Dual-redundancy instance master-slave management method for health management of avionics core processing platform

Abstract

The invention provides a dual-redundancy instance master-slave management method for health management of an avionics core processing platform, and relates to the technical field of airborne avionics. According to the method, master-slave management is carried out by designing message receiving and sending between two health management instances of the avionics core processing platform, so that only one master instance exists at the same moment, and the health management efficiency is improved. Only the master instance responds to a non-periodic command from the airborne health management system, and the slave instance switches the master instance and the slave instance in time when the master instance does not have a processing condition. The method is high in expandability, an avionics core processing platform belongs to an airborne core processing platform, most software is provided with a dual-redundancy framework in design, and the dual-redundancy instance master-slave management method can be expanded to other resident software.

Description

Technical Field

[0001] The present invention relates to the technical field of airborne avionics, and in particular provides a dual-redundancy instance master-slave management method for health management of an avionics core processing platform. Background Art

[0002] The integrated avionics processing platform is a distributed real-time computer network on the aircraft. The avionics core processing platform contains multiple computing processing modules and their interfaces with the network. Each computing module can host multiple applications with different security levels.

[0003] The main functions of the health management software include: 1. Fault detection, filtering and integration of the avionics core processing platform; 2. Periodic reporting of faults to the crew warning system and the airborne health management system; 3. Responding to and processing non-periodic commands from the airborne health management system. The most important non-periodic command response is to specify a module to perform IBIT (Initiated Built-In-Test) according to the requirements of the airborne health management system, and return the IBIT results to the airborne health management system.

[0004] In order to ensure that when only one side of the cabinet is running, the health management software can normally send fault reports to the crew warning system and the airborne health management system, the avionics core processing platform is configured with dual redundancy instances, that is, two health management instances, which reside in the left cabinet GPM_L1 (GPM, General Processor Module) and the right cabinet GPM_R1. Both health management instances can filter and integrate faults and publish fault reports, but for the airborne health management system, at the same time, it is expected that only one health management instance software responds to its non-periodic commands to prevent the two instances from returning different responses to the airborne health management system, resulting in information unavailability.

[0005] Therefore, information needs to be synchronized between the two health management instances of the avionics core processing platform to ensure that there is only one master instance at the same time, and the master-slave instance can be switched in time when the master instance does not have the processing conditions. Summary of the invention

[0006] The purpose of the present application is to solve the problem that dual-redundancy instances of health management simultaneously respond to non-periodic request commands from an onboard health management system, resulting in reduced credibility and misleading the onboard health management system.

[0007] In order to achieve the above-mentioned object, the present invention adopts the following technical solution: a dual-redundancy instance master-slave management method for avionics core processing platform health management, the method comprising:

[0008] S1: Initialization of role information of two health management instances;

[0009] S2: The two health management instances send the initialization IMA health management status summary message of the health management instance to each other and receive the fault monitoring information from the switch and the initialization IMA health management status summary message of the other health management instance, wherein the IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information;

[0010] S3: The two health management instances start arbitration based on the received initial IMA health management status summary message;

[0011] S4: The two health management instances send the IMA health management status summary message after arbitration of the health management instance to each other and receive the fault monitoring information from the switch and the IMA health management status summary message after arbitration of the other health management instance, wherein the IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information;

[0012] S5: The two health management instances perform normal arbitration based on the received IMA health management status summary message and return to S4 after arbitration.

[0013] The dual-redundancy instance master-slave management method for the avionics core processing platform health management provided by the present invention also has such a technical feature that the initialization of S1 includes setting the role information of the health management instance to the slave instance information and setting the switch backup information to the default value.

[0014] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has such a technical feature that the periodic sending of the IMA health management status summary message of the health management instance to the other party in S2 includes:

[0015] Generate the role information and switch backup information of the corresponding health management instance at the corresponding position offset according to the structure definition of the IMA health management status summary message;

[0016] The role information and switch backup information of the health management instance are sent according to the period of the IMA health management status summary message.

[0017] The dual-redundancy instance master-slave management method for the avionics core processing platform health management provided by the present invention also has such a technical feature that S2 also includes a judgment on whether the current health management instance receives an IMA health management status summary message from another health management instance according to a predetermined period.

[0018] The dual-redundancy instance master-slave management method for the health management of the avionics core processing platform provided by the present invention also has such a technical feature that the structure definition of the IMA health management status summary message includes data validity definition, field name definition, field size definition, field data type definition and data set definition.

[0019] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has such a technical feature that S3 includes:

[0020] S3.1: If the IMA health management status summary message information sent by another health management instance is not received according to the scheduled period, the health management instance is set as the main instance and IBIT management is not performed;

[0021] S3.2: If the IMA health management status summary message information sent by another health management instance is received according to a predetermined period, the cabinet location where the health management instance resides is determined;

[0022] S3.3: If the cabinet where this health management instance resides is the left cabinet, the role information of this health management instance is set to the master instance and IBIT management is not performed; if the cabinet where this health management instance resides is the right cabinet, the role information of this health management instance is maintained as a slave instance.

[0023] The dual-redundancy instance master-slave management method for the health management of the avionics core processing platform provided by the present invention also has such a technical feature, the S5 includes: obtaining the role information of another health management instance in the received IMA health management status summary message information according to the structure definition of the IMA health management status summary message; performing normal arbitration according to the role information of the other health management instance and the judgment result of whether the IMA health management status summary message of the other health management instance is received according to the predetermined period.

[0024] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has such a technical feature that the normal arbitration includes:

[0025] If the health management instance is a master instance and IBIT management is not performed, and the role information of another health management instance received is a slave instance, when the health management instance meets the preset conversion conditions, the role information of the health management instance is switched to a slave instance within 2 seconds;

[0026] If the health management instance is the primary instance and IBIT management is not performed, and the IMA health management status summary message information sent by another health management instance is not received for three consecutive times, the role information of the health management instance is maintained as the primary instance and IBIT management is not performed;

[0027] If this health management instance is the master instance and does not perform IBIT management, and the health management instance on the other side is the slave instance, and an IBIT request is received from the airborne health management system at the same time, and the test ID is not the host device, then after determining that the module corresponding to the test ID specified by the airborne health management system can perform IBIT, and the IBIT of the module is started, this health management instance sets the role information to the master instance and performs IBIT management;

[0028] If this health management instance is the master instance and IBIT management is not performed, and the health management instance on the other side is the master instance and IBIT management is performed, then this health management instance is set as a slave instance;

[0029] If the health management instance is the primary instance and IBIT management is not performed, the health management instance on the other side is the primary instance and IBIT management is not performed, and the cabinet where the health management instance resides is the left cabinet, then the health management instance is kept as the primary instance and IBIT management is not performed;

[0030] If the health management instance is the master instance and IBIT management is not performed, the health management instance on the other side is the master instance and IBIT management is not performed, and the cabinet where the health management instance resides is the right cabinet, then set the health management instance as a slave instance;

[0031] If this health management instance is the master instance and performs IBIT management, and the other health management instance is the slave instance, after the module that performs IBIT management completes the test, the role information of this health management instance is set to the master instance and IBIT management is not performed;

[0032] If this health management instance is the primary instance and performs IBIT management, and the health management instance on the other side is the primary instance and does not perform IBIT management, then this health management instance is set to remain the primary instance and perform IBIT management;

[0033] If the health management instance is a slave instance and has not received the IMA health management status summary message information sent by another health management instance for three consecutive times, the role information of the health management instance is set to the master instance and IBIT management is not performed;

[0034] If the health management instance is a slave instance, and the role information of the health management instance on the other side remains the master instance for at least 3 seconds and no IBIT management is performed, and then the role information of the other health management instance is set to the slave instance for 2 seconds, then the health management instance is set to the master instance within 2 seconds and no IBIT management is performed;

[0035] If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the left cabinet, the role information of the health management instance is set to the master instance and IBIT management is not performed;

[0036] If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the right cabinet, the health management instance is kept as a slave instance.

[0037] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has such a technical feature that the preset conversion condition includes one selected from the following conditions:

[0038] The connection between this health management instance and the onboard health management system is lost;

[0039] This health management instance receives an IBIT request from the onboard health management system and the test ID is the host GPM;

[0040] The main power of the host GPM of this health management instance is lost or a data load request is accepted.

[0041] Beneficial Effects

[0042] The dual-redundancy instance master-slave management method for the avionics core processing platform health management provided by the present invention uses the IMA health management cycle status summary message to perform master-slave instance interaction and synchronization, and the message can be used to back up the switch's fault cycle monitoring information. The switch is a sub-device of the avionics core processing platform, and different switches are connected to different networks, and there is no redundant backup function between each other. The avionics core processing platform health management function collects the cycle monitoring information from each sub-device and integrates the fault information and sends it to the crew alarm system and the airborne health management system system. The avionics core processing platform health management function can use the IMA health management cycle status summary message used for dual-redundancy instance master-slave synchronization to back up the switch's cycle monitoring information.

[0043] The dual-redundancy instance master-slave management method for the health management of the avionics core processing platform provided by the present invention comprehensively considers all states of the aircraft software, including the initialization state and the normal state. In the initialization state, it is assumed that another instance has played the master role, and the current instance is initialized as a slave instance, which reduces the situation where the response information is unreliable due to the presence of two master instances when the aircraft is in a normal state. The method has strong scalability. The avionics core processing platform belongs to the airborne core processing platform. Most software designs have a dual-redundancy architecture. The dual-redundancy instance master-slave management method proposed by the present invention can be extended to other resident software. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A flowchart of a master-slave management determination method provided by an embodiment of the present invention;

[0046] Figure 2 A health management message cross-linking diagram provided by an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of health management initiation arbitration provided in an embodiment of the present invention;

[0048] Figure 4 This is a schematic diagram of the master-slave transfer of health management provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The present application is further described in detail below in conjunction with the accompanying drawings and examples, but it should be noted that these implementation methods are not limitations of the present application, and equivalent changes or substitutions in functions, methods, or structures made by ordinary technicians in the field based on these implementation methods are all within the scope of protection of the present application.

[0050] In the description of the embodiments of the present application, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the creation of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the creation of the present application.

[0051] In addition, the terms "first", "second", "third", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", etc. may explicitly or implicitly include one or more of the features. In the description of the invention of this application, unless otherwise specified, the meaning of "plurality" is two or more.

[0052] The terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the invention of this application can be understood by specific circumstances.

[0053] Health management can be divided into master instances and slave instances. Only the master instance can set the "self-test processable" parameter in the periodic fault report sent to the airborne health management system to indicate that this instance can receive non-periodic request commands from the airborne health management system and can perform initialization tests. When the airborne health management system sends a non-periodic command to the avionics core processing platform, only the health management master instance receives the command, determines whether to execute the command based on the current state of the avionics core processing platform, and returns the judgment result and execution result to the airborne health management system, while the health management slave instance ignores the non-periodic request command from the airborne health management system.

[0054] like Figure 1 As shown, an embodiment of the present application provides a dual-redundancy instance master-slave management method for health management of an avionics core processing platform, the method comprising:

[0055] S1: Initialization of role information of two health management instances;

[0056] S2: The two health management instances send the initialization IMA health management status summary message of the health management instance to each other and receive the fault monitoring information from the switch and the initialization IMA health management status summary message of the other health management instance, wherein the IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information;

[0057] S3: The two health management instances start arbitration based on the received initial IMA health management status summary message;

[0058] S4: The two health management instances send the IMA health management status summary message after arbitration of the health management instance to each other and receive the fault monitoring information from the switch and the IMA health management status summary message after arbitration of the other health management instance, wherein the IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information;

[0059] S5: The two health management instances perform normal arbitration based on the received IMA health management status summary message and return to S4 after arbitration.

[0060] In some embodiments, the initialization of S1 includes setting the role information of the health management instance to the slave instance information and setting the switch backup information to the default value.

[0061] In some embodiments, the periodic sending of the IMA health management status summary message of the health management instance to the other party in S2 includes:

[0062] Generate the role information and switch backup information of the corresponding health management instance at the corresponding position offset according to the structure definition of the IMA health management status summary message;

[0063] The role information and switch backup information of the health management instance are sent according to the period of the IMA health management status summary message.

[0064] In some embodiments, S2 further includes determining whether the health management instance receives an IMA health management status summary message from another health management instance according to a predetermined period.

[0065] In some embodiments, the structure definition of the IMA health management status summary message includes data validity definition, field name definition, field size definition, field data type definition, and data set definition.

[0066] In some embodiments, S3 includes:

[0067] S3.1: If the IMA health management status summary message information sent by another health management instance is not received according to the scheduled period, the health management instance is set as the main instance and IBIT management is not performed;

[0068] S3.2: If the IMA health management status summary message information sent by another health management instance is received according to a predetermined period, the cabinet location where the health management instance resides is determined;

[0069] S3.3: If the cabinet where this health management instance resides is the left cabinet, the role information of this health management instance is set to the master instance and IBIT management is not performed; if the cabinet where this health management instance resides is the right cabinet, the role information of this health management instance is maintained as a slave instance.

[0070] In some embodiments, the S5 includes: obtaining the role information of another health management instance in the received IMA health management status summary message information according to the structure definition of the IMA health management status summary message; performing normal arbitration based on the role information of the other health management instance and the judgment result of whether the IMA health management status summary message of another health management instance is received according to the predetermined period.

[0071] In some embodiments, the normal arbitration includes:

[0072] If the health management instance is a master instance and IBIT management is not performed, and the role information of another health management instance received is a slave instance, when the health management instance meets the preset conversion conditions, the role information of the health management instance is switched to a slave instance within 2 seconds;

[0073] If the health management instance is the primary instance and IBIT management is not performed, and the IMA health management status summary message information sent by another health management instance is not received for three consecutive times, the role information of the health management instance is maintained as the primary instance and IBIT management is not performed;

[0074] If this health management instance is the master instance and does not perform IBIT management, and the health management instance on the other side is the slave instance, and an IBIT request is received from the airborne health management system at the same time, and the test ID is not the host device, then after determining that the module corresponding to the test ID specified by the airborne health management system can perform IBIT, and the IBIT of the module is started, this health management instance sets the role information to the master instance and performs IBIT management;

[0075] If this health management instance is the master instance and IBIT management is not performed, and the health management instance on the other side is the master instance and IBIT management is performed, then this health management instance is set as a slave instance;

[0076] If the health management instance is the primary instance and IBIT management is not performed, the health management instance on the other side is the primary instance and IBIT management is not performed, and the cabinet where the health management instance resides is the left cabinet, then the health management instance is kept as the primary instance and IBIT management is not performed;

[0077] If the health management instance is the master instance and IBIT management is not performed, the health management instance on the other side is the master instance and IBIT management is not performed, and the cabinet where the health management instance resides is the right cabinet, then set the health management instance as a slave instance;

[0078] If this health management instance is the master instance and performs IBIT management, and the other health management instance is the slave instance, after the module that performs IBIT management completes the test, the role information of this health management instance is set to the master instance and IBIT management is not performed;

[0079] If this health management instance is the primary instance and performs IBIT management, and the health management instance on the other side is the primary instance and does not perform IBIT management, then this health management instance is set to remain the primary instance and perform IBIT management;

[0080] If the health management instance is a slave instance and has not received the IMA health management status summary message information sent by another health management instance for three consecutive times, the role information of the health management instance is set to the master instance and IBIT management is not performed;

[0081] If the health management instance is a slave instance, and the role information of the health management instance on the other side remains the master instance for at least 3 seconds and no IBIT management is performed, and then the role information of the other health management instance is set to the slave instance for 2 seconds, then the health management instance is set to the master instance within 2 seconds and no IBIT management is performed;

[0082] If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the left cabinet, the role information of the health management instance is set to the master instance and IBIT management is not performed;

[0083] If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the right cabinet, the health management instance is kept as a slave instance.

[0084] In some embodiments, the preset conversion condition includes one selected from the following conditions:

[0085] The connection between this health management instance and the onboard health management system is lost;

[0086] This health management instance receives an IBIT request from the onboard health management system and the test ID is the host GPM;

[0087] The main power of the host GPM of this health management instance is lost or a data load request is accepted.

[0088] In some embodiments, a dual-redundancy instance master-slave management method for avionics core processing platform health management is provided, such as Figure 2-4 As shown, the details are as follows:

[0089] Step 1. As attached Figure 2 As shown, while the two health management instances are publishing fault reports and responding to non-periodic commands from the onboard health management system, in order to synchronize and monitor the role information of the two instances, each health management instance publishes an IMA health management status summary message, which includes the role information of the health management instance and the backup information of the switch fault information. The IMA health management status summary message structure is defined as follows (the specific fault information of the switch is not expanded in detail here):

[0090] Table 1 IMA health management status summary message structure definition table

[0091]

[0092] The "Instance Role" field in the message marks whether the instance on this side is a master instance or a slave instance. If it is a slave instance, it ignores non-periodic commands from the airborne health management system. If it is a master instance, it can respond to non-periodic commands from the airborne health management system and manage IBIT requests and other commands from the airborne health management system.

[0093] Among them, the master instance is divided into "master instance and no IBIT management" and "master instance and IBIT management". "Master instance and no IBIT management" means that the instance is the master instance and no module in the platform is executing IBIT. When the airborne health management system issues a non-periodic command for a module to perform IBIT, the master instance should respond to the airborne health management system in a timely manner, and determine whether IBIT can be performed, and respond to the airborne health management system in a timely manner whether IBIT can be performed, and perform IBIT management at the same time. "Master instance and IBIT management" means that the instance is the master instance and there is a module in the platform executing IBIT. At the same time, only one module in the platform can execute IBIT. This field marks that an IBIT is already being executed and cannot respond to another IBIT non-periodic command from the airborne health management system.

[0094] Step 2. When the health management function is started, in order to prevent another instance from being the master instance, each health management instance assumes that another instance is already the master device, and sets the instance role on this side to "slave instance" when the IMA health management cycle status summary message is first issued. At the same time, the backup information of the switch fault information in the IMA health management status summary message is set to the default value during initialization.

[0095] Step 3. As attached Figure 2 As shown, the two health management instances will start arbitration after publishing the first IMA health management status summary message. Within 2 seconds after publishing the first IMA health management status summary message, if any instance does not receive the IMA health management status summary message from the other instance according to the scheduled period, it is considered that the other instance is not activated, and the instance role on this side is set to "master instance and not IBIT managed". Within 2 seconds after publishing the first IMA health management status summary message, when both instances detect that the other side is in an activated state, it is necessary to determine the GPM location where the health management instances on both sides reside. If the health management instance resides in the left cabinet, that is, HM_L1, the instance role is set to "master instance and not IBIT managed"; if the health management instance resides in the right cabinet, that is, HM_R1, the instance role continues to be set to "slave instance". At the same time, the health management software instance fills the backup information of the switch fault information in the IMA health management status summary message according to the fault monitoring information received from the switch.

[0096] Step 4. Two seconds after the first IMA health management status summary message is released, normal arbitration begins. Normal arbitration is based on master-slave switching arbitration under specific conditions. At the same time, the health management software instance fills in the backup information of the switch fault information in the IMA health management status summary message based on the fault monitoring information received from the switch. When the GPM where the master instance resides is in a specific condition, the instance cannot continue to serve as the master instance to process non-periodic commands from the airborne health management system, and the master instance needs to switch to the slave role. When this instance is a slave instance and the master instance on the other side cannot continue to serve as the master instance, the slave instance should be converted to the master instance in time to ensure that the avionics core processing platform responds to and processes non-periodic commands from the airborne health management system in a timely manner. The specific situation is as follows.

[0097] 1. As Figure 4 As shown in the figure, when this side is the master instance and its status is "master instance and not managed by IBIT", and the other side is the slave instance, when any of the following conditions is met, the master instance should be transferred and the instance role should be set to "slave instance" within 2 seconds.

[0098] 1) The health management instance on this side loses the connection with the onboard health management system. If the connection with the onboard health management system is lost, it is impossible to continue to interact with the onboard health management system and cannot complete the function of responding to the non-periodic commands of the onboard health management system.

[0099] 2) An IBIT request is received and the test ID (representing the device number for which IBIT is required) is the host GPM. If the host GPM performs IBIT, it will be powered off and perform a self-test. During the self-test, the functions resident on the GPM stop running and cannot interact with the onboard health management system.

[0100] 3) The main power supply of the host GPM is lost or the data loading request is accepted. If the main power supply of the host GPM is lost, it will not be able to get long-term power supply in the future, and there is a risk of losing the main instance; if data is loaded on the host GPM, the functions resident on the GPM will stop running and will not be able to interact with the onboard health management system during this period.

[0101] When the slave instance monitors that the other instance remains the "master instance and is not managed by IBIT" for at least 3 seconds and is set to "slave instance" for 2 seconds, it is considered that the master instance on the other side is about to transfer the master instance. In this case, the slave instance on this side should be set to "master instance and is not managed by IBIT" within 2 seconds.

[0102] 2. When one side is the master instance and its status is "master instance and no IBIT management is performed", and the other side is the slave instance, when the master instance receives an IBIT non-periodic command from the airborne health management system and the test ID requested by the IBIT does not correspond to the GPM where this instance resides, after determining that the module corresponding to the test ID specified by the airborne health management system can perform IBIT and the IBIT of the module is started, the master instance should set the role to "master instance and perform IBIT management".

[0103] 3. When one side is the master instance and its status is "master instance and IBIT management", and the other side is the slave instance, when the module performing IBIT in the avionics core processing platform completes self-detection, the master instance should set its role to "master instance and not performing IBIT management".

[0104] 4. When one side is the master instance and the other side is the slave instance, if the slave instance fails to receive the IMA health management cycle status summary message from the master instance as expected for three consecutive times or the received message is invalid, the instance on the other side is considered to have failed. The slave instance needs to set the instance role to "master instance and not IBIT managed" within 2 seconds.

[0105] 5. When both sides are master instances and their status is "master instance and not managed by IBIT", in order to ensure that there is only one master instance in the platform at the same time, it is necessary to determine the GPM location where the health management instances on both sides reside. If the health management instance resides in the left cabinet, that is, HM_L1, the instance role continues to be set to "master instance and not managed by IBIT"; if the health management instance resides in the right cabinet, that is, HM_R1, the instance role is set to "slave instance".

[0106] 6. When both sides are "slave instances", in order to ensure that there is a master instance in the platform to receive non-periodic requests from the airborne health management system, it is necessary to determine the GPM location of the health management instances on both sides. If the health management instance resides in the left cabinet, that is, HM_L1, the instance role is set to "master instance and no IBIT management"; if the health management instance resides in the right cabinet, that is, HM_R1, the instance role continues to be set to "slave instance".

[0107] 7. When one side is the master instance and its status is "master instance and not managed by IBIT", and the other side is also the master instance and its status is "master instance and managed by IBIT", the master instance with the status of "master instance and not managed by IBIT" should set its role to "slave instance".

[0108] The above is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application. The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and variations can be made without departing from the technical principles of the present application, and these improvements and variations should also be regarded as the protection scope of the present application.

Claims

1. A dual-redundancy instance master-slave management method for avionics core processing platform health management, characterized in that: The method comprises: S1: Initialization of role information of two health management instances; S2: The two health management instances send the initialization IMA health management status summary message of the health management instance to each other and receive the fault monitoring information from the switch and the initialization IMA health management status summary message of the other health management instance, wherein the IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information; S3: The two health management instances start arbitration based on the received initial IMA health management status summary message; S4: The two health management instances send the IMA health management status summary message after arbitration of the health management instance to each other and receive the fault monitoring information from the switch and the IMA health management status summary message after arbitration of the other health management instance, wherein the IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information; S5: The two health management instances perform normal arbitration based on the received IMA health management status summary message and return to S4 after arbitration.

2. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The initialization of S1 includes setting the role information of the health management instance to the slave instance information and setting the switch backup information to the default value.

3. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The periodic sending of the IMA health management status summary message of the health management instance to the other party in S2 includes: Generate the role information and switch backup information of the corresponding health management instance at the corresponding position offset according to the structure definition of the IMA health management status summary message; The role information and switch backup information of the health management instance are sent according to the period of the IMA health management status summary message.

4. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The S2 also includes determining whether the health management instance receives an IMA health management status summary message from another health management instance according to a predetermined period.

5. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 3, characterized in that: The structure definition of the IMA health management status summary message includes data validity definition, field name definition, field size definition, field data type definition and data set definition.

6. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The S3 includes: S3.1: If the IMA health management status summary message information sent by another health management instance is not received according to the scheduled period, the health management instance is set as the main instance and IBIT management is not performed; S3.2: If the IMA health management status summary message information sent by another health management instance is received according to a predetermined period, the cabinet location where the health management instance resides is determined; S3.3: If the cabinet where this health management instance resides is the left cabinet, the role information of this health management instance is set to the master instance and IBIT management is not performed; if the cabinet where this health management instance resides is the right cabinet, the role information of this health management instance is maintained as a slave instance.

7. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The S5 includes: obtaining the role information of another health management instance in the received IMA health management status summary message information according to the structure definition of the IMA health management status summary message; performing normal arbitration according to the role information of the other health management instance and the judgment result of whether the IMA health management status summary message of the other health management instance is received according to the predetermined period.

8. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 7, characterized in that: The normal arbitration includes: If the health management instance is a master instance and IBIT management is not performed, and the role information of another health management instance received is a slave instance, when the health management instance meets the preset conversion conditions, the role information of the health management instance is switched to a slave instance within 2 seconds; If the health management instance is the primary instance and IBIT management is not performed, and the IMA health management status summary message information sent by another health management instance is not received for three consecutive times, the role information of the health management instance is maintained as the primary instance and IBIT management is not performed; If this health management instance is the master instance and does not perform IBIT management, and the health management instance on the other side is the slave instance, and an IBIT request is received from the airborne health management system at the same time, and the test ID is not the host device, then after determining that the module corresponding to the test ID specified by the airborne health management system can perform IBIT, and the IBIT of the module is started, this health management instance sets the role information to the master instance and performs IBIT management; If this health management instance is the master instance and IBIT management is not performed, and the health management instance on the other side is the master instance and IBIT management is performed, then this health management instance is set as a slave instance; If the health management instance is the primary instance and IBIT management is not performed, the health management instance on the other side is the primary instance and IBIT management is not performed, and the cabinet where the health management instance resides is the left cabinet, then the health management instance is kept as the primary instance and IBIT management is not performed; If the health management instance is the master instance and IBIT management is not performed, the health management instance on the other side is the master instance and IBIT management is not performed, and the cabinet where the health management instance resides is the right cabinet, then set the health management instance as a slave instance; If this health management instance is the master instance and performs IBIT management, and the other health management instance is the slave instance, after the module that performs IBIT management completes the test, the role information of this health management instance is set to the master instance and IBIT management is not performed; If this health management instance is the primary instance and performs IBIT management, and the health management instance on the other side is the primary instance and does not perform IBIT management, then this health management instance is set to remain the primary instance and perform IBIT management; If the health management instance is a slave instance and has not received the IMA health management status summary message information sent by another health management instance for three consecutive times, the role information of the health management instance is set to the master instance and IBIT management is not performed; If the health management instance is a slave instance, and the role information of the health management instance on the other side remains the master instance for at least 3 seconds and no IBIT management is performed, and then the role information of the other health management instance is set to the slave instance for 2 seconds, then the health management instance is set to the master instance within 2 seconds and no IBIT management is performed; If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the left cabinet, the role information of the health management instance is set to the master instance and IBIT management is not performed; If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the right cabinet, the health management instance is kept as a slave instance.

9. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 8, characterized in that: The preset conversion condition includes one selected from the following conditions: The connection between this health management instance and the onboard health management system is lost; This health management instance receives an IBI T request from the onboard health management system and the test ID is the host GPM; The main power of the host GPM of this health management instance is lost or a data load request is accepted.

Images