Redundancy management method of dual-redundancy system

Abstract

The invention belongs to the technical field of redundancy management of an airplane electromechanical integrated management system, and particularly relates to a redundancy management method of a dual-redundancy system, which comprises the following steps: step 1, a core processor 1 receives a signal 1 and a signal 2, and a core processor 2 receives the signal 1 and the signal 2; the signal 1 and the signal 2 are two signals obtained by measuring the same sample point by two same sensors; 2, the core processor 1 and the core processor 2 carry out validity judgment on the signal 1 and the signal 2; and step 3, when the signal 1 and the signal 2 are both effective, the core processor 1 and the core processor 2 preferentially adopt the signal 1 as the priority redundancy input of the first function, and the signal 2 is used as the priority redundancy input of the second function. According to the redundancy data use method provided by the invention, the occurrence of the event is effectively avoided, the redundancy function is fully played, and the security of the system is improved.

Description

Technical Field

[0001] The present application belongs to the technical field of redundancy management of an aircraft electromechanical integrated management system, and in particular, relates to a redundancy management method for a dual-redundancy system. Background Art

[0002] The aircraft electromechanical system includes dozens of subsystems such as power supply, hydraulic pressure, environmental control, fuel, landing gear, etc. With the improvement of the integration of aircraft, the control design of each electromechanical system is considered uniformly, forming an electromechanical integrated control architecture. According to the safety requirements of the aircraft electromechanical system, the automatic control system is generally a dual-redundancy design. At present, the on-board design judges the signal source through the sensor measurement range, short circuit, and open circuit, and judges the acquisition signal transmission channel through healthy heartbeat, equipment BIT, etc., and performs redundancy management of dual-redundancy signals based on this. When the signal source and signal transmission channel of redundancy 1 are both valid, the data of redundancy 1 is used; when the signal source or signal transmission channel of redundancy 1 is invalid and the signal source and signal transmission channel of redundancy 2 are both valid, the data of redundancy 2 is used; when the data of redundancy 1 and redundancy 2 are both invalid, the safety value is set. The problem with this redundancy switching is that the validity judgment of redundancy 1 and redundancy 2 cannot cover all failure modes, which will cause the redundancy switching to fail. In a system with three or more redundancy, after independent judgment of all redundancy data, the final arbitration is usually carried out by voting. In a dual-redundancy system, this method does not hold true. The dual-redundancy data are both valid but inconsistent, and it is difficult to determine which data is correct. In aircraft safety analysis, when the automatic control and alarm functions of a certain function fail at the same time, it is a Class II event, which is a high-safety event. The system usually configures dual-redundancy acquisition, processing and driving to meet the system safety requirements. However, according to the above redundancy processing method, both the automatic control and alarm functions give priority to the data of redundancy 1. Although the data of redundancy 1 is valid, its value has always deviated from the normal value, which will cause the automatic control and alarm functions to fail, and the dual redundancy function is not played. The sensor single point causes a Class II event. Taking the air source control of the environmental control system as an example, when the bleed air is over-temperature and loses the alarm function, it is a Class II event. The system is equipped with a dual-redundancy bleed air temperature sensor. According to the above redundancy switching logic, if the value of the bleed air temperature sensor redundancy 1 is valid, but 40°C lower than the actual temperature, the left air source will continue to be heated, eventually leading to overtemperature without an alarm, and it will not attract the pilot's attention until a larger fault occurs, resulting in an unsafe incident. Summary of the invention

[0003] In order to solve the above problems, the present application provides 1. a redundancy management method for a dual-redundancy system, comprising:

[0004] Step 1: Core processing 1 receives signal 1 and signal 2, and core processing 2 receives signal 1 and signal 2; signal 1 and signal 2 are two signals obtained by the same two sensors measuring the same sample point;

[0005] Step 2: Core processing 1 and core processing 2 make validity judgment on signal 1 and signal 2;

[0006] Step 3: When both signal 1 and signal 2 are valid, core processing 1 and core processing 2 preferentially use signal 1 as the priority margin input of the first function and use signal 2 as the priority margin input of the second function.

[0007] Preferably, in step 3, when signal 1 is valid and signal 2 is invalid, core processing 1 and core processing 2 use signal 1 as input of the first function and use signal 2 as input of the second function.

[0008] Preferably, in step 3, when signal 1 is invalid and signal 2 is valid, core processing 1 and core processing 2 use signal 2 as the priority margin input of the first function and use signal 2 as the priority margin input of the second function.

[0009] Preferably, the method for core processing 1 and core processing 2 to receive signal 1 and signal 2 includes: remote acquisition 1 acquires signal 1 of sensor 1A, and sends remote acquisition 1's own heartbeat signal, data packet VPC check word, and sensor validity to core processing 1 and core processing 2 through a bus; remote acquisition 2 acquires signal 2 of sensor 1B, and sends remote acquisition 2's own heartbeat signal, data packet VPC check word, and sensor validity to core processing 1 and core processing 2 through a bus.

[0010] Preferably, the sensor validity includes: the sensor itself, the acquisition interface BIT, and the over-range judgment of the sensor, and when all are valid, the value is assigned as valid.

[0011] Preferably, the conditions for the validity judgment result to be valid are: when the node heartbeat is a non-constant number, the VPC check word is correct and the sensor validity is valid.

[0012] Preferably, the first function includes alarm logic resolution.

[0013] Preferably, the second function comprises automatic control logic processing.

[0014] The advantages of the present application include: the present invention provides a method for using dual redundancy information for an electromechanical integrated control system, which is characterized in that when it is impossible to fully determine whether the sensor signal value is the actual value, especially when the signal values ​​reported by the dual redundant sensors are inconsistent but the signal judgments are normal, in the traditional design, the automatic control and failure alarm functions of the same function use the same redundant sensor signal, which leads to the problem of simultaneous loss of automatic control and failure alarm of the function. In the aircraft safety analysis results, such faults will lead to the occurrence of Class II events, and the method for using redundancy data proposed in the present invention effectively avoids the occurrence of this event, gives full play to the redundancy effect, and improves the safety of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a system architecture diagram applicable to the present invention;

[0016] Figure 2 It is a flow chart of the use of dual redundancy information;

[0017] Figure 3 It is a logic diagram for processing dual-redundancy information. DETAILED DESCRIPTION

[0018] In order to make the technical solution and advantages of the present application clearer, the technical solution of the present application will be further described in detail in detail and in detail in conjunction with the accompanying drawings. It can be understood that the specific embodiments described here are only partial embodiments of the present application, which are only used to explain the present application, not to limit the present application. It should be noted that, for the convenience of description, only the parts related to the present application are shown in the accompanying drawings, and other related parts can refer to the general design. In the absence of conflict, the embodiments in the present application and the technical features in the embodiments can be combined with each other to obtain new embodiments.

[0019] As shown in the figure, the system architecture involved in the present invention is as follows Figure 1 As shown, it includes: sensor 1A and sensor 1B are dual-redundancy sensors; remote acquisition 1 and remote acquisition 2 are dual-redundancy acquisition channels; core processing 1 and core processing 2 are dual-redundancy automatic control and alarm logic solution modules; remote drive 1 and remote drive 2 are dual-redundancy power drive channels; avionics alarm is a dual-redundancy core processing that solves the alarm logic and then sends the alarm information to the avionics for alarm.

[0020] The dual-redundancy processing logic involved in the present invention is a high-security event of Class II in which both the automatic control failure and the alarm function are lost. The automatic control and alarm of a certain function cannot fail simultaneously due to an abnormality in any link of the sensor acquisition transmission channel.

[0021] The following is combined with Figure 2 and 3, the present invention is further introduced, the method for using the dual redundancy information of the present invention comprises the following steps:

[0022] Step 1: Core processing 1 receives signal 1 and signal 2, and core processing 2 receives signal 1 and signal 2; signal 1 and signal 2 are two signals obtained by the same two sensors measuring the same sample point;

[0023] The sensor receiving method is as follows:

[0024] (1) Remote acquisition 1 acquires the signal of sensor 1A, and sends its own heartbeat signal 1, data packet VPC check word, and sensor validity (including the sensor itself, acquisition interface BIT, and sensor over-range judgment, which are all valid when they are all valid) to core processing 1 and core processing 2 through the bus;

[0025] (2) Remote acquisition 2 acquires signal 2 of sensor 1B, and sends its own heartbeat signal, data packet VPC check word, and sensor validity (including the sensor itself, acquisition interface BIT, and sensor over-range judgment, which are all assigned a value of valid when all are valid) to core processing 1 and core processing 2 through the bus.

[0026] Step 2: Core processing 1 and core processing 2 judge the validity of signal 1 and signal 2; through "node heartbeat + VPC check word + sensor validity", the basic validity of the sensor signal is judged;

[0027] The specific method is as follows:

[0028] (1) Core processing 1 and 2 respectively judge the received node heartbeat. When the number is non-constant, the node works normally. When the VPC check word is correct and the sensor validity is valid, the sensor signal value is valid and can participate in subsequent logic processing.

[0029] Step 3: When the core processing performs a logical judgment on a function alarm, if the sensor signal uploaded by remote collection 1 is normal, the sensor signal of remote collection 1 is used first to solve the alarm logic;

[0030] The method of using the alarm logic data is as follows:

[0031] (1) When core processing 1 and 2 are performing alarm logic processing, if the sensor 1A signal uploaded by remote acquisition 1 and the sensor 1B signal uploaded by remote acquisition 2 are both valid after data preprocessing, the sensor 1A signal is used first;

[0032] (2) When the sensor 1A signal uploaded by remote acquisition 1 fails, switch to using the sensor 1B signal uploaded by remote acquisition 2.

[0033] Step 4: When the core processing performs automatic control logic judgment of the same function, when the sensor signal uploaded by remote acquisition 2 is valid, the sensor signal of remote acquisition 2 is used first to perform automatic control logic solution.

[0034] The method of using the automatic control logic data is as follows:

[0035] (1) When core processing 1 and 2 are performing automatic control logic processing, if the sensor 1A signal uploaded by remote acquisition 1 and the sensor 1B signal uploaded by remote acquisition 2 are both valid after data preprocessing, the sensor 1B signal is used first;

[0036] (2) When the sensor 1B signal uploaded by remote acquisition 2 fails, the sensor 1A signal uploaded by remote acquisition 1 is switched to be used.

[0037] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A redundancy management method for a dual-redundancy system, characterized in that: include: Step 1: Core processing 1 receives signal 1 and signal 2, and core processing 2 receives signal 1 and signal 2; signal 1 and signal 2 are two signals obtained by the same two sensors measuring the same sample point; Step 2: Core processing 1 and core processing 2 make validity judgment on signal 1 and signal 2; Step 3: When both signal 1 and signal 2 are valid, core processing 1 and core processing 2 preferentially use signal 1 as the priority margin input of the first function and use signal 2 as the priority margin input of the second function.

2. The redundancy management method of a dual-redundancy system according to claim 1, characterized in that: In step 3, when signal 1 is valid and signal 2 is invalid, core processing 1 and core processing 2 use signal 1 as the input of the first function and use signal 1 as the input of the second function.

3. The redundancy management method of a dual-redundancy system according to claim 2, characterized in that: In step 3, when signal 1 is invalid and signal 2 is valid, core processing 1 and core processing 2 use signal 2 as the priority margin input of the first function and use signal 2 as the priority margin input of the second function.

4. The redundancy management method of a dual-redundancy system according to claim 1, characterized in that: The method for core processing 1 and core processing 2 to receive signal 1 and signal 2 includes: remote collection 1 collects signal 1 of sensor 1A, and sends remote collection 1's own heartbeat signal, data packet VPC check word, and sensor validity to core processing 1 and core processing 2 through a bus; remote collection 2 collects signal 2 of sensor 1B, and sends remote collection 2's own heartbeat signal, data packet VPC check word, and sensor validity to core processing 1 and core processing 2 through a bus.

5. The redundancy management method of a dual-redundancy system according to claim 4, characterized in that: The sensor validity includes: the sensor itself, the acquisition interface BIT, and the sensor's over-range judgment. When all are valid, the value is assigned as valid.

6. The redundancy management method of a dual-redundancy system according to claim 5, characterized in that: The conditions for the validity judgment result to be valid are: when the node heartbeat is a non-constant number, the VPC check word is correct and the sensor validity is valid.

7. The redundancy management method of a dual-redundancy system according to claim 6, characterized in that: The first function includes alarm logic solving.

8. The redundancy management method of a dual-redundancy system according to claim 7, characterized in that: The second function includes automatic control logic processing.

Images