STPA method based on hierarchical function control structure and interaction model

Abstract

The invention provides an STPA method based on a hierarchical function control structure and an interaction model, and relates to the technical field of system safety analysis, and the STPA method comprises the steps: dividing and building a function module FM of a researched system, determining a function attribute FA and a directed interaction tag DIT, and carrying out the optimization of the STPA method on the basis of an original hierarchical control structure model HCSM; and a new hierarchical function control structure and an interaction model HFCSIM are constructed. According to the model, unified definition and specification are adopted, the quality of the model is improved, and the problem that no strict specific method and form can follow in the model building process of STPA is fundamentally solved; meanwhile, through the establishment of the HFCSIM, the accuracy and the effectiveness of an analysis result are ensured; besides, according to the method, the improper / error type of each DIT is taken as a guide word, the identification of the UCA and the cause factors thereof is further refined, and the quality of an analysis result is ensured from another perspective, so that the design process can be more fully guided and optimized.

Description

Technical Field

[0001] The present invention relates to the technical field of system safety analysis, in particular to an STPA method based on a hierarchical functional control structure and an interactive model. Background Art

[0002] System Theoretic Process Analysis (STPA) is a hazard analysis technique based on the accident model and analysis process (STAMP) based on system thinking. It regards safety as a control problem and uses a hierarchical control structure model (HCSM) to describe the system. Accidents occur when unsafe interactions between components, external interference and / or component failures are not adequately controlled. The emergence of STPA makes up for the serious shortcomings of traditional safety analysis methods in identifying design defects, including software and system design errors, especially potential dangerous elements and causal scenarios such as abnormal interactions between components. At present, STPA has been widely used in complex engineering systems such as transportation, aviation, aerospace, and nuclear power. It has also been adopted by many standards, such as "RTCA DO 356A: "Airworthiness Security Methods and Considerations", "ISO / PAS21448: Safety of the Intended Functionality (SOTIF)" and "SAE J3187-System Theoretic Process Analysis (STPA) Recommended Practices for Evaluations of Automotive Related Safety-Critical Systems".

[0003] STPA has three main steps: 1) Establish the engineering foundation required for analysis, including determining possible accidents in the system, system-level hazards that lead to accidents, and building HCSM. 2) Identify unsafe control actions (UCA) that lead to danger. STPA divides unsafe control actions into four categories: no control action provided, incorrect control action provided, timing error of control action provided, and control action duration that is too long or too short. 3) By analyzing each component of HCSM and the interactions between them, determine the cause of UCA or violation of safety constraints (SC).

[0004] Although the existing STPA is very suitable for the safety analysis of complex systems, it has prominent problems in the construction of HCSM, mainly reflected in:

[0005] 1) STPA only provides an extremely abstract HCSM that only contains simple control loops. The modeling process is not detailed enough and lacks systematicity and completeness. Some component interaction information that has a key impact on safety analysis is likely to be ignored, resulting in the interaction information defined in the existing HCSM being unable to fully support the identification and analysis of unsafe control actions (UCA) and their causal factors (CF) in complex systems.

[0006] 2) It is difficult to maintain the consistency and continuity of HCSM between different analysts and at different analysis stages. Its correctness and completeness are also highly dependent on the technical level and proficiency of the analysts. In many cases, it needs to rely on "brainstorming", which will essentially affect the correctness of the analysis and the effectiveness of the results. Summary of the invention

[0007] In view of the deficiencies of the prior art, the object of the present invention is to propose a STPA method based on a hierarchical functional control structure and an interaction model, comprising:

[0008] Step 1: Based on the STPA method, determine the potential accidents of the engineering system and the system-level hazards corresponding to the accidents;

[0009] Step 2: Determine the hierarchical functional control structure and interaction model HFCSIM of the system under study in the engineering system. The hierarchical functional control structure and interaction model HFCSIM includes four functional modules FM. Determine the functional attributes FA of each functional module, and then determine the directed interaction label DIT of each element in the functional attribute FA. The name and direction of the directed interaction label DIT represent the interactive coupling behavior between the functional modules and the direction of the interactive coupling behavior.

[0010] Step 3: Based on the pre-set list of unsafe control actions UCA and causal factors with inappropriate / error types existing in each DIT as the guide words, as well as the potential accidents of the engineering system in step 1 and the system-level hazards corresponding to the accidents, the unsafe control actions UCA are identified in the final hierarchical functional control structure and interaction model HFCSIM with inappropriate or error types existing in CA of the control C element in the functional attribute FA as the guide words;

[0011] Step 4: For the unsafe control action UCA obtained in step 3, according to the pre-set list of unsafe control action UCA and causal factors with the inappropriate or error type of each DIT as the guide word, and the inappropriate or error type of all DITs in the functional attribute FA as the guide word, in the final hierarchical functional control structure and interaction model HFCSIM, determine the causal factors that lead to the unsafe control action UCA.

[0012] Optionally, step 2 specifically includes:

[0013] Step 2.1: Determine the system to be studied in the engineering system and the function of the system to be studied;

[0014] Step 2.2: According to the functions of the system under study, the system under study is divided into four functional modules, namely, the controller module CT, the actuator module AT, the sensor module SE and the controlled object module CPR, and the hierarchical relationship between the controller module CT, the actuator module AT, the sensor module SE and the controlled object module CPR is determined;

[0015] Step 2.3: Design the division criteria of the functional attributes FA of the modules, determine the functional attributes FA of each functional module, and determine the names and directions of all directed interaction tags DIT according to the functional attributes FA of each functional module FM, the information of the current design stage and the hierarchical relationship in step 2.2;

[0016] Step 2.4: Connect all functional modules FM according to the names and directions of all directed interaction tags DIT to obtain the initial hierarchical functional control structure and interaction model HFCSIM;

[0017] Step 2.5: Check the interaction information in the initial hierarchical functional control structure and interaction model HFCSIM. If the interaction information in the initial hierarchical functional control structure and interaction model HFCSIM is complete, use the hierarchical functional control structure and interaction model HFCSIM as the final hierarchical functional control structure and interaction model HFCSIM. If the interaction information in the initial hierarchical functional control structure and interaction model HFCSIM is missing, update the information of the current design stage and return to execute step 2.3.

[0018] Optionally, the controller module CT includes all controllers in the system under study, the actuator module AT includes all actuators in the system under study, the sensor module SE includes all sensors in the system under study, and the controlled object module CPR includes all controlled objects in the system under study.

[0019] Optionally, the division criteria of the functional attributes FA of the functional module FM include control C, state variable SV, feedback FB, guarantee G and model M.

[0020] Optionally, the control C includes the control behavior CA output by the module, as well as input control commands ICC from modules other than the module in the system under study, and control commands ECC from outside the system under study.

[0021] Optionally, the state variable SV includes a system state variable SSV and an environment state variable ESV.

[0022] Optionally, the feedback FB includes a first feedback FFL and a second feedback FTU, the first feedback FFL is feedback received by the module from a module with a lower level than the module, and the second feedback FTU is feedback sent by the module to a module with a higher level than the module.

[0023] Optionally, the guarantee G includes a prerequisite P and a resource R, wherein the prerequisite P is a condition that must be met before the function is executed, and the resource R is something that is required or consumed for the function to be executed.

[0024] Optionally, the model M is a process model PM contained in the module.

[0025] The beneficial effects of adopting the above technical solution are:

[0026] The present invention discloses an STPA method based on a hierarchical functional control structure and an interactive model. By dividing and establishing the functional modules FM of the studied system, determining the functional attributes FA and the directed interactive tags DIT, the STPA hierarchical control structure model HCSM is improved to form a new hierarchical functional control structure and interactive model HFCSIM, i.e., an accurate hierarchical control structure model. The model improves the quality of the model by considering various aspects and elements of the system and adopting a unified definition and specification, and fundamentally solves the problem that STPA only relies on natural language description rules in the process of model establishment, and there is no rigorous specific method and form to follow; at the same time, through the establishment of a systematic accurate hierarchical control structure model, the method realizes the guarantee of the consistency, integrity, correctness and continuity of the model in the analysis process, thereby ensuring the accuracy and effectiveness of the analysis results; in addition, the method uses the inappropriate / error type of each DIT as a guide word, further refines the identification of UCA and its causal factors, and guarantees the quality of the analysis results from another perspective, so that it can more fully guide and optimize the design process. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A schematic diagram of a STPA method flow based on a hierarchical functional control structure and an interaction model in an embodiment of the present invention;

[0028] Figure 2 A schematic diagram of a HFCSIM modeling process in an embodiment of the present invention;

[0029] Figure 3 Schematic diagram of a functional attribute FA of a functional module FM and a directed interaction tag DIT included in FA in an embodiment of the present invention;

[0030] Figure 4 The invention discloses a hierarchical functional control structure and interactive model HFCSIM of a wheel brake system WBS system in an embodiment of the invention. DETAILED DESCRIPTION

[0031] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0032] In view of the problems existing in the prior art, the present invention provides an STPA method based on a hierarchical functional control structure and an interaction model. Figure 1 , which may include the following steps:

[0033] Step 1: Based on the STPA method, determine the potential accidents of the engineering system and the system-level hazards corresponding to the accidents;

[0034] Among them, this step is the basis of the STPA method. This step is the conventional method of the existing STPA, which mainly establishes the engineering foundation required for the analysis. The potential accidents of the engineering system can be understood as accidents that may occur in the engineering system, and the system-level hazards corresponding to the accidents can be understood as the system-level hazards that cause the accidents.

[0035] For example, "during the aircraft landing (LA) or rejected takeoff (RTO) process, insufficient braking pressure or untimely braking results in insufficient braking and failure to fully decelerate, causing the aircraft to run off the runway" is a system-level hazard, which in turn results in an accident.

[0036] Step 2: Determine the hierarchical functional control structure and interaction model HFCSIM (Hierarchical Functional Control Structure and Interaction Model) of the system under study in the engineering system. The hierarchical functional control structure and interaction model HFCSIM includes four functional modules FM (Function Module), determine the functional attribute FA (Functional Attribute) of each functional module, and then determine the directional interaction tag DIT (Directional Interaction Tag) of each element in the functional attribute FA. The name and direction of the directional interaction tag DIT represent the interactive coupling behavior between the functional modules and the direction of the interactive coupling behavior;

[0037] Combination Figure 2 , step 2 specifically includes the following steps:

[0038] Step 2.1: Determine the system to be studied in the engineering system and the function of the system to be studied;

[0039] Among them, the entire engineering system may have multiple subsystems, and the present invention needs to determine the research object, that is, the system to be studied, that is, Figure 2 Clarify the functions and boundaries of the system.

[0040] Step 2.2: According to the functions of the system under study, the system under study is divided into four functional modules FM, namely, controller module CT (Controller), actuator module AT (Actuator), sensor module SE (Sensor) and controlled object module CPR (Controlled Process), namely Figure 2 The division of the functional modules FM; determine the hierarchical relationship between the controller modules CT, actuator modules AT, sensor modules SE and controlled object modules CPR, that is, Figure 2Determination of the FM levels and relationships;

[0041] The system under study can be represented as a set of function modules FM (Function Module), that is, FM = {CT, AT, SE, CPR}, and the controller module CT includes all controllers in the system under study, that is, CT = {CT1…CT i ...}; the actuator module AT includes all actuators in the system under study, that is, AT = {AT1...AT j ...}; the sensor module SE includes all sensors in the system under study, that is, SE = {SE1...SE k ...}; the controlled object module CPR includes all controlled objects in the system under study, that is, CPR = {CPR1...CPR m …}.

[0042] Step 2.3: Design the division criteria of the functional attributes FA of the modules, determine the functional attributes FA of each functional module, and determine the names and directions of all directed interaction tags DIT of each module according to the functional attributes FA of each functional module FM, the information of the current design stage and the hierarchical relationship in step 2.2;

[0043] The functional attributes FA of the functional module FM are divided into control C (Control), state variable SV (State Variable), feedback FB (Feedback), guarantee G (Guarantee) and model M (Model), that is, FA = {C, SV, FB, G, M};

[0044] Among them, the control C includes the control action CA (Control Action) output by the module, the input control command ICC (Input Control Command) from modules other than the module in the system under study, and the control command ECC (External Control Command) from outside the system under study, that is, C = {CA, ICC, ECC}.

[0045] Among them, ICC and ECC are both control commands and inputs, and CA is both a control behavior and an output. In the scope of this study, they are classified as control attributes of FM.

[0046] Wherein, the state variable SV includes a system state variable SSV (System State Variable) and an environment state variable ESV (Environment State Variable), that is, SV = {SSV, ESV};

[0047] The feedback FB includes a first feedback FFL (Feedback from Lower Level) and a second feedback FTU (Feedback to Upper Level). The first feedback FFL is feedback received by the module from a module with a lower level than the module, and the second feedback FTU is feedback sent by the module to a module with a higher level than the module, that is, FB = {FFL, FTU};

[0048] The guarantee G includes a precondition P (Precondition) and a resource R (Resource). The precondition P is a condition that must be met before the function is executed, and the resource R is something that is required or consumed for the function to be executed, that is, G = {P, R};

[0049] Among them, the guarantee attribute here refers to the prerequisites and resources required for the execution of the function. Without these, the function cannot run normally when other attributes are complete, so it is called the guarantee attribute. The premise P (Precondition) refers to the conditions that must be met before the function is executed. Before P (one or more) are met, the function cannot be started. P can be understood as a system state that must be "true" before the function is executed, or certain conditions that must be verified to be met; resources R (Resource) are things required or consumed for the execution of the function, that is, the hardware, software, program, manpower and energy required for the function to process input to produce output.

[0050] The model M is a process model PM (Process Model) included in the module, and the PM includes a description of the control relationship.

[0051] Among them, the classification standard of the functional attribute FA of the module can be expressed by Table 1:

[0052] Table 1 Classification criteria of module functional attributes FA

[0053]

[0054] Step 2.4: Connect all functional modules FM according to the names and directions of all directed interaction tags DIT to obtain the initial hierarchical functional control structure and interaction model HFCSIM;

[0055] Among them, step 2.3 and step 2.4 are equivalent to Figure 2 Determine the FA of each FM, clarify the DIT contained in each FA, and connect each FM.

[0056] Step 2.5: Check the interaction information in the initial hierarchical function control structure and interaction model HFCSIM. If the interaction information in the initial hierarchical function control structure and interaction model HFCSIM is complete, the hierarchical function control structure and interaction model HFCSIM is used as the final hierarchical function control structure and interaction model HFCSIM. If the interaction information in the initial hierarchical function control structure and interaction model HFCSIM is missing, update the information of the current design stage and return to execute step 2.3, which is equivalent to Figure 2 The part that determines whether the model is complete.

[0057] Take an example to illustrate step 2. According to the system functions of the WBS system, it is divided into four FMs, namely, the crew members Pilots, the brake control unit (BSCU), the hydraulic system (HS) and the wheels. Among them, the Pilots are the controller module CT, which is the highest level of the system; the BSCU is both the controlled object module CPR of the Pilots and the controller module CT of the HS, which is the second level of the system; and the HS module is the controlled object module CPR for the BSCU and the controller module CT for the wheels, which is the third level of the system; the wheels are the bottom-level controlled object module CPR. Then determine the names of all directed interaction labels DIT of each module and the directions of the directed interaction labels DIT. For details, see Figure 3 .

[0058] According to step 2, construct the HFCSIM of the wheel brake system WBS system, such as Figure 4 , you can also refer to Table 2;

[0059] Table 2 Functional attributes FA and directed interaction labels DIT of each functional module FM of HFCSIM in WBS system

[0060]

[0061]

[0062] Step 3: Based on the pre-set list of unsafe control actions UCA and causal factors with inappropriate / error types existing in each DIT as the guide words, as well as the potential accidents of the engineering system in step 1 and the system-level hazards corresponding to the accidents, the unsafe control actions UCA are identified in the final hierarchical functional control structure and interaction model HFCSIM with inappropriate or error types existing in CA of the control C element in the functional attribute FA as the guide words;

[0063] The list of unsafe control actions UCA and causal factors with inappropriate / error types of each DIT as the guide words is shown in Table 3:

[0064] Table 3 List of unsafe control actions UCA and causal factors with inappropriate / error types existing in each DIT as the guide word

[0065]

[0066]

[0067] Combined with the composition, working principle and constructed HFCSIM of the wheel brake system WBS, it can be known that the controllers in the system are Pilots and BSCU. This embodiment only analyzes the BSCU control behavior "implementing automatic braking" that causes the system-level hazard "during the landing (LA) and rejected takeoff (RTO) of the aircraft, insufficient braking pressure or untimely braking, insufficient braking, inability to fully decelerate, causing the aircraft to run off the runway". Specifically, combined with the list of unsafe control actions UCA and causal factors with the inappropriate / error type of each DIT as the guide word, the inappropriate or error type of CA in the DIT of the control C element in the functional attribute FA is used as the guide word, and the identified UCA is shown in Table 4:

[0068] Table 4 UCA related to BSCU automatic braking

[0069]

[0070]

[0071] Step 4: For the unsafe control action UCA obtained in step 3, according to the pre-set list of unsafe control action UCA and causal factors with DIT as the guide word, and with all functional attributes in DIT as the guide word, in the final hierarchical functional control structure and interaction model HFCSIM, determine the causal factors that lead to the unsafe control action UCA.

[0072] In combination with the above example, the present invention analyzes the causal factors of one of the identified UCAs: "BSCU did not provide automatic braking operation during the landing / RTO phase of the aircraft, resulting in the aircraft running off the runway without deceleration." According to the list of unsafe control actions UCA and causal factors in Table 3 with the inappropriate / error type of each DIT as the guide word, the inappropriate or error type of all DITs in the functional attribute FA is used as the guide word, and the causal factors that lead to the generation of UCA are identified in the final hierarchical functional control structure and interaction model HFCSIM. The identified causal factors are shown in Table 5:

[0073] Table 5 Causes of BSCU not implementing automatic braking command

[0074]

[0075]

[0076] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) to form a technical solution.

Claims

1. A STPA method based on hierarchical functional control structure and interaction model, characterized in that: include: Step 1: Based on the STPA method, determine the potential accidents of the engineering system and the system-level hazards corresponding to the accidents; Step 2: Determine the hierarchical functional control structure and interaction model HFCSIM of the system under study in the engineering system. The hierarchical functional control structure and interaction model HFCSIM includes four functional modules FM. Determine the functional attributes FA of each functional module, and then determine the directed interaction label DIT of each element in the functional attribute FA. The name and direction of the directed interaction label DIT represent the interactive coupling behavior between the functional modules and the direction of the interactive coupling behavior. Step 3: Based on the pre-set list of unsafe control actions UCA and causal factors with inappropriate / error types existing in each DIT as the guide words, as well as the potential accidents of the engineering system in step 1 and the system-level hazards corresponding to the accidents, the unsafe control actions UCA are identified in the final hierarchical functional control structure and interaction model HFCSIM with inappropriate or error types existing in CA of the control C element in the functional attribute FA as the guide words; Step 4: For the unsafe control action UCA obtained in step 3, according to the pre-set list of unsafe control action UCA and causal factors with the inappropriate or error type of each DIT as the guide word, and the inappropriate or error type of all DITs in the functional attribute FA as the guide word, in the final hierarchical functional control structure and interaction model HFCSIM, determine the causal factors that lead to the unsafe control action UCA.

2. The STPA method based on hierarchical functional control structure and interaction model according to claim 1, characterized in that: Step 2 specifically includes: Step 2.1: Determine the system to be studied in the engineering system and the function of the system to be studied; Step 2.2: According to the functions of the system under study, the system under study is divided into four functional modules, namely, the controller module CT, the actuator module AT, the sensor module SE and the controlled object module CPR, and the hierarchical relationship between the controller module CT, the actuator module AT, the sensor module SE and the controlled object module CPR is determined; Step 2.3: Design the division criteria of the functional attributes FA of the modules, determine the functional attributes FA of each functional module, and determine the names and directions of all directed interaction tags DIT according to the functional attributes FA of each functional module FM, the information of the current design stage and the hierarchical relationship in step 2.2; Step 2.4: According to the names and directions of all directed interaction tags DIT, all functional modules FM are connected to obtain the initial hierarchical functional control structure and interaction model HFCSIM; Step 2.5: Check the interaction information in the initial hierarchical functional control structure and interaction model HFCSIM. If the interaction information in the initial hierarchical functional control structure and interaction model HFCSIM is complete, use the hierarchical functional control structure and interaction model HFCSIM as the final hierarchical functional control structure and interaction model HFCSIM. If the interaction information in the initial hierarchical functional control structure and interaction model HFCSIM is missing, update the information of the current design stage and return to execute step 2.

3.

3. The STPA method based on hierarchical functional control structure and interaction model according to claim 2, characterized in that: The controller module CT includes all controllers in the system under study, the actuator module AT includes all actuators in the system under study, the sensor module SE includes all sensors in the system under study, and the controlled object module CPR includes all controlled objects in the system under study.

4. The STPA method based on hierarchical functional control structure and interaction model according to claim 2, characterized in that: The classification criteria of the functional attributes FA of the functional module FM include control C, state variable SV, feedback FB, guarantee G and model M.

5. The STPA method based on hierarchical functional control structure and interaction model according to claim 4, characterized in that: The control C includes the control behavior CA output by the module, the input control commands ICC from modules other than the module in the system under study, and the control commands ECC from outside the system under study.

6. The STPA method based on hierarchical functional control structure and interaction model according to claim 4, characterized in that: The state variables SV include system state variables SSV and environment state variables ESV.

7. The STPA method based on hierarchical functional control structure and interaction model according to claim 4, characterized in that: The feedback FB includes a first feedback FFL and a second feedback FTU, wherein the first feedback FFL is feedback received by the module from a module of a lower level than the module, and the second feedback FTU is feedback sent by the module to a module of a higher level than the module.

8. The STPA method based on hierarchical functional control structure and interaction model according to claim 4, characterized in that: The guarantee G includes premise P and resources R. The premise P is a condition that must be met before the function is executed, and the resource R is something required or consumed for the function to be executed.

9. The STPA method based on hierarchical functional control structure and interaction model according to claim 4, characterized in that: The model M is the process model PM contained in the module.

Images