aspects of another function. In this step, all task-related functions are carefully checked, analyzed and determined to establish the coupling relationship between each task-related function. For example, the output of one function is the resource of another function, then a connection is established between the two elements to represent this coupling relationship.

[0045] (2) Identify the coupling between task-related functions and autonomous level switching trigger functions

[0046] Autonomous level switching trigger functions affect task-related functions through output trigger events, which mainly manifest in causing autonomous level switching. On the other hand, task-related functions also affect autonomous level switching trigger functions. Therefore, in this step, a connection needs to be established between task-related functions and autonomous level switching trigger functions to represent this coupling relationship. In particular, the trigger event serves as the premise (P) of the task function, which means that only after the trigger event occurs, the autonomous level will switch.

[0047] Among them, the "management of function resonance" described in step six is as follows:

[0048] (1) Analyze safety-critical coupling

[0049] This step aims to identify and analyze the coupling relationships in the system that are critical to security. These coupling relationships refer to the key dependencies and interactions between two or more functions in the system, which, if failed or problematic, can have a significant impact on the overall security of the system. By analyzing these critical couplings, potential security risks can be identified, and preventive measures can be taken against these risks.

[0050] (2) Propose measures to reduce functional resonance

[0051] Once potential functional resonance effects are identified, this step involves proposing specific measures to reduce or eliminate these resonance effects. Measures may include technical improvements, management improvements, and training and cultural improvements.

[0052] Technical improvement measures may include: system redundancy design, introducing backup mechanisms (such as hardware or software redundancy) for critical functions to reduce the risk of single-point failure; reducing the variability of human operation through automated systems; deploying information monitoring and early warning systems to continuously monitor key parameters of functions, etc. Management improvement measures may include: clearly defining roles and responsibilities, assigning clear responsibilities and permissions in the team, ensuring that each function has a clear person responsible for its execution; regularly conduct risk assessment, identify high-risk functional resonance effects, and develop targeted contingency plans; optimize the allocation and use of system resources to avoid multiple functions relying on the same resources, etc. Training and cultural improvement measures may include: providing training for system operators on system working principles, function interaction and potential risks; through risk awareness training, enhance personnel's awareness of resonance effects and system failure modes, etc.

[0053] The purpose of this step is to reduce or eliminate the negative impact of functional resonance on the system through these measures, and to enhance the stability and security of the system.

[0054] (3) Analyze self-autonomous level switching variability

[0055] This step focuses on analyzing and identifying potential unexpected LoA switching behaviors when the system switches between different levels of autonomy (LoA). LoA switching refers to the process of transitioning from one level of autonomous operation to another. There are three different types of LoA switching variations: providing incorrect LoA switching instructions, not providing LoA switching instructions, and providing LoA switching instructions too early / late. All three variations can potentially pose risks to the system, such as mismatching LoA with actual needs when not providing LoA switching instructions or providing incorrect LoA switching instructions, or delaying or prematurely interrupting tasks when providing LoA switching instructions too early or late. A table method can be used to analyze the variability of LoA switching. Analyze and list each LoA switching process, the corresponding variation type, and the LoA switching behavior of personnel and autonomous control module variations. These identified LoA switching behaviors are the focus of attention, and effective safety constraints need to be proposed to limit them to ensure the safety of system operation.

[0056] (4) Propose safety constraints for LoA switching

[0057] Based on the results of the LoA switching variability analysis, specific safety constraints (SC) are proposed to ensure the safety of the LoA switching process. Safety constraints refer to specific restrictions established during system design, operation, and management to prevent hazards, reduce risks, and ultimately avoid accidents or losses. These restrictions may include conditions that need to be met during the switching process (such as environmental parameters, system state), standardization of operation steps (such as detailed switching procedures), and personnel training and qualification (such as ensuring that operators have the necessary skills and knowledge).

[0058] The conditions that need to be met for LoA switching can be identified by analyzing past operational data and accident reports, and combining interviews with system designers, operators, and experts in related fields to identify common problems and related environmental conditions or system states during the switching process. By identifying these potential risk factors, safety constraints for environmental conditions and system states that need to be met for LoA switching can be clearly defined.

[0059] Operation step standardization can be achieved by analyzing the LoA switching process in detail and identifying key operation steps and conditions that need to be ensured. Flowcharts or state transition diagrams can be used to clearly define each step of the switching process, ensuring that the order of operation steps and conditions meet the requirements.

[0060] The training and qualification requirements of personnel can switch the complexity and criticality of the task according to the autonomous level, and the specific skills and knowledge required for the operator during the switching process are clear. For example, it is necessary to understand which environmental parameters, how to identify the system state, how to deal with switching failure, etc. Based on the task requirements, the ability standards of the operating personnel are formulated, and the certification mechanism is established to ensure that the personnel with corresponding skills and knowledge can perform autonomous level switching operation. For example, the operator can be required to pass a specific examination and certification to confirm that they have the required technical level. In addition, regular skill training and switching process simulation can be carried out to make the operator familiar with the switching process under different conditions.

[0061] The purpose of this step is to limit the negative impact of autonomous level switching variability on the system by proposing safety constraints for system autonomous level switching, and to ensure that the system can operate stably and reliably under dynamic autonomous level.

[0062] The efficacy and advantages of the present application are:

[0063] Based on the FRAM method, the present application proposes a safety analysis method for dynamic autonomous level human-machine team, which can effectively identify and manage the system safety hazards caused by autonomous level switching and functional variability. By introducing dynamic change analysis of autonomous level, the safety of the system under complex tasks and different autonomous levels is improved, and specific safety improvement measures are proposed to enhance the stability of the system and the safety guarantee of task execution. The safety analysis method described in the present application is scientific, good in process, and has wide application value. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 The flow chart of the dynamic autonomous level human-machine team safety analysis method based on FRAM described in the present application.

[0065] Figure 2 The internal nested structure diagram of the functional hexagon three autonomous levels described in the present application.

[0066] Figure 3 The manned / unmanned aerial vehicle formation FRAM task related function internal nested structure described in the present application.

[0067] Figure 4 The manned / unmanned aerial vehicle formation FRAM model described in the present application.

[0068] The foreign language symbols and codes involved in the present specification are summarized as follows:

[0069] Functional Resonance Analysis Method, FRAM - Functional Resonance Analysis Method;

[0070] Level of Automation, LoA - Autonomy Level

[0071] Unmanned Aerial Vehicle, UAV - Unmanned Aerial Vehicle

[0072] Multi-Purpose Displays, MPDs - Multi-Purpose Displays

[0073] Keyboard Unit, KU - Keyboard Unit

[0074] Mission Control Grip, MCG - Mission Control Grip

[0075] Tactical Common Data Link, TCDL - Tactical Common Data Link

[0076] Global Positioning System, GPS - Global Positioning System

[0077] Modernized Target Acquisition Designation Sight, MTADS - Modernized Target Acquisition Designation Sight

[0078] Safety Constraints, SC - Safety Constraints DETAILED DESCRIPTION

[0079] The application is a dynamic autonomous level man-machine team safety analysis method based on FRAM. The process is illustrated by taking a man-machine team (manned aircraft / unmanned aircraft formation) formed by a helicopter and a UAV to execute a task of attacking enemy ground targets as an example. The task of attacking enemy targets by the man-machine team has typical multi-stage task characteristics, mainly including four stages of reconnaissance, developing combat plans, attacking targets, and re-forming. The autonomy level of the UAV in the task is dynamically changing, which brings the problem of dynamic switching of autonomy level, thereby increasing the risk of accidents of the system.

[0080] During the collaborative combat mission process of human-machine teaming, drones perform tasks at different levels of autonomy. During the reconnaissance phase, if a drone enters a dangerous area and is locked onto by enemy fire control radar, it will switch to LoA1, where the pilot will manually control it and conduct electronic countermeasures. Otherwise, it will autonomously complete the reconnaissance mission at LoA3, providing target reference points and battlefield terrain. Subsequently, during the combat planning phase, the drone will autonomously plan and request pilot approval at LoA2. ​​If the battlefield situation is urgent, it will switch to LoA3 to autonomously formulate and execute the plan. The target strike phase usually requires LoA2, with the pilot approving the attack. However, in complex situations, the drone will switch to LoA3, where the drone will autonomously control the strike. Finally, during the reorganization phase, the drone must disengage from the battlefield at LoA1 or LoA3, depending on the enemy threat.

[0081] In manned / unmanned aerial vehicle (UAV) teaming missions, several key helicopter components are crucial for manned / unmanned aerial vehicle (UAV) collaboration. These components include the Tactical Common Data Link (TCDL), Keyboard Unit (KU), Mission Control Grip (MCG), Multi-Purpose Displays (MPDs), Global Positioning System (GPS), and Modernized Target Acquisition Designation Sight (MTADS). These components, as the "resources" in the FRAM functional hexagon, play a key role in the execution of the function.

[0082] The present invention is a FRAM-based human-machine team safety analysis method considering the dynamic switching of autonomy levels. The process of dynamic changes in the autonomy level of UAVs in the above-mentioned human-machine team mission is analyzed in detail. The flow chart of this method is as follows: Figure 1 As shown, the method includes the following five steps:

[0083] Step 1: Identify the system's functionality

[0084] (1) Identify task-related functions

[0085] Four mission-related functions of human-machine teaming FRAM are identified: reconnaissance, battle planning, targeting, and re-formation.

[0086] (2) Identify all possible levels of autonomy of the function

[0087] According to the human-machine team task analysis, the autonomous level of the four task stages is identified as follows: the autonomous level of the UAV in the reconnaissance stage is LoA1 and LoA3, the autonomous level of the UAV in the combat plan making stage is LoA2 and LoA3, the autonomous level of the UAV in the target attack stage is LoA2 and LoA3, and the autonomous level of the UAV in the reformation stage is LoA1 and LoA3.

[0088] (3) Identify the autonomous level switching trigger function

[0089] The five autonomous level switching trigger functions are: enemy radar lock detection, manned / unmanned aircraft communication, task stage update, air defense firepower detection, and combat situation analysis.

[0090] Step two: identify the six aspects of the function

[0091] (1) Identify the six aspects of the task-related function

[0092] The six aspects of the FRAM task-related function are identified in the form of a table. Tables 1-4 perform FRAM analysis on the four task-related functions, and identify the six aspects of the function, namely I, O, P, R, T and C.

[0093] Table 1: Six aspects of the reconnaissance stage

[0094]

[0095]

[0096] Table 2: Six aspects of the combat plan making function

[0097]

[0098]

[0099] Table 3: Six aspects of the target attack function

[0100]

[0101] Table 4: Six aspects of the reformation function

[0102]

[0103]

[0104] (2) Identify the six aspects of the autonomous level switching trigger function

[0105] The six aspects of the five autonomous level switching trigger functions are identified in Table 5.

[0106] Table 5 Six aspects of autonomous level switching trigger function

[0107]

[0108] Step three: Establish the internal nested structure of function

[0109] (1) Identify all nested functions under autonomous level

[0110] The autonomous level that the two task-related functions of "reconnaissance" and "reformation" can be in is LoAl or LoA3, so their internal nested functions include: pilot control (LoAl), autonomous control module (LoA3), human supervision, flight control platform, and task platform.

[0111] The autonomous level that the two task-related functions of "formulate battle plan" and "attack target" can be in is LoA2 or LoA3, so their internal nested functions include: autonomous control module (LoA2), autonomous control module (LoA3), human approval, human supervision, flight control platform, and task platform.

[0112] (2) Determine the coupling relationship between nested functions

[0113] Based on the internal nested structure of the human-machine team formation FRAM function hexagon, Figure 2 the internal nested structure of each task-related function for the four specific task stages is determined, as shown in Figure 3 For the two functions of "reconnaissance" and "reformation", they do not include the two nested functions of "autonomous control module (LoA2)" and "human approval", so based on Figure 2 , the two nested functions and the coupling lines related to them are removed, which constitutes the coupling relationship between the nested functions of "reconnaissance" and "reformation". For the two functions of "formulate battle plan" and "attack target", they do not include the nested function of "pilot control (LoAl)", so based on Figure 2 , the nested function and the coupling lines related to it are removed, which constitutes the coupling relationship between the nested functions of "formulate battle plan" and "attack target".

[0114] (3) Identify the correspondence between the six aspects of task-related functions and nested functions

[0115] After determining the internal nested functions and their coupling relationships, the six aspects of task-related functions and the six aspects of nested functions need to be corresponded. The four task-related functions are analyzed in detail to find the input, output, resource, premise, time, and control required for task execution under different autonomous levels. The six aspects of task-related functions are assigned to their internal nested functions in Tables 1-4.

[0116] Step four: Identify variability of functions

[0117] (1) Identify variability of task-related function outputs

[0118] In the human-UAV teaming system with dynamic autonomy levels, the execution of functions is not only affected by the triggering events, but also leads to variability of outputs due to the changes within the functions. In order to fully understand and control the impact of these variabilities on the overall performance and safety of the system, it is necessary to identify and analyze the variability of each function in detail. Table 6 analyzes the variability of task-related functions in the human-UAV teaming FRAM in detail.

[0119] Variability of task-related function outputs

[0120]

[0121]

[0122] (2) Identify variability of autonomy level switching trigger function outputs

[0123] According to the function variability analysis in Table 7, the variability of autonomy level switching trigger function outputs is the "triggering event" that leads to the switching of the UAV autonomy level, which includes: the UAV being locked by an enemy fire control radar, communication interruption, switching command error, switching command delay, intense anti-aircraft fire, and urgent battlefield situation.

[0124] Variability of autonomy level switching trigger function outputs

[0125]

[0126]

[0127] Step five: Identify coupling between functions

[0128] (1) Identify coupling between task-related functions

[0129] According to Tables 1-4, the coupling relationship between functions can be determined. The coupling relationship of task-related functions is as follows: the outputs of the reconnaissance phase (target reference point and battlefield terrain) serve as inputs for the planning phase; the outputs of the planning phase (attack mode, flight route) serve as inputs for the target attack phase; the outputs of the target attack phase (target destruction confirmation) serve as inputs for the reformation phase.

[0130] (2) Identify coupling between task-related functions and autonomy level switching trigger functions

[0131] The coupling relationship between the task-related functions and the autonomous level switching trigger functions is as follows: the output of the enemy radar lock detection (UAV is locked by the enemy fire control radar) as a prerequisite for the reconnaissance phase and the reformation phase; the output of the manned aircraft / unmanned aircraft communication (communication data) as a prerequisite for the reconnaissance phase and the reformation phase; the output of the updated task phase (autonomous level switching instruction) as a prerequisite for the reconnaissance phase, the combat plan development phase and the target attack phase; the output of the air defense fire detection (air defense fire density) as a prerequisite for the combat plan development phase; the output of the combat situation analysis (combat situation data) is a prerequisite for the target attack phase.

[0132] Based on steps one to five, according to the manned aircraft / unmanned aircraft formation FRAM function, the internal nested structure of the task-related function, and the coupling relationship between functions, the FRAM model of the manned aircraft / unmanned aircraft formation is established, as shown in Figure 4 .

[0133] Step 6: Management of functional resonance

[0134] (1) Analysis of safety critical coupling

[0135] In the manned aircraft / unmanned aircraft formation task, multiple functions in the reconnaissance, target attack and reformation phases have a direct impact on system-level hazards. Among them, the output of the reconnaissance phase "F6 - pilot control" function has a key role in the crash of the unmanned aircraft and the failure of the task, the output of the target attack phase "F22 - task platform" affects the task failure, and the "F23 - pilot control" function in the reformation phase also affects the task failure. The variability of these functions mainly comes from the output of the upstream functions, especially in the reconnaissance phase, the enemy radar lock information is crucial for the rapid reaction of the pilot.

[0136] (2) Measures to reduce functional resonance

[0137] In order to effectively deal with the functional resonance caused by the FRAM key coupling relationship, and to ensure the safety and reliability of the system in complex combat environment, a series of management measures must be developed and implemented. These measures will focus on the reliability of information transmission, the redundancy and automation of functions, the coordination and synchronization between functions, and the decision support and training of pilots, etc., aiming to reduce or eliminate the potential risk of functional resonance, so as to improve the overall performance of the system. The proposed improvement measures are as follows:

[0138] (a) Improve the reliability and timeliness of information transmission: enhance the transmission channel of radar lock information, ensure that "UAV is locked state" is transmitted to the pilot in time through redundant channels, and introduce an automatic alarm mechanism. Prioritize key battlefield information to ensure priority transmission and reduce delay.

[0139] (b) Increase functional redundancy and automated response: Increase the redundancy design of pilot tasks, and when the pilot does not respond in time, the system automatically switches the UAV to manual operation and performs preliminary electronic countermeasures. Enhance the automation capabilities of the autonomous control module, automatically analyze inputs and make quick decisions, and reduce human intervention.

[0140] (c) Enhance coordination and synchronization between functions: Ensure synchronization of functions in task stages, increase task completion prompting functions to allow pilots to accurately adjust strategies. Optimize the transition of functions across stages, standardize data transmission, and avoid resonance caused by information delay or loss.

[0141] (d) Decision support and training for pilots: Provide real-time decision support tools, dynamically assess system risks and provide response recommendations. Conduct regular simulations to improve pilots' ability to respond to information delays and autonomous level switching risks.

[0142] (3) Analysis of autonomous level switching variability

[0143] In manned / unmanned aircraft cooperative combat missions, there is a switch in the autonomous level within each individual task stage, and there is also a switch in the autonomous level between two adjacent task stages. Autonomous level switching can be varied into three different types: providing incorrect LoA switching instructions, not providing LoA switching instructions, and providing LoA switching instructions too early / late. The results of these three variations may pose risks to the system. Table 8 lists the manned / unmanned aircraft formation autonomous level switching variability analysis, which describes each LoA switching behavior and determines the variation type of LoA switching behavior, identifies the pilot and unmanned aircraft variation LoA switching behavior, and provides a basis for subsequent safety constraints to limit autonomous level switching variations.

[0144] Table 8 Autonomous Level Switching Variability Analysis

[0145]

[0146]

[0147] (4) Safety constraints for autonomous level switching

[0148] Safety constraints refer to specific restrictions made during system design, operation, and management processes to prevent hazards, reduce risks, and ultimately avoid accidents or losses. These constraints can cover various aspects, including system structure, function, operation process, and personnel behavior, aiming to ensure system safety under normal operation and abnormal conditions. For the autonomous level switching behavior of UAVs in manned aircraft formation cases, corresponding safety constraints are proposed in Table 9, which aim to prevent hazards and ultimately avoid losses.

[0149] Table 9 Safety constraints for human-machine team cooperative engagement tasks

[0150]

Claims

1. A method for analyzing the safety of human-machine platooning based on FRAM considering autonomous level dynamic switching, characterized in that, The method comprises the following steps: Step 1: Identify the functions of the system: identify the key functions of each task in the system for the human-machine team task execution process; in this step, the task-related functions and autonomous level switching trigger functions need to be identified; Step 2: Identify the six aspects of the function: including: input I, output O, precondition P, resource R, time T, control C; Step 3: Establish the internal nested structure of the function: extend the traditional FRAM and establish a nested structure of multiple autonomous levels inside each function hexagon; describe in detail the execution mode of each function at different autonomous levels; Step 4: Identify the variability of the function: analyze and identify the variability of each function at different autonomous levels, including the changes of input and output; pay attention to the variability of the autonomous level switching trigger function; Step 5: Identify the coupling between functions: analyze the mutual dependence and influence relationship between functions; the output of one function can be used as any one of the input, resource, precondition, time, and control of another function; through the coupling analysis between functions, the coupling relationship between upstream and downstream functions is determined; Step 6: Manage function resonance: evaluate the impact of function resonance generated by the coupling between functions on system safety, and the unacceptable resonance phenomenon that may be triggered during the autonomous level switching process; by analyzing these potential risks, safety constraints and mitigation measures are developed to ensure stable operation of the system at the dynamic autonomous level and reduce the safety hazards caused by function resonance; In step 3, the establishment of the internal nested structure of the function is specifically as follows: 3.1 Identify all nested functions at all autonomous levels First, for all autonomous levels of the task-related function, according to the needs of task execution, all nested functions at all autonomous levels are identified, which constitute the main body of the internal nested structure of the task-related function; in the function hexagon of FRAM, according to the control and execution, the control of the function is divided into 3 different autonomous levels: LoA1, LoA2, LoA3, which correspond to three functions: pilot control LoA1, autonomous control module LoA2 and autonomous control module LoA3, wherein the autonomous control module LoA2 needs the approval of the person, and the autonomous control module LoA3 is supervised by the person; the execution of the function is divided into flight control platform and task platform; 3.2 Determine the coupling relationship between nested functions After identifying all internal nested functions, the coupling relationship between these functions needs to be determined, that is, the connection relationship between the six aspects of the function; 3.3 Identify the correspondence between the six aspects of the task-related function and the nested function After the six aspects of the functional hexagon and the internal nested structure of the function are determined, the internal nested structure and the external functional hexagon need to be connected; according to the actual situation of the task, the I, O, P, R, T and C of the external functional hexagon are corresponded to the six aspects of the function under different autonomous levels; the input I of the external functional hexagon is connected with the input I of the autonomous control module LoA2, the autonomous control module LoA3 and the pilot control LoA1; the premise P of the external functional hexagon is connected with the premise P of the autonomous control module LoA2, the autonomous control module LoA3 and the pilot control LoA1; the output O of the external functional hexagon is connected with the output O of the flight control platform and the task platform; wherein In step four, the variability of the identified function is described as follows: 4.1 Identify the output variability of the task-related function Variability refers to the deviation, change or inconsistency that may occur in the execution process of the function; it is necessary to determine the output variability of the task-related function, which may be affected by the upstream function or the deviation of the function itself in the execution, resulting in variability, that is, the inconsistency between the output result and the expectation; carefully check the output of each task-related function, analyze and describe the unexpected output result that the function may produce, that is, the output variability; 4.2 Identify the output variability of the autonomous level switching trigger function All output variability of autonomous level switch trigger functions need to be identified; The unexpected output result produced by the autonomous level switching trigger function in the execution process leads to the triggering event of autonomous level switching; carefully check the output of each autonomous level switching trigger function, analyze and describe the unexpected output result that the function may produce; In step five, the coupling between functions is described as follows: 5.1 Identify the coupling between task-related functions Carefully check all task-related functions, analyze and determine the coupling relationship between each task-related function; including the output of one function is the resource of another function, then a connection is established between the two elements to represent this coupling relationship; 5.2 Identify the coupling between task-related functions and autonomous level switching trigger functions The autonomous level switching trigger function has an impact on the task-related function through the output trigger event, and the task-related function also has an impact on the autonomous level switching trigger function; therefore, a connection needs to be established between the task-related function and the autonomous level switching trigger function to represent this coupling relationship; the trigger event as the premise P of the task function, which indicates that only after the trigger event occurs, the autonomous level will be switched.

2. The FRAM-based human-machine team safety analysis method considering dynamic switching of autonomous level according to claim 1, characterized in that the functions of the system in step one are described as follows: 1.1 Identify the task-related function The daily task process of the system is identified as a set of functions, and the functions related to the execution of the system task are called task-related functions; it is used to describe the tasks or activities that need to be executed in the system; the task-related function includes the activities required for the system to complete the routine task, and its operation has a direct impact on the state of the task; 1.2 Identify all possible autonomous levels of the function ​ One function can be executed at multiple different levels of autonomy; the process of function execution and the required resources, conditions are different at different levels of autonomy; according to the actual situation of task execution, the level of autonomy of each task-related function in actual execution is identified; for the human-robot team system, the unmanned aerial vehicle includes four levels of autonomy: manual operation, consent management, exception management and high autonomy, and only the first three levels of autonomy are considered here; Each task-related function can work at different levels of autonomy, so all levels of autonomy of the function need to be identified; 1.3 Identify the autonomous level switching trigger function The autonomous level switching of the system is caused by trigger events; trigger events have two sources: internal stimuli and external stimuli, internal stimuli include events within the autonomous system, and external stimuli include events in the surrounding environment; and trigger events are the result of triggering the execution of autonomous level switching functions, that is, the output of these functions; Therefore, these autonomous level switching trigger functions need to be identified; For the human-robot team system, these functions include task phase update, system communication, and detection of anti-aircraft fire.

3. The human-robot team safety analysis method considering dynamic switching of autonomous levels based on FRAM according to claim 1 or 2, characterized in that the six aspects of the identified functions in step two are specifically: 2.1 Identify the six aspects of the task-related function For the task-related functions identified in step one, the six aspects of the task-related functions are analyzed in detail to identify the input, output, premise, resource, time and control of the function; In the execution analysis, follow the FRAM definition of the six aspects of the function: the input is the condition or event that triggers the execution of the function; The output is the result produced after the execution of the function, which affects the subsequent system state; The premise is the condition or resource that must be met before the function is executed; The resource is the support or tool required for the execution of the function; Time refers to the execution time of the function and its scheduling in time; Control refers to the mechanism and constraints that regulate the behavior of the function; This analysis step is performed using a table method; 2.2 Identify the six aspects of the autonomous level switching trigger function For the autonomous level switching trigger functions identified in step one, follow the FRAM definition of the six aspects of the function to analyze the six aspects of the autonomous level switching trigger function in detail to identify the input, output, premise, resource, time and control of the function; Similarly, this analysis step is performed using a table method or other appropriate method.

4. The method of claim 1, wherein the autonomous level is determined based on the FRAM. Under LoA1, the unmanned aerial vehicle is manually controlled by the pilot, and the pilot gives the unmanned aerial vehicle instructions, and the flight control platform of the unmanned aerial vehicle plans the flight route and adjusts the aircraft attitude according to the instructions; The task platform executes specific tasks according to the instructions, including photographing targets and launching missiles; The pilot controls the output O of LoA1 and the input I of the flight control platform and the task platform are connected; At LoA2, the UAV autonomously controls flight and performs tasks, with the pilot supervising the UAV's behavior; at this level of autonomy, the UAV sends requests to the crew and needs the pilot's approval to perform planned key actions, including missile launch; therefore, the output O of the autonomous control module LoA2 is connected to the input I of the flight control platform and the mission platform; the pilot's approval output O is connected to the control C of the autonomous control module LoA2; At LoA3, the UAV has high autonomy and can achieve fully autonomous flight and task execution without the pilot's approval, and only sends alert information to the pilot in emergency situations, and the pilot can veto the UAV's actions or take over control; therefore, the output O of the autonomous control module LoA3 is connected to the input I of the flight control platform and the mission platform; the pilot's supervision output O is connected to the control C of the autonomous control module LoA3.

5. The method of claim 1, wherein the FRAM-based human-vehicle platooning safety analysis method considers dynamic switching of autonomous levels. The management function resonance described in step six is as follows: 6.1 Analyze safety-critical coupling Coupling refers to the key dependencies and interactions between two or more functions in the system, and if these relationships fail or have problems, they may have a significant impact on the overall safety of the system; by analyzing these key couplings, potential safety hazards are identified, and preventive measures are taken to address these hazards; 6.2 Propose measures to reduce functional resonance Once potential functional resonance effects are identified, these effects can be reduced or eliminated through technical improvements, management improvements, and training and cultural improvements; 6.3 Analyze LoA switching variability LoA switching refers to the process of switching the system from one autonomous operating level to another; LoA switching can be varied into three different types: providing incorrect LoA switching instructions, not providing LoA switching instructions, and providing LoA switching instructions too early / late; the results of these three variations may pose risks to the system, and if no LoA switching instructions are provided or incorrect LoA switching instructions are provided, the LoA may not match the actual requirements, and providing LoA switching instructions too early or late may cause the task to be delayed or interrupted prematurely; use table method to analyze the variability of LoA switching; Analyze and list each LoA switching process, the corresponding variation type, and the LoA switching behavior of personnel and autonomous control modules; These identified LoA switching behaviors are the focus of attention, and effective safety constraints need to be proposed to limit them to ensure the safety of system operation; 6.4 Propose safety constraints for LoA switching Safety constraints refer to specific restrictions developed during system design, operation, and management to prevent hazards, reduce risks, and ultimately avoid accidents or losses; these restrictions may include conditions that need to be met during switching, standardization of operation steps, and personnel training and qualification.

6. The method of claim 5, wherein the autonomous level is determined based on the FRAM. Technical improvement measures include: system redundancy design, introducing backup mechanisms for critical functions to reduce the risk of single-point failure; reducing the variability of human operation through automated systems; deploying information monitoring and early warning systems to continuously monitor key parameters of functions; Management improvement measures include: clearly defining roles and responsibilities, assigning clear responsibilities and permissions in the team, and ensuring that each function has a clear person in charge when executed; regularly conduct risk assessment, identify high-risk function resonance effects, and develop targeted emergency plans; optimize the allocation and use of system resources to avoid multiple functions relying on the same resources; Training and cultural improvement measures include: providing training for system operators on system working principles, function interaction, and potential risks; enhancing personnel's awareness of resonance effects and system failure modes through risk awareness training.

7. The method of claim 5, wherein the autonomous level is determined based on the FRAM. Conditions that need to be met for autonomous level switching, through the analysis of past operation data and accident reports, and combined with interviews with system designers, operators and experts in related fields, common problems in the switching process and related environmental conditions or system states are identified; By identifying these potential risk factors, the safety constraints of the environmental conditions and system states required for autonomous level switching are clearly defined; Operation step standardization, through detailed analysis of the autonomous level switching process, key operation steps and conditions that need to be ensured are sorted out; By drawing flowcharts or establishing state transition diagrams, each step of the switching process is clearly defined to ensure that the order of operation steps and conditions meet the requirements; Personnel training and qualification requirements, according to the complexity and criticality of autonomous level switching tasks, the specific skills and knowledge required for operators during the switching process are clearly defined; Based on task requirements, develop the ability standards of operators, and establish a certification mechanism to ensure that only personnel with corresponding skills and knowledge can perform autonomous level switching operations; Operators are required to pass specific examinations to confirm that they have the required technical level; In addition, regular skill training and switching process simulation are required to familiarize operators with the switching process under different conditions.

Images