A method and apparatus for optimizing redundancy signal voting monitoring strategy

Abstract

This invention provides a method and apparatus for optimizing redundancy signal voting and monitoring strategies, belonging to the field of security design. The method includes: determining the availability and integrity targets of redundancy signals based on a system architecture-level fault tree; identifying signal transmission links, signal attributes, and equipment availability and integrity indices; constructing a voting monitoring strategy model library based on signal redundancy and signal attributes, the library containing multiple voting monitoring strategy models; constructing a voting monitoring fault tree for each voting monitoring strategy model according to the library, and calculating the redundancy signal availability and integrity indices for each voting monitoring strategy based on the voting monitoring fault tree; selecting the voting monitoring strategy with the highest redundancy signal availability and integrity as the optimal voting monitoring strategy. This invention considers the availability and integrity requirements of the flight control system transmission links and can automatically optimize redundancy signal voting and monitoring strategies.

Description

Technical Field

[0001] This invention belongs to the field of security design technology, and in particular relates to a method and apparatus for optimizing a redundancy signal voting monitoring strategy. Background Technology

[0002] In the design and implementation of high-safety flight control systems, ensuring the availability and integrity of input signals directly affects aircraft safety and control functions. Therefore, a redundant architecture is generally adopted to meet the availability and integrity requirements of the signal transmission link.

[0003] With the increasing number of aircraft sensors and the growing degree of distributed system design, the combinations of signal sources and communication channels are growing exponentially. The traditional method of monitoring and voting by experts manually evaluating each signal is no longer suitable for the rapid iteration and process assurance of civil aviation R&D.

[0004] Therefore, it is necessary to design a set of automated optimization methods for monitoring and voting strategies that take into account the characteristics of redundant signals and the requirements of availability and integrity. Summary of the Invention

[0005] To address the technical problem that methods for evaluating each signal monitoring and voting strategy in related technologies are no longer suitable for the rapid iteration and process assurance requirements of civil aviation R&D processes, this invention provides a method and apparatus for optimizing redundant signal voting and monitoring strategies that considers both integrity and availability. This achieves automated optimization of redundant signal voting and monitoring strategies, taking into account the availability and integrity requirements of the flight control system transmission link. The technical solution is as follows:

[0006] Firstly, a method for optimizing a redundancy signal voting monitoring strategy is provided, including the following steps:

[0007] S1, Determine the availability and integrity targets of redundancy signals based on the system architecture hierarchical fault tree;

[0008] S2 identifies signal transmission links, signal attributes, and equipment availability and integrity metrics.

[0009] S3. Construct a voting monitoring strategy model library based on signal redundancy and signal attributes. The voting monitoring strategy model library contains multiple voting monitoring strategy models.

[0010] S4. Construct a voting monitoring fault tree for each voting monitoring strategy model corresponding to the voting monitoring strategy based on the voting monitoring strategy model library, and calculate the redundancy signal availability index and integrity index for each voting monitoring strategy based on the voting monitoring fault tree.

[0011] S5. Based on the results of S4 and the voting monitoring objectives, select the voting monitoring strategy that maximizes the availability and integrity of the redundancy signal as the optimal voting monitoring strategy.

[0012] Optionally, in S2,

[0013] Signal attributes include: signal redundancy, bus signal / discrete signal;

[0014] The signal transmission link is the complete transmission path of the signal from the acquisition end to the flight control system;

[0015] Signal availability and integrity metrics refer to the availability and integrity of each device in the signal transmission link.

[0016] Optionally, in S3, a voting monitoring strategy model library is constructed based on signal redundancy and signal attributes, including voting monitoring strategy model libraries for dual-redundancy, triple-redundancy, quadruple-redundancy, hexa-redundancy, and octau-redundancy signals.

[0017] Optionally, the dual-redundancy signal voting monitoring strategy model library includes a first voting monitoring strategy model and a second voting monitoring strategy model.

[0018] The first voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if the two redundancy signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid; if the two redundancy signals are inconsistent, the voting value is confirmed to be invalid.

[0019] The second voting monitoring strategy model is used to monitor bus signals for voting. The voting monitoring process is as follows:

[0020] If the two redundancy signals are consistent, the voting value is averaged to determine the voting value as valid; if the two redundancy signals are inconsistent and either bus communication of the two redundancy signals is invalid, the voting value is determined to be invalid.

[0021] If the two redundancy signals are consistent, the voting value is taken as the average value to determine the validity of the voting value; if the two redundancy signals are inconsistent and either of the two redundancy signals is invalid in bus communication, the signal with valid bus communication is used as the voting value.

[0022] Optionally, the triple-redundancy signal voting monitoring strategy model library includes a third voting monitoring strategy model and a fourth voting monitoring strategy model.

[0023] The third voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if the three redundancy signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid; if the three redundancy signals are inconsistent, the majority signal is taken.

[0024] The fourth voting monitoring strategy model is used to monitor the voting bus signals. The voting monitoring process is as follows:

[0025] If the three redundancy signals are consistent, the middle value is taken as the voting value, and the voting value is determined to be valid. If any redundancy of the three redundancy signals is inconsistent with other signals or any redundancy bus communication is invalid, the second voting monitoring strategy model is used to monitor the voting of the remaining two redundancy signals. If any two redundancy signals of the three redundancy signals have invalid bus communication or are inconsistent in pairwise comparisons, the voting value is determined to be invalid.

[0026] Optionally, the quadruple redundancy signal voting monitoring strategy model library includes a fifth voting monitoring strategy model and a sixth voting monitoring strategy model.

[0027] The fifth voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if the four redundancy signals are consistent, the consistent signal is taken as the voting value and the voting value is determined to be valid; if three redundancy signals are consistent, the consistent signal is taken as the voting value and the voting value is determined to be valid; if two redundancy signals are inconsistent with the other two redundancy signals, the voting value is determined to be invalid; the two dual-redundancy signals are first monitored by the first voting monitoring strategy model, and then the results are monitored by the first voting monitoring strategy model.

[0028] The sixth voting monitoring strategy model is used to monitor the voting bus signal. The voting monitoring process is as follows:

[0029] If the four redundancy signals are consistent, the average of the two middle redundancy signals is taken as the voting value, and the voting value is determined to be valid. If any redundancy of the four redundancy signals is inconsistent with other signals or if any redundancy bus communication is invalid, the fourth voting monitoring strategy model is used to monitor the voting of the remaining three redundancy signals. If any two redundancy signals of the four redundancy signals are consistent but inconsistent with the signals of the other two consistent redundancy signals, the voting value is determined to be invalid. If any two redundancy bus communication of the four redundancy signals is invalid, the second voting monitoring strategy model is used to monitor the voting of the remaining two redundancy signals. The two dual-redundancy signals are first monitored by the second voting monitoring strategy model, and then the results are monitored by the second voting monitoring strategy model.

[0030] Optionally, the six-redundancy signal voting monitoring strategy model library includes a seventh voting monitoring strategy model and an eighth voting monitoring strategy model.

[0031] The seventh voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if six redundancy signals are consistent, or five redundancy signals are consistent, or four redundancy signals are consistent, then the consistent signal is taken as the voting value, and the voting value is determined to be valid; if three redundancy signals are inconsistent with the other three redundancy signals, then the voting value is determined to be invalid; for two three-redundancy signals, the third voting monitoring strategy model is first used for voting monitoring, and then the first voting monitoring strategy model is used to monitor the result; for three two-redundancy signals, the first voting monitoring strategy model is first used for voting monitoring, and then the third voting monitoring strategy model is used to monitor the result.

[0032] The eighth voting monitoring strategy model is used to monitor the voting bus signal. The voting monitoring process is as follows:

[0033] If the six redundancy signals are consistent, the average of the two middle channels is taken as the voting value, and the voting value is determined to be valid. If any redundancy signal bus communication is invalid or inconsistent with other five redundancy signals, the median value of the five redundancy signals is taken as the voting value, and the voting value is determined to be valid. If any two redundancy signal bus communication is invalid or any two redundancy signals are inconsistent with other four redundancy signals, the sixth voting monitoring strategy model is used to monitor the voting of the remaining four redundancy signals. If any three redundancy bus communication is invalid or inconsistent with other three redundancy signals, the fourth voting monitoring strategy model is used to monitor the voting of the remaining three redundancy signals. If the four redundancy signal bus communication is invalid, the voting value is considered invalid. Two three redundancy signals are first monitored using the fourth voting monitoring strategy model, and then the second voting monitoring strategy model is used to monitor the result. Three two redundancy signals are first monitored using the second voting monitoring strategy model, and then the fourth voting monitoring strategy model is used to monitor the result.

[0034] Optionally, the octet redundancy signal voting monitoring strategy model library includes a ninth voting monitoring strategy model and a tenth voting monitoring strategy model.

[0035] The ninth voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if eight, seven, six, or five redundant signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid; if four redundant signals are inconsistent with the other four, the voting value is determined to be invalid; for two four-redundant signals, the fifth voting monitoring strategy model is first used for voting monitoring, and then the first voting monitoring strategy model is used to monitor the result; for four two-redundant signals, the first voting monitoring strategy model is first used for voting monitoring, and then the fifth voting monitoring strategy model is used to monitor the result.

[0036] The tenth voting monitoring strategy model is used to monitor the voting bus signal. The voting monitoring process is as follows:

[0037] If all eight redundant signals are consistent, the average of the two middle signals is taken as the voting value, and the voting value is determined to be valid. If any redundant signal bus communication is invalid or any redundant signal is inconsistent with the other seven redundant signals, the average of the seven redundant signals is taken as the voting value, and the voting value is determined to be valid. If two redundant signal bus communications are invalid or two redundant signals are inconsistent with the other six redundant signals, the eighth voting monitoring strategy model is used to monitor the remaining six redundant signals to determine the voting value to be valid. If three redundant bus communications are invalid or three redundant signals are inconsistent with the other five redundant signals, the average of the five redundant signals is taken as the voting value, and the voting value is determined to be valid. If four redundant signals are consistent and are inconsistent with the other four... If signals with consistent redundancy are inconsistent, the voting value is determined to be invalid. If four redundancy bus communications are invalid, the sixth voting monitoring strategy model is used to monitor the remaining four redundancy channels to determine the voting value to be valid. If five redundancy bus communications are invalid, the fourth voting monitoring strategy model is used to monitor the remaining three redundancy channels to determine the voting value to be valid. If six redundancy bus communications are invalid, the voting value is determined to be invalid. For two four-redundancy signals, the sixth voting monitoring strategy model is first used for voting monitoring, and then the second voting monitoring strategy model is used to monitor the result. For four two-redundancy signals, the second voting monitoring strategy is first used for voting monitoring, and then the sixth voting monitoring strategy model is used to monitor the result.

[0038] Optionally, the selection process for the optimal voting monitoring strategy in S5 is as follows:

[0039] The voting monitoring strategy is comprehensively evaluated using a weighted average formula to obtain the comprehensive evaluation result k;

[0040] The voting monitoring strategy that maximizes the comprehensive evaluation result k is determined as the optimal voting monitoring strategy.

[0041] The weighted average formula is: k = 0.6 * e Y-y +0.4*e X-x ;

[0042] X represents the availability objective obtained in step 1, and Y represents the integrity objective.

[0043] x is the availability metric obtained in step 4, and y is the integrity metric.

[0044] Secondly, a redundancy signal voting monitoring strategy optimization device is provided, comprising:

[0045] The determination module is used to determine the availability and integrity targets of redundancy signals based on the system architecture hierarchical fault tree;

[0046] The identification module is used to identify signal transmission links, signal attributes, and equipment availability and integrity indicators.

[0047] A construction module is used to build a voting monitoring strategy model library based on signal redundancy and signal attributes. The voting monitoring strategy model library contains multiple voting monitoring strategy models.

[0048] The calculation module is used to construct a voting monitoring fault tree for each voting monitoring strategy model corresponding to the voting monitoring strategy based on the voting monitoring strategy model library, and to calculate the redundancy signal availability index and integrity index for each voting monitoring strategy based on the voting monitoring fault tree.

[0049] The selection module is used to select the voting monitoring strategy that maximizes the availability and integrity of the redundancy signal as the optimal voting monitoring strategy based on the calculation results and the voting monitoring objectives.

[0050] Thirdly, a redundancy signal voting monitoring strategy optimization device is provided, comprising a processor and a memory, wherein the processor is configured to execute instructions stored in the memory, and the processor implements any of the methods described in the first aspect by executing the instructions.

[0051] Fourthly, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a processing component of a computer, cause the processing component to perform any of the methods described in the first aspect.

[0052] Fifthly, a computer program product comprising instructions is provided, which, when run on a computer, causes the computer to perform any of the methods described in the first aspect.

[0053] The beneficial effects of this invention are at least as follows:

[0054] It can automatically generate a voting monitoring strategy model library for multi-attribute and redundant signals; comprehensively consider integrity and availability indicators to achieve optimal voting monitoring strategy for redundant signals; and provide a basis for system architecture design without relying on expert experience, and provide support for model-based design and development. Attached Figure Description

[0055] Figure 1 This is a flowchart illustrating an optimal method for redundancy signal voting monitoring strategy that considers integrity and availability according to an embodiment of the present invention.

[0056] Figure 2 This is a schematic diagram of the angular rate sensor signal transmission link in Embodiment 1 of the present invention;

[0057] Figure 3 It is the signal integrity analysis fault tree constructed based on the four-redundancy signal voting monitoring strategy model in Embodiment 1 of the present invention;

[0058] Figure 4 It is the signal availability analysis fault tree constructed based on the four-redundancy signal voting monitoring strategy model in Embodiment 1 of the present invention;

[0059] Figure 5 This is a schematic diagram of the hexaredundant switch signal transmission link in Embodiment 2 of the present invention;

[0060] Figure 6 This is the signal integrity analysis fault tree constructed based on the hexaredundant switch signal voting monitoring strategy model in Embodiment 2 of the present invention;

[0061] Figure 7 This is a fault tree for signal availability analysis constructed based on the hexaredundant switch signal voting monitoring strategy model in Embodiment 2 of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

[0063] One embodiment of the present invention provides a method for optimizing a redundancy signal voting monitoring strategy, such as... Figure 1 As shown, the method includes:

[0064] S1, Determine the availability and integrity targets of redundancy signals based on the system architecture hierarchical fault tree;

[0065] S2 identifies signal transmission links, signal attributes, and equipment availability and integrity metrics.

[0066] S3. Construct a voting monitoring strategy model library based on signal redundancy and signal attributes. The voting monitoring strategy model library contains multiple voting monitoring strategy models.

[0067] S4. Construct a voting monitoring fault tree for each voting monitoring strategy model corresponding to the voting monitoring strategy based on the voting monitoring strategy model library, and calculate the redundancy signal availability index and integrity index for each voting monitoring strategy based on the voting monitoring fault tree.

[0068] S5. Based on the results of S4 and the voting monitoring objectives, select the voting monitoring strategy that maximizes the availability and integrity of the redundancy signal as the optimal voting monitoring strategy.

[0069] In one possible implementation, signal attributes include: signal redundancy, bus signal / discrete signal;

[0070] The signal transmission link is the complete transmission path of the signal from the acquisition end to the flight control system;

[0071] Signal availability and integrity metrics refer to the availability and integrity of each device in the signal transmission link.

[0072] 1. The dual-redundancy signal voting monitoring strategy model library includes a first voting monitoring strategy model and a second voting monitoring strategy model.

[0073] The first voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if the two redundancy signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid; if the two redundancy signals are inconsistent, the voting value is confirmed to be invalid.

[0074] The second voting monitoring strategy model is used to monitor bus signals for voting. The voting monitoring process is as follows:

[0075] If the two redundancy signals are consistent, the voting value is averaged to determine the voting value as valid; if the two redundancy signals are inconsistent and either bus communication of the two redundancy signals is invalid, the voting value is determined to be invalid.

[0076] If the two redundancy signals are consistent, the voting value is taken as the average value to determine the validity of the voting value; if the two redundancy signals are inconsistent and either of the two redundancy signals is invalid in bus communication, the signal with valid bus communication is used as the voting value.

[0077] 2. The triple-redundancy signal voting monitoring strategy model library includes a third voting monitoring strategy model and a fourth voting monitoring strategy model.

[0078] The third voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if the three redundancy signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid; if the three redundancy signals are inconsistent, the majority signal is taken.

[0079] The fourth voting monitoring strategy model is used to monitor the voting bus signals. The voting monitoring process is as follows:

[0080] If the three redundancy signals are consistent, the middle value is taken as the voting value, and the voting value is determined to be valid. If any redundancy of the three redundancy signals is inconsistent with other signals or any redundancy bus communication is invalid, the second voting monitoring strategy model is used to monitor the voting of the remaining two redundancy signals. If any two redundancy signals of the three redundancy signals have invalid bus communication or are inconsistent in pairwise comparisons, the voting value is determined to be invalid.

[0081] 3. The quadruple redundancy signal voting monitoring strategy model library includes a fifth voting monitoring strategy model and a sixth voting monitoring strategy model.

[0082] The fifth voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if the four redundancy signals are consistent, the consistent signal is taken as the voting value and the voting value is determined to be valid; if three redundancy signals are consistent, the consistent signal is taken as the voting value and the voting value is determined to be valid; if two redundancy signals are inconsistent with the other two redundancy signals, the voting value is determined to be invalid; the two dual-redundancy signals are first monitored by the first voting monitoring strategy model, and then the results are monitored by the first voting monitoring strategy model.

[0083] The sixth voting monitoring strategy model is used to monitor the voting bus signal. The voting monitoring process is as follows:

[0084] If the four redundancy signals are consistent, the average of the two middle redundancy signals is taken as the voting value, and the voting value is determined to be valid. If any redundancy of the four redundancy signals is inconsistent with other signals or if any redundancy bus communication is invalid, the fourth voting monitoring strategy model is used to monitor the voting of the remaining three redundancy signals. If any two redundancy signals of the four redundancy signals are consistent but inconsistent with the signals of the other two consistent redundancy signals, the voting value is determined to be invalid. If any two redundancy bus communication of the four redundancy signals is invalid, the second voting monitoring strategy model is used to monitor the voting of the remaining two redundancy signals. The two dual-redundancy signals are first monitored by the second voting monitoring strategy model, and then the results are monitored by the second voting monitoring strategy model.

[0085] 4. The six-redundancy signal voting monitoring strategy model library includes a seventh voting monitoring strategy model and an eighth voting monitoring strategy model.

[0086] The seventh voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if six redundancy signals are consistent, or five redundancy signals are consistent, or four redundancy signals are consistent, then the consistent signal is taken as the voting value, and the voting value is determined to be valid; if three redundancy signals are inconsistent with the other three redundancy signals, then the voting value is determined to be invalid; for two three-redundancy signals, the third voting monitoring strategy model is first used for voting monitoring, and then the first voting monitoring strategy model is used to monitor the result; for three two-redundancy signals, the first voting monitoring strategy model is first used for voting monitoring, and then the third voting monitoring strategy model is used to monitor the result.

[0087] The eighth voting monitoring strategy model is used to monitor the voting bus signal. The voting monitoring process is as follows:

[0088] If the six redundancy signals are consistent, the average of the two middle channels is taken as the voting value, and the voting value is determined to be valid. If any redundancy signal bus communication is invalid or inconsistent with other five redundancy signals, the median value of the five redundancy signals is taken as the voting value, and the voting value is determined to be valid. If any two redundancy signal bus communication is invalid or any two redundancy signals are inconsistent with other four redundancy signals, the sixth voting monitoring strategy model is used to monitor the voting of the remaining four redundancy signals. If any three redundancy bus communication is invalid or inconsistent with other three redundancy signals, the fourth voting monitoring strategy model is used to monitor the voting of the remaining three redundancy signals. If the four redundancy signal bus communication is invalid, the voting value is considered invalid. Two three redundancy signals are first monitored using the fourth voting monitoring strategy model, and then the second voting monitoring strategy model is used to monitor the result. Three two redundancy signals are first monitored using the second voting monitoring strategy model, and then the fourth voting monitoring strategy model is used to monitor the result.

[0089] 5. The octet redundancy signal voting monitoring strategy model library includes the ninth and tenth voting monitoring strategy models.

[0090] The ninth voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if eight, seven, six, or five redundant signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid; if four redundant signals are inconsistent with the other four, the voting value is determined to be invalid; for two four-redundant signals, the fifth voting monitoring strategy model is first used for voting monitoring, and then the first voting monitoring strategy model is used to monitor the result; for four two-redundant signals, the first voting monitoring strategy model is first used for voting monitoring, and then the fifth voting monitoring strategy model is used to monitor the result.

[0091] The tenth voting monitoring strategy model is used to monitor the voting bus signal. The voting monitoring process is as follows:

[0092] If all eight redundant signals are consistent, the average of the two middle signals is taken as the voting value, and the voting value is determined to be valid. If any redundant signal bus communication is invalid or any redundant signal is inconsistent with the other seven redundant signals, the average of the seven redundant signals is taken as the voting value, and the voting value is determined to be valid. If two redundant signal bus communications are invalid or two redundant signals are inconsistent with the other six redundant signals, the eighth voting monitoring strategy model is used to monitor the remaining six redundant signals to determine the voting value to be valid. If three redundant bus communications are invalid or three redundant signals are inconsistent with the other five redundant signals, the average of the five redundant signals is taken as the voting value, and the voting value is determined to be valid. If four redundant signals are consistent and are inconsistent with the other four... If signals with consistent redundancy are inconsistent, the voting value is determined to be invalid. If four redundancy bus communications are invalid, the sixth voting monitoring strategy model is used to monitor the remaining four redundancy channels to determine the voting value to be valid. If five redundancy bus communications are invalid, the fourth voting monitoring strategy model is used to monitor the remaining three redundancy channels to determine the voting value to be valid. If six redundancy bus communications are invalid, the voting value is determined to be invalid. For two four-redundancy signals, the sixth voting monitoring strategy model is first used for voting monitoring, and then the second voting monitoring strategy model is used to monitor the result. For four two-redundancy signals, the second voting monitoring strategy is first used for voting monitoring, and then the sixth voting monitoring strategy model is used to monitor the result.

[0093] In one feasible implementation, the selection process for the optimal voting monitoring strategy in S5 is as follows:

[0094] The voting monitoring strategy is comprehensively evaluated using a weighted average formula to obtain the comprehensive evaluation result k;

[0095] The voting monitoring strategy that maximizes the comprehensive evaluation result k is determined as the optimal voting monitoring strategy.

[0096] The weighted average formula is: k = 0.6 * e Y-y +0.4*e X-x ;

[0097] X represents the availability target obtained in step S1 above, and Y represents the integrity target.

[0098] x is the availability index obtained in step S4 above, and y is the integrity index.

[0099] This invention provides a method for optimizing voting monitoring strategies for redundant signals that considers both integrity and availability. This method can automatically generate a voting monitoring strategy model library for multi-attribute and redundant signals; comprehensively consider integrity and availability indicators to optimize voting monitoring strategies for redundant signals; achieve design that does not rely on expert experience, provide a basis for system architecture design, and provide support for model-based design and development.

[0100] Example 1

[0101] For the flight control system, the signal voting monitoring strategy for the quadruple redundancy angular rate sensor signals is optimized, and the steps are as follows:

[0102] S101, the redundancy signal availability and integrity targets are allocated and acquired through the system architecture hierarchical fault tree. Based on the system failure state, the fault tree is constructed in combination with the system architecture. Based on engineering experience or average allocation method, the redundancy signal availability and integrity are allocated. According to the system architecture hierarchical fault tree analysis, the probability of the angular rate sensor signal voting value error is set to 1E-4, and the probability of the voting value loss is set to 1E-3.

[0103] S201 identifies signal attributes; this signal is a 4-redundant signal, a bus signal.

[0104] S202, Identify the signal transmission link; the transmission link for each redundancy of the four-redundancy angular rate signal is as follows: Figure 2 As shown;

[0105] S203, obtain signal availability and integrity indicators. The availability and integrity indicators of each link in the signal transmission link are obtained through reliability prediction, engineering experience or relevant standards. Table 1 shows the availability and integrity indicators of each component in the transmission link.

[0106] Table 1. Availability and Integrity Indicators of Various Components in the Transmission Link

[0107]

[0108]

[0109] S301, Construct a quadruple-redundancy signal voting monitoring strategy model library:

[0110] For bus signals, there are two voting strategies for quadruple redundancy signals. The first is that if all four redundancy signals are consistent, the average of the two middle redundancy signals is taken. If any redundancy signal is inconsistent with other signals or invalid, the remaining three redundancy signals are used for voting monitoring. If any two redundancy signals are consistent but inconsistent with the other two consistent redundancy signals, the quadruple redundancy voting is considered invalid. If any two redundancy signals are valid, the remaining two redundancy signals are used for voting monitoring. The second strategy involves using two redundancy signals to vote on the two dual redundancy signals in the quadruple redundancy signal, and then using these two redundancy signals for voting monitoring. Since there are two strategies for dual redundancy signal voting monitoring, there are four possible combinations, for a total of five strategies.

[0111] S401, construct a fault tree based on the voting monitoring strategy model and calculate the redundancy signal availability and integrity. Based on signal attributes, signal transmission links, and availability / integrity indicators, and using a voting monitoring strategy model library established for signal redundancy, calculate the probability of voting signal loss or error through the fault tree method. The constructed integrity indicator fault tree is as follows: Figure 3 As shown, the availability metric fault tree is as follows: Figure 4 As shown in the figure, the calculation results are shown in Table 2;

[0112] Table 2 Calculation Results

[0113] Model Integrity (1E-06 / H) Availability (1E-06 / H) Model 1 0.00004257 0.00005879 Model 2 0.0002843 0.2903 Model 3 0.000000002342 1858 Model 4 0.0000000417 879.6 Model 5 0.00004257 0.2903

[0114] S501, Optimization of Voting Monitoring Strategy: A weighted average algorithm is used to comprehensively evaluate voting monitoring strategies. Assuming availability objective is X and integrity objective is Y, a certain voting monitoring strategy calculates voting signal availability index x and integrity index y, using the formula k = 0.6*e Y-y +0.4*e X-x After obtaining the comprehensive evaluation results of the voting monitoring strategy, and finally comprehensively evaluating all strategies in the monitoring strategy model library, the strategy with the largest k is the preferred strategy. After calculation, the k values ​​obtained by the five strategies are 1.00046020301, 1.00046008666, 0.99971695019, 1.000108165899, and 1.00046008681, respectively. Finally, strategy one, namely the four-redundancy signal consistency monitoring voting model, is selected as the monitoring voting strategy for this signal.

[0115] The S502 system architecture hierarchical fault tree update updates the optimized voting monitoring strategy into the system architecture and updates the system hierarchical fault tree, thereby redistributing and confirming availability / integrity indicators to ultimately meet the system's availability and integrity indicators.

[0116] In one embodiment, for the flight control system, a signal voting monitoring strategy is optimized for hexaredundant switch signals, and the steps are as follows:

[0117] S101, the redundancy signal availability and integrity targets are allocated and acquired through the system architecture hierarchical fault tree. Based on the system failure state, the fault tree is constructed in combination with the system architecture. Based on engineering experience or average allocation method, the redundancy signal availability and integrity are allocated. According to the system architecture hierarchical fault tree analysis, the probability of incorrect voting value of switch signal is set to 1E-6, and the probability of loss of voting value is set to 1E-5.

[0118] S201, Identify signal attributes: This signal is a hexagonal signal, a discrete signal.

[0119] S202, Identify the signal transmission link; the transmission link for each redundancy of the six-redundancy switch signal is as follows: Figure 5 As shown;

[0120] S203, obtain signal availability and integrity indicators. The availability and integrity indicators of each link in the signal transmission link are obtained through reliability prediction, engineering experience or relevant standards. Table 3 shows the availability and integrity indicators of each component in the transmission link.

[0121] Table 3. Availability and Integrity Indicators of Various Components in the Transmission Link

[0122]

[0123]

[0124] S301, Construct a six-redundancy signal voting monitoring strategy model library:

[0125] For discrete signals, there are three voting strategies for six-redundancy signals: First, if all six redundancy signals are consistent, the consistent signal is selected; if all five redundancy signals are consistent, the consistent signal is selected; if all four redundancy signals are consistent, the consistent signal is selected; if three redundancy signals are inconsistent with the other three redundancy signals, the vote is considered invalid. Second, for three two-redundancy signals, a two-redundancy consistency monitoring strategy is first applied, and then the voted three-redundancy signal is monitored using a three-redundancy consistency monitoring strategy. Third, for two three-redundancy signals, a three-redundancy consistency monitoring strategy is first applied, and then the voted two-redundancy signal is monitored using a two-redundancy consistency monitoring strategy.

[0126] S401, construct a fault tree based on the voting monitoring strategy model and calculate the redundancy signal availability and integrity. Based on signal attributes, signal transmission links, and availability / integrity indicators, and using a voting monitoring strategy model library established for signal redundancy, calculate the probability of voting signal loss or error through the fault tree method. The constructed integrity indicator fault tree is as follows: Figure 6 As shown, the availability analysis fault tree is as follows: Figure 7 As shown in Table 4, the calculation results are as follows;

[0127] Table 4 Calculation Results

[0128] Model Integrity (1E-06 / H) Availability (1E-06 / H) Model 1 0.04332 0.1872 Model 2 0.0432 0 Model 3 0.01442 240.1

[0129] S501, Optimization of Voting Monitoring Strategy: A weighted average algorithm is used to comprehensively evaluate voting monitoring strategies. Assuming availability objective is X and integrity objective is Y, a certain voting monitoring strategy calculates voting signal availability index x and integrity index y, using the formula k = 0.6*e Y-y +0.4*e X-xAfter obtaining the comprehensive evaluation result of the voting monitoring strategy, and finally comprehensively evaluating all strategies in the monitoring strategy model library, the strategy with the largest k is the optimal strategy. The calculated k values ​​for the three strategies are as follows:

[0130] 1.000004499, 1.000004574, 0.99990856, finally strategy two is selected, that is, the three-way dual-redundancy signals first adopt the dual-redundancy consistency monitoring strategy, and the voted triple-redundancy signals adopt the triple-redundancy consistency monitoring strategy;

[0131] S502, updating the system architecture-level fault tree, updates the optimized voting monitoring strategy to the system architecture and updates the system-level fault tree, thereby redistributing and confirming availability / integrity indicators, ultimately satisfying the system's availability and integrity indicators.

[0132] An embodiment of the present invention provides a redundancy signal voting monitoring strategy optimization device, comprising:

[0133] The determination module is used to determine the availability and integrity targets of redundancy signals based on the system architecture hierarchical fault tree;

[0134] The identification module is used to identify signal transmission links, signal attributes, and equipment availability and integrity indicators.

[0135] A construction module is used to build a voting monitoring strategy model library based on signal redundancy and signal attributes. The voting monitoring strategy model library contains multiple voting monitoring strategy models.

[0136] The calculation module is used to construct a voting monitoring fault tree for each voting monitoring strategy model corresponding to the voting monitoring strategy based on the voting monitoring strategy model library, and to calculate the redundancy signal availability index and integrity index for each voting monitoring strategy based on the voting monitoring fault tree.

[0137] The selection module is used to select the voting monitoring strategy that maximizes the availability and integrity of the redundancy signal as the optimal voting monitoring strategy based on the calculation results and the voting monitoring objectives.

[0138] An embodiment of the present invention provides a redundancy signal voting monitoring strategy optimization device, including a processor and a memory. The processor is configured to execute instructions stored in the memory, and the processor implements the redundancy signal voting monitoring strategy optimization method of the present invention by executing the instructions.

[0139] An embodiment of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer's processing component, cause the processing component to perform the redundancy signal voting monitoring strategy optimization method described in this embodiment of the present invention.

[0140] An embodiment of the present invention provides a computer program product containing instructions that, when the computer program product is run on a computer, cause the computer to execute the redundancy signal voting monitoring strategy optimization method described in this embodiment of the present invention.

[0141] The above description merely illustrates the embodiments of this application, and while it is quite specific and detailed, it should not be construed as limiting the scope of the patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Furthermore, any parts not detailed in this application are conventional techniques.

Claims

1. A method for optimizing a redundancy signal voting monitoring strategy, characterized in that, Includes the following steps: S1, Determine the availability and integrity targets of redundancy signals based on the system architecture hierarchical fault tree; S2 identifies the signal transmission link, signal attributes, and device availability and integrity metrics. Signal attributes include signal redundancy and bus / discrete signals. The signal transmission link is the complete transmission path of the signal from the acquisition terminal to the flight control system. The signal availability and integrity metrics are the availability and integrity metrics of each device in the signal transmission link. S3, construct a voting monitoring strategy model library based on signal redundancy and signal attributes. The voting monitoring strategy model library contains multiple voting monitoring strategy models. The voting monitoring strategy model library constructed based on signal redundancy and signal attributes includes voting monitoring strategy model libraries for dual-redundancy, triple-redundancy, quadruple-redundancy, hexa-redundancy, and octau-redundancy signals. S4. Construct a voting monitoring fault tree for each voting monitoring strategy model corresponding to the voting monitoring strategy based on the voting monitoring strategy model library, and calculate the redundancy signal availability index and integrity index for each voting monitoring strategy based on the voting monitoring fault tree. S5, based on the results of S4 and the voting monitoring objective, select the voting monitoring strategy that maximizes the availability and integrity of the redundancy signal as the optimal voting monitoring strategy. The selection process for the optimal voting monitoring strategy is as follows: comprehensively evaluate the voting monitoring strategies using a weighted average formula to obtain the comprehensive evaluation result k; determine the voting monitoring strategy with the largest comprehensive evaluation result k as the optimal voting monitoring strategy; where the weighted average formula is: k = 0.6 * e Y-y +0.4* e X-x X is the availability target obtained in step S1, Y is the integrity target, x is the availability index obtained in step S4, and y is the integrity index.

2. The method according to claim 1, characterized in that, The dual-redundancy signal voting monitoring strategy model library includes a first voting monitoring strategy model and a second voting monitoring strategy model. The first voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: if the two redundancy signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid; if the two redundancy signals are inconsistent, the voting value is confirmed to be invalid. The second voting monitoring strategy model is used to monitor bus signals for voting. The voting monitoring process is as follows: If the two redundancy signals are consistent, the voting value is averaged to determine the voting value as valid; if the two redundancy signals are inconsistent and either of the two redundancy signals has invalid bus communication, the voting value is determined to be invalid. If the two redundancy signals are consistent, the voting value is taken as the average value to determine the validity of the voting value; if the two redundancy signals are inconsistent and either of the two redundancy signals is invalid in bus communication, the signal with valid bus communication is used as the voting value.

3. The method according to claim 2, characterized in that, The triple-redundancy signal voting monitoring strategy model library includes a third voting monitoring strategy model and a fourth voting monitoring strategy model. The third voting monitoring strategy model is used to monitor discrete signals. The voting monitoring process is as follows: If the three redundancy signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid; if the three redundancy signals are inconsistent, the majority signal is taken. The fourth voting monitoring strategy model is used to monitor the voting bus signals. The voting monitoring process is as follows: If the three redundancy signals are consistent, the middle value is taken as the voting value, and the voting value is determined to be valid. If any redundancy of the three redundancy signals is inconsistent with other signals or any redundancy bus communication is invalid, the second voting monitoring strategy model is used to monitor the voting of the remaining two redundancy signals. If any two redundancy signals of the three redundancy signals have invalid bus communication or are inconsistent in pairwise comparisons, the voting value is determined to be invalid.

4. The method according to claim 3, characterized in that, The quadruple redundancy signal voting monitoring strategy model library includes the fifth voting monitoring strategy model and the sixth voting monitoring strategy model. The fifth voting monitoring strategy model is used to monitor discrete signals during voting. The voting monitoring process is as follows: If the four redundancy signals are consistent, the consistent signal is taken as the voting value and the voting value is determined to be valid; if three redundancy signals are consistent, the consistent signal is taken as the voting value and the voting value is determined to be valid; if two redundancy signals are inconsistent with the other two redundancy signals, the voting value is determined to be invalid; the two dual-redundancy signals are first monitored by the first voting monitoring strategy model, and then the result is monitored by the first voting monitoring strategy model. The sixth voting monitoring strategy model is used to monitor the voting bus signals. The voting monitoring process is as follows: If the four redundancy signals are consistent, the average of the two middle redundancy signals is taken as the voting value, and the voting value is determined to be valid. If any redundancy of the four redundancy signals is inconsistent with other signals or if any redundancy bus communication is invalid, the fourth voting monitoring strategy model is used to monitor the voting of the remaining three redundancy signals. If any two redundancy signals of the four redundancy signals are consistent but inconsistent with the signals of the other two consistent redundancy signals, the voting value is determined to be invalid. If any two redundancy bus communication of the four redundancy signals is invalid, the second voting monitoring strategy model is used to monitor the voting of the remaining two redundancy signals. The two dual-redundancy signals are first monitored by the second voting monitoring strategy model, and then the results are monitored by the second voting monitoring strategy model.

5. The method according to claim 4, characterized in that, The six-redundancy signal voting monitoring strategy model library includes the seventh and eighth voting monitoring strategy models. The seventh voting monitoring strategy model is used to monitor discrete signals during voting. The voting monitoring process is as follows: If six redundancy signals are consistent, or five redundancy signals are consistent, or four redundancy signals are consistent, then the consistent signal is taken as the voting value, and the voting value is determined to be valid; if three redundancy signals are inconsistent with the other three redundancy signals, then the voting value is determined to be invalid; for two redundancy signals, the third voting monitoring strategy model is first used for voting monitoring, and then the first voting monitoring strategy model is used for voting monitoring of the result; for three redundancy signals, the first voting monitoring strategy model is first used for voting monitoring, and then the third voting monitoring strategy model is used for voting monitoring of the result. The eighth voting monitoring strategy model is used to monitor the voting bus signal. The voting monitoring process is as follows: If the six redundancy signals are consistent, the average of the two middle channels is taken as the voting value, and the voting value is determined to be valid. If any redundancy signal bus communication is invalid or inconsistent with other five redundancy signals, the median value of the five redundancy signals is taken as the voting value, and the voting value is determined to be valid. If any two redundancy signal bus communication is invalid or any two redundancy signals are inconsistent with other four redundancy signals, the sixth voting monitoring strategy model is used to monitor the voting of the remaining four redundancy signals. If any three redundancy bus communication is invalid or inconsistent with other three redundancy signals, the fourth voting monitoring strategy model is used to monitor the voting of the remaining three redundancy signals. If the four redundancy signal bus communication is invalid, the voting value is considered invalid. Two three redundancy signals are first monitored using the fourth voting monitoring strategy model, and then the second voting monitoring strategy model is used to monitor the result. Three two redundancy signals are first monitored using the second voting monitoring strategy model, and then the fourth voting monitoring strategy model is used to monitor the result.

6. The method according to claim 5, characterized in that, The octet redundancy signal voting monitoring strategy model library includes the ninth and tenth voting monitoring strategy models. The ninth voting monitoring strategy model is used to monitor discrete signals during voting. The voting monitoring process is as follows: If eight, seven, six, or five redundancy signals are consistent, the consistent signal is taken as the voting value, and the voting value is determined to be valid. If four redundancy signals are inconsistent with the other four redundancy signals, the voting value is determined to be invalid. For two four-redundancy signals, the fifth voting monitoring strategy model is first used for voting monitoring, and then the first voting monitoring strategy model is used for voting monitoring of the result. For four two-redundancy signals, the first voting monitoring strategy model is first used for voting monitoring, and then the fifth voting monitoring strategy model is used for voting monitoring of the result. The tenth voting monitoring strategy model is used to monitor the voting bus signal. The voting monitoring process is as follows: If all eight redundant signals are consistent, the average of the two middle signals is taken as the voting value, and the voting value is determined to be valid. If any redundant signal bus communication is invalid or any redundant signal is inconsistent with the other seven redundant signals, the middle value of the seven redundant signals is taken as the voting value, and the voting value is determined to be valid. If two redundant signal bus communications are invalid or two redundant signals are inconsistent with the other six redundant signals, the eighth voting monitoring strategy model is used to monitor the remaining six redundant signals to determine the voting value is valid. If three redundant bus communications are invalid or three redundant signals are inconsistent with the other five redundant signals, the middle value of the five redundant signals is taken as the voting value, and the voting value is determined to be valid. If four redundant signals are consistent but inconsistent with the other four redundant signals, the voting value is determined to be invalid. If four redundant bus communications are invalid, the sixth voting monitoring strategy model is used to monitor the remaining four redundant channels to determine the validity of the voting value. If five redundant bus communications are invalid, the fourth voting monitoring strategy model is used to monitor the remaining three redundant channels to determine the voting value is valid; if six redundant bus communications are invalid, the voting value is determined to be invalid; for two four-redundant signals, the sixth voting monitoring strategy model is used for voting monitoring first, and then the second voting monitoring strategy model is used to monitor the result; for four two-redundant signals, the second voting monitoring strategy is used for voting monitoring first, and then the sixth voting monitoring strategy model is used to monitor the result.

7. A device for optimizing a redundancy signal voting monitoring strategy, characterized in that, The apparatus for performing the method according to any one of claims 1 to 6 comprises: The determination module is used to determine the availability and integrity targets of redundancy signals based on the system architecture hierarchical fault tree; The identification module is used to identify signal transmission links, signal attributes, and device availability and integrity indicators. Signal attributes include signal redundancy and bus signal / discrete signal. The signal transmission link is the complete transmission path of the signal from the acquisition end to the flight control system. The signal availability and integrity indicators are the availability and integrity indicators of each device in the signal transmission link. The construction module is used to build a voting monitoring strategy model library based on signal redundancy and signal attributes. The voting monitoring strategy model library contains multiple voting monitoring strategy models. The voting monitoring strategy model library built based on signal redundancy and signal attributes includes voting monitoring strategy model libraries for dual-redundancy, triple-redundancy, quadruple-redundancy, hexa-redundancy, and octau-redundancy signals. The calculation module is used to construct a voting monitoring fault tree for each voting monitoring strategy model corresponding to the voting monitoring strategy based on the voting monitoring strategy model library, and to calculate the redundancy signal availability index and integrity index for each voting monitoring strategy based on the voting monitoring fault tree. The selection module is used to select the voting monitoring strategy that maximizes the availability and integrity of the redundancy signal based on the calculation results and the voting monitoring objective. The selection process for the optimal voting monitoring strategy is as follows: A weighted average formula is used to comprehensively evaluate the voting monitoring strategies, obtaining a comprehensive evaluation result k; the voting monitoring strategy with the largest comprehensive evaluation result k is determined as the optimal voting monitoring strategy. The weighted average formula is: k = 0.6 * e Y-y +0.4* e X-x X represents the availability objective, Y represents the integrity objective, x represents the availability metric, and y represents the integrity metric.

Images