A dual-redundancy instance master-slave management method for health management of an avionics core processing platform

Abstract

The application provides a dual-redundancy instance master-slave management method for health management of an avionics core processing platform, and relates to the technical field of airborne avionics. The method designs the sending and receiving of messages between two instances of the health management of the avionics core processing platform to perform master-slave management, so as to ensure that only one master instance exists at the same time, only the master instance responds to aperiodic commands from an airborne health management system, and the slave instance timely switches the master-slave instances when the master instance does not have processing conditions. The method has strong scalability, the avionics core processing platform belongs to an airborne core processing platform, most software designs have a dual-redundancy architecture, and the dual-redundancy instance master-slave management method provided by the application can be extended to other resident software.

Description

Technical Field

[0001] The present invention relates to the technical field of airborne avionics, and in particular provides a dual-redundancy instance master-slave management method for health management of an avionics core processing platform. Background Art

[0002] The integrated avionics processing platform is a distributed real-time computer network on the aircraft. The avionics core processing platform contains multiple computing processing modules and their interfaces with the network. Each computing module can host multiple applications with different security levels.

[0003] The main functions of the health management software include: 1. Fault detection, filtering and integration functions of the avionics core processing platform; 2. Periodic reporting of faults to the crew warning system and the airborne health management system; 3. Responding to and processing non-periodic commands from the airborne health management system. The most important non-periodic command response is to specify a module to perform IBIT (Initiated Built-In-Test) according to the requirements of the airborne health management system, and return the IBIT results to the airborne health management system.

[0004] To ensure that the health management software can properly send fault reports to the crew warning system and the onboard health management system when only one cabinet is operating, the avionics core processing platform is configured with dual redundant instances: two health management instances, one residing in the left cabinet (GPM_L1, General Processor Module) and the other in the right cabinet (GPM_R1). Both health management instances can filter and consolidate faults and issue fault reports. However, the onboard health management system expects only one health management instance to respond to non-periodic commands at any given time to prevent the two instances from returning different responses to the onboard health management system, resulting in information unavailability.

[0005] Therefore, information needs to be synchronized between the two health management instances of the avionics core processing platform to ensure that there is only one master instance at the same time, and the master-slave instance switch can be performed in time when the master instance does not have the processing conditions. Summary of the Invention

[0006] The purpose of this application is to solve the problem that dual-redundancy instances of health management simultaneously respond to non-periodic request commands from an onboard health management system, resulting in decreased credibility and misleading the onboard health management system.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: a dual-redundancy instance master-slave management method for avionics core processing platform health management, the method comprising:

[0008] S1: Initialization of role information of two health management instances;

[0009] S2: The two health management instances each send an initial IMA health management status summary message of their own health management instance to the other and receive fault monitoring information from the switch and an initial IMA health management status summary message from the other health management instance. The IMA health management status summary message includes the role information of the health management instance and backup information of the switch fault information.

[0010] S3: The two health management instances start arbitration based on the received initial IMA health management status summary message;

[0011] S4: The two health management instances each send an IMA health management status summary message after arbitration of the health management instance to the other party and receive the fault monitoring information from the switch and the IMA health management status summary message after arbitration of the other health management instance. The IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information.

[0012] S5: The two health management instances perform normal arbitration based on the received IMA health management status summary message and return to S4 after arbitration.

[0013] The dual-redundancy instance master-slave management method for the avionics core processing platform health management provided by the present invention also has such a technical feature that the initialization of S1 includes setting the role information of the health management instance to the slave instance information and setting the switch backup information to the default value.

[0014] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has the following technical features: the periodic sending of the IMA health management status summary message of the health management instance to the other party in S2 includes:

[0015] Generate the role information and switch backup information of the corresponding health management instance at the corresponding position offset according to the structure definition of the IMA health management status summary message;

[0016] The role information and switch backup information of the health management instance are sent according to the period of the IMA health management status summary message.

[0017] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has such a technical feature that S2 also includes determining whether the health management instance has received an IMA health management status summary message from another health management instance according to a predetermined period.

[0018] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has the following technical features: the structure definition of the IMA health management status summary message includes data validity definition, field name definition, field size definition, field data type definition and data set definition.

[0019] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has the following technical features: S3 includes:

[0020] S3.1: If the IMA health management status summary message sent by another health management instance is not received within the scheduled period, the health management instance is set as the primary instance and IBIT management is not performed;

[0021] S3.2: If an IMA health management status summary message is received from another health management instance according to a predetermined period, the cabinet location where the health management instance resides is determined;

[0022] S3.3: If the cabinet location where this health management instance resides is the left cabinet, the role information of this health management instance is set to the master instance and IBIT management is not performed; if the cabinet location where this health management instance resides is the right cabinet, the role information of this health management instance is maintained as a slave instance.

[0023] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has the following technical features: S5 includes: obtaining role information of another health management instance from the received IMA health management status summary message according to the structure definition of the IMA health management status summary message; and performing normal arbitration based on the role information of the other health management instance and the result of determining whether the IMA health management status summary message of the other health management instance is received according to a predetermined period.

[0024] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has the following technical features: the normal arbitration includes:

[0025] If the current health management instance is a master instance and has not been managed by IBIT, and the role information received from another health management instance is a slave instance, when the current health management instance meets the preset conversion conditions, the role information of the current health management instance will be switched to a slave instance within 2 seconds;

[0026] If the health management instance is the primary instance and IBIT management is not performed, and if it fails to receive the IMA health management status summary message from another health management instance for three consecutive times, the role information of the health management instance will be kept as the primary instance and IBIT management will not be performed.

[0027] If the health management instance is the master instance and does not perform IBIT management, and the health management instance on the other side is a slave instance, and an IBIT request is received from the airborne health management system and the test ID is not the master device, then after determining that the module corresponding to the test ID specified by the airborne health management system can perform IBIT and the IBIT of the module is started, the health management instance will set the role information to the master instance and perform IBIT management;

[0028] If the health management instance is the master instance and is not managed by IBIT, and the health management instance on the other side is the master instance and is managed by IBIT, then the health management instance will be set as a slave instance.

[0029] If the health management instance is the primary instance and is not managed by IBIT, and the health management instance on the other side is the primary instance and is not managed by IBIT, and the cabinet where the health management instance resides is the left cabinet, then the health management instance remains the primary instance and is not managed by IBIT.

[0030] If the health management instance is the master instance and is not managed by IBIT, the health management instance on the other side is the master instance and is not managed by IBIT, and the cabinet where the health management instance resides is the right cabinet, then set the health management instance as a slave instance.

[0031] If this health management instance is the master instance and performs IBIT management, and the other health management instance is the slave instance, after the module performing IBIT management is tested, the role information of this health management instance is set to the master instance and IBIT management is not performed;

[0032] If the current health management instance is the primary instance and is managed by IBIT, and the health management instance on the other side is the primary instance and is not managed by IBIT, then the current health management instance will be kept as the primary instance and managed by IBIT.

[0033] If the health management instance is a slave instance and has not received the IMA health management status summary message from another health management instance for three consecutive times, the role information of the health management instance is set to the master instance and IBIT management is not performed;

[0034] If the health management instance is a slave instance, and the role information of the health management instance on the other side remains the master instance for at least 3 seconds without IBIT management, and the role information of the other health management instance is set to the slave instance for 2 seconds, the health management instance is set to the master instance within 2 seconds without IBIT management;

[0035] If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the left cabinet, the role information of the health management instance is set to the master instance and IBIT management is not performed;

[0036] If the current health management instance is a slave instance, the role information of the other health management instance is a slave instance, and the cabinet where the current health management instance resides is the right cabinet, the current health management instance is kept as a slave instance.

[0037] The dual-redundancy instance master-slave management method for avionics core processing platform health management provided by the present invention also has the following technical features: the preset conversion condition includes one selected from the following conditions:

[0038] The connection between this health management instance and the onboard health management system is lost;

[0039] This health management instance receives an IBIT request from the onboard health management system and the test ID is the host GPM;

[0040] The main power supply of the host GPM of this health management instance is lost or a data load request is accepted.

[0041] Beneficial effects

[0042] The dual-redundant instance master-slave management method for avionics core processing platform health management provided by this invention uses IMA health management cycle status summary messages for master-slave instance interaction and synchronization. These messages can also be used to back up switch fault cycle monitoring information. Switches are sub-devices of the avionics core processing platform, and different switches are connected to different networks, lacking redundant backup capabilities. The avionics core processing platform health management function collects cycle monitoring information from each sub-device, consolidates the fault information, and sends it to the crew alarm system and the onboard health management system. The avionics core processing platform health management function can use the IMA health management cycle status summary messages used for dual-redundant instance master-slave synchronization to back up the switch cycle monitoring information.

[0043] The dual-redundant instance master-slave management method for avionics core processing platform health management proposed in this invention comprehensively considers all states of aircraft software, including initialization and normal states. In the initialization state, the current instance is initialized as a slave, assuming that another instance is already the master. This reduces the risk of unreliable responses caused by the presence of two master instances during normal aircraft operation. This method is highly scalable. The avionics core processing platform is an onboard core processing platform, and most software designs utilize a dual-redundant architecture. Therefore, the dual-redundant instance master-slave management method proposed in this invention can be extended to other resident software. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0045] Figure 1 A flowchart of the master-slave management determination method provided by an embodiment of the present invention;

[0046] Figure 2 A health management message cross-linking diagram provided by an embodiment of the present invention;

[0047] Figure 3 This is a schematic diagram of health management arbitration startup provided by an embodiment of the present invention;

[0048] Figure 4 This is a schematic diagram of the master-slave transfer of health management provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The present application is further described in detail below with reference to the accompanying drawings and examples. However, it should be noted that these embodiments are not limitations of the present application, and any equivalent transformations or substitutions in functions, methods, or structures made by ordinary technicians in this field based on these embodiments are within the scope of protection of the present application.

[0050] In the description of the embodiments of the present application, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the creation of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the creation of the present application.

[0051] Furthermore, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature identified with "first," "second," etc., may explicitly or implicitly include one or more of the features. In the description of the inventions of this application, unless otherwise specified, "plurality" means two or more.

[0052] The terms "mounted," "connected," and "connected" should be understood broadly. For example, they can refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediary; and internal communication between two components. A person of ordinary skill in the art will understand the specific meanings of these terms in the context of this application based on specific circumstances.

[0053] Health management can be divided into master and slave instances. Only the master instance can set the "Handle Self-Test" parameter in periodic fault reports sent to the onboard health management system, indicating that this instance can receive aperiodic request commands from the onboard health management system and perform initialization tests. When the onboard health management system sends an aperiodic command to the avionics core processing platform, only the health management master instance receives the command, determines whether to execute the command based on the current state of the avionics core processing platform, and returns the judgment and execution results to the onboard health management system. Health management slave instances, on the other hand, ignore aperiodic request commands from the onboard health management system.

[0054] like Figure 1 As shown, an embodiment of the present application provides a dual-redundancy instance master-slave management method for avionics core processing platform health management, the method comprising:

[0055] S1: Initialization of role information of two health management instances;

[0056] S2: The two health management instances each send an initial IMA health management status summary message of their own health management instance to the other and receive fault monitoring information from the switch and an initial IMA health management status summary message from the other health management instance. The IMA health management status summary message includes the role information of the health management instance and backup information of the switch fault information.

[0057] S3: The two health management instances start arbitration based on the received initial IMA health management status summary message;

[0058] S4: The two health management instances each send an IMA health management status summary message after arbitration of the health management instance to the other party and receive the fault monitoring information from the switch and the IMA health management status summary message after arbitration of the other health management instance. The IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information.

[0059] S5: The two health management instances perform normal arbitration based on the received IMA health management status summary message and return to S4 after arbitration.

[0060] In some embodiments, the initialization of S1 includes setting the role information of the health management instance to slave instance information and setting the switch backup information to a default value.

[0061] In some embodiments, the periodic sending of the IMA health management status summary message of the health management instance to the other party in S2 includes:

[0062] Generate the role information and switch backup information of the corresponding health management instance at the corresponding position offset according to the structure definition of the IMA health management status summary message;

[0063] The role information and switch backup information of the health management instance are sent according to the period of the IMA health management status summary message.

[0064] In some embodiments, S2 further includes determining whether the current health management instance receives an IMA health management status summary message from another health management instance according to a predetermined period.

[0065] In some embodiments, the structure definition of the IMA health management status summary message includes data validity definition, field name definition, field size definition, field data type definition, and data set definition.

[0066] In some embodiments, the S3 includes:

[0067] S3.1: If the IMA health management status summary message sent by another health management instance is not received within the scheduled period, the health management instance is set as the primary instance and IBIT management is not performed;

[0068] S3.2: If an IMA health management status summary message is received from another health management instance according to a predetermined period, the cabinet location where the health management instance resides is determined;

[0069] S3.3: If the cabinet location where this health management instance resides is the left cabinet, the role information of this health management instance is set to the master instance and IBIT management is not performed; if the cabinet location where this health management instance resides is the right cabinet, the role information of this health management instance is maintained as a slave instance.

[0070] In some embodiments, the S5 includes: obtaining the role information of another health management instance in the received IMA health management status summary message information according to the structure definition of the IMA health management status summary message; performing normal arbitration based on the role information of the other health management instance and the judgment result of whether the IMA health management status summary message of the other health management instance is received according to the predetermined period.

[0071] In some embodiments, the normal arbitration includes:

[0072] If the current health management instance is a master instance and has not been managed by IBIT, and the role information received from another health management instance is a slave instance, when the current health management instance meets the preset conversion conditions, the role information of the current health management instance will be switched to a slave instance within 2 seconds;

[0073] If the health management instance is the primary instance and IBIT management is not performed, and if it fails to receive the IMA health management status summary message from another health management instance for three consecutive times, the role information of the health management instance will be kept as the primary instance and IBIT management will not be performed.

[0074] If the health management instance is the master instance and does not perform IBIT management, and the health management instance on the other side is a slave instance, and an IBIT request is received from the airborne health management system and the test ID is not the master device, then after determining that the module corresponding to the test ID specified by the airborne health management system can perform IBIT and the IBIT of the module is started, the health management instance will set the role information to the master instance and perform IBIT management;

[0075] If the health management instance is the master instance and is not managed by IBIT, and the health management instance on the other side is the master instance and is managed by IBIT, then the health management instance will be set as a slave instance.

[0076] If the health management instance is the primary instance and is not managed by IBIT, and the health management instance on the other side is the primary instance and is not managed by IBIT, and the cabinet where the health management instance resides is the left cabinet, then the health management instance remains the primary instance and is not managed by IBIT.

[0077] If the health management instance is the master instance and is not managed by IBIT, the health management instance on the other side is the master instance and is not managed by IBIT, and the cabinet where the health management instance resides is the right cabinet, then set the health management instance as a slave instance.

[0078] If this health management instance is the master instance and performs IBIT management, and the other health management instance is the slave instance, after the module performing IBIT management is tested, the role information of this health management instance is set to the master instance and IBIT management is not performed;

[0079] If the current health management instance is the primary instance and is managed by IBIT, and the health management instance on the other side is the primary instance and is not managed by IBIT, then the current health management instance will be kept as the primary instance and managed by IBIT.

[0080] If the health management instance is a slave instance and has not received the IMA health management status summary message from another health management instance for three consecutive times, the role information of the health management instance is set to the master instance and IBIT management is not performed;

[0081] If the health management instance is a slave instance, and the role information of the health management instance on the other side remains the master instance for at least 3 seconds without IBIT management, and the role information of the other health management instance is set to the slave instance for 2 seconds, the health management instance is set to the master instance within 2 seconds without IBIT management;

[0082] If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the left cabinet, the role information of the health management instance is set to the master instance and IBIT management is not performed;

[0083] If the current health management instance is a slave instance, the role information of the other health management instance is a slave instance, and the cabinet where the current health management instance resides is the right cabinet, the current health management instance is kept as a slave instance.

[0084] In some embodiments, the preset conversion condition includes one selected from the following conditions:

[0085] The connection between this health management instance and the onboard health management system is lost;

[0086] This health management instance receives an IBIT request from the onboard health management system and the test ID is the host GPM;

[0087] The main power supply of the host GPM of this health management instance is lost or a data load request is accepted.

[0088] In some embodiments, a dual-redundancy instance master-slave management method for avionics core processing platform health management, such as Figure 2-4 As shown, the details are as follows:

[0089] Step 1. As attached Figure 2 As shown, while the two health management instances are issuing fault reports and responding to aperiodic commands from the onboard health management system, each health management instance publishes an IMA health management status summary message to synchronize and monitor the role information of the two instances. This message includes the role information of the health management instance and backup information about the switch fault information. The IMA health management status summary message structure is defined as follows (specific switch fault information is not detailed here):

[0090] Table 1 IMA health management status summary message structure definition table

[0091]

[0092] The "Instance Role" field in this message indicates whether the local instance is a master or slave. If it is a slave, it ignores aperiodic commands from the OHMS. If it is a master, it can respond to aperiodic commands from the OHMS and manage IBIT requests and other commands from the OHMS.

[0093] Among them, the master instance is divided into "master instance and no IBIT management" and "master instance and IBIT management". "Master instance and no IBIT management" means that the instance is the master instance and no module in the platform is executing IBIT. When the airborne health management system issues a non-periodic command for a module to perform IBIT, the master instance should respond to the airborne health management system in a timely manner, determine whether IBIT can be performed, and promptly respond to the airborne health management system whether IBIT can be performed, while performing IBIT management. "Master instance and IBIT management" means that the instance is the master instance and there is a module in the platform executing IBIT. At the same time, only one module in the platform can execute IBIT. This field indicates that an IBIT is already being executed and cannot respond to another IBIT non-periodic command from the airborne health management system.

[0094] Step 2. When the health management function is enabled, to prevent another instance from becoming the master, each health management instance assumes that the other instance is already the master. When issuing the first IMA health management cycle status summary message, the local instance role is set to "slave." Also, during initialization, the backup information for switch fault information in the IMA health management status summary message is set to the default value.

[0095] Step 3. As attached Figure 2 As shown, after the two health management instances publish the first IMA health management status summary message, they initiate arbitration. Within two seconds of publishing the first IMA health management status summary message, if either instance does not receive an IMA health management status summary message from the other instance at the scheduled interval, the other instance is considered inactive and its role is set to "master instance without IBIT management." Within two seconds of publishing the first IMA health management status summary message, if both instances detect that the other instance is active, they determine the GPM location of the health management instances. If the health management instance resides in the left cabinet, HM_L1, the instance role is set to "master instance without IBIT management." If the health management instance resides in the right cabinet, HM_R1, the instance role remains set to "slave instance." Simultaneously, the health management software instance populates the IMA health management status summary message with backup information for the switch fault information.

[0096] Step 4. Two seconds after the first IMA health management status summary message is released, normal arbitration begins. Normal arbitration is based on master-slave switching arbitration under specific conditions. At the same time, the health management software instance fills in the backup information of the switch fault information in the IMA health management status summary message based on the fault monitoring information received from the switch. When the GPM where the master instance resides is in a specific condition, the instance can no longer serve as the master instance to process non-periodic commands from the airborne health management system, and the master instance needs to switch to the slave role. When this instance is a slave instance and the master instance on the other side can no longer serve as the master instance, the slave instance should be converted to the master instance in time to ensure that the avionics core processing platform responds to and processes non-periodic commands from the airborne health management system in a timely manner. The specific situation is as follows.

[0097] 1. Such as Figure 4 As shown in the figure, when this side is the master instance and its status is "Master instance and not IBIT managed" and the other side is a slave instance, if any of the following conditions are met, the master instance should relinquish the instance role and set it to "Slave instance" within 2 seconds.

[0098] 1) The local health management instance loses connection with the onboard health management system. If the connection is lost, the local health management instance cannot continue to interact with the onboard health management system and cannot respond to non-periodic commands from the onboard health management system.

[0099] 2) Receive an IBIT request and the test ID (representing the device number for which IBIT is to be performed) is the host GPM. If the host GPM performs IBIT, it will power down and perform a self-test. During this self-test, all functions resident on the GPM cease to operate and cannot interact with the onboard health management system.

[0100] 3) The host GPM loses its main power supply or the data load request is accepted. If the host GPM loses its main power supply, it will not be able to receive long-term power, and there is a risk of losing the master instance. If data is loaded on the host GPM, the functions resident on the GPM will stop running and will not be able to interact with the onboard health management system.

[0101] If the slave instance monitors the other instance and maintains the "master instance and not managed by IBIT" status for at least 3 seconds, and then is set to "slave instance" for 2 seconds, it is considered that the master instance on the other side is about to transfer the master instance status. In this case, the slave instance on this side should be set to "master instance and not managed by IBIT" within 2 seconds.

[0102] 2. When one side is the master instance and its status is "master instance and IBIT management is not performed", and the other side is a slave instance, when the master instance receives an IBIT non-periodic command from the airborne health management system and the test ID of the IBIT request does not correspond to the GPM where this instance resides, after determining that the module corresponding to the test ID specified by the airborne health management system can perform IBIT and the IBIT of the module is started, the master instance should set its role to "master instance and IBIT management".

[0103] 3. When one side is the master instance and its status is "Master Instance with IBIT Management", and the other side is the slave instance, when the module performing IBIT in the avionics core processing platform completes self-test, the master instance should set its role to "Master Instance without IBIT Management".

[0104] 4. When one side is the master instance and the other side is the slave instance, if the slave instance fails to receive the expected IMA health management cycle status summary message from the master instance three times in a row or the received message is invalid, the other side instance is considered to have failed. The slave instance must set the instance role to "master instance and not IBIT managed" within 2 seconds.

[0105] 5. When both sides are master instances and their status is "Master instance and not managed by IBIT", to ensure that there is only one master instance in the platform at a time, it is necessary to determine the GPM location of the health management instances on both sides. If the health management instance resides in the left cabinet, that is, HM_L1, the instance role continues to be set to "Master instance and not managed by IBIT". If the health management instance resides in the right cabinet, that is, HM_R1, the instance role is set to "Slave instance".

[0106] 6. When both sides are "slave instances", to ensure that there is a master instance in the platform to receive non-periodic requests from the airborne health management system, it is necessary to determine the GPM location of the health management instances on both sides. If the health management instance resides in the left cabinet, that is, HM_L1, the instance role is set to "master instance and not IBIT managed"; if the health management instance resides in the right cabinet, that is, HM_R1, the instance role is still set to "slave instance".

[0107] 7. If one side is the master instance and its status is "Master instance and not managed by IBIT", and the other side is also the master instance and its status is "Master instance and managed by IBIT", the master instance in the "Master instance and not managed by IBIT" status should set its role to "Slave instance".

[0108] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application. The above description is merely a preferred embodiment of the present application. It should be noted that those skilled in the art can make various improvements and variations without departing from the technical principles of the present application, and such improvements and variations shall also be considered within the scope of protection of the present application.

Claims

1. A dual-redundancy instance master-slave management method for avionics core processing platform health management, characterized by: The method comprises: S1: Initialization of role information of two health management instances; S2: The two health management instances each send an initial IMA health management status summary message of their own health management instance to the other and receive fault monitoring information from the switch and an initial IMA health management status summary message from the other health management instance. The IMA health management status summary message includes the role information of the health management instance and backup information of the switch fault information. S3: The two health management instances start arbitration based on the received initial IMA health management status summary message; S4: The two health management instances each send an IMA health management status summary message after arbitration of the health management instance to the other party and receive the fault monitoring information from the switch and the IMA health management status summary message after arbitration of the other health management instance. The IMA health management status summary message includes the role information of the health management instance and the backup information of the switch fault information. S5: The two health management instances perform normal arbitration based on the received IMA health management status summary message and return to S4 after arbitration.

2. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The initialization of S1 includes setting the role information of the health management instance to the slave instance information and setting the switch backup information to the default value.

3. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The periodic sending of the IMA health management status summary message of the health management instance to the other party in S2 includes: Generate the role information and switch backup information of the corresponding health management instance at the corresponding position offset according to the structure definition of the IMA health management status summary message; The role information and switch backup information of the health management instance are sent according to the period of the IMA health management status summary message.

4. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The S2 also includes determining whether the health management instance receives an IMA health management status summary message from another health management instance according to a predetermined period.

5. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 3, characterized in that: The structure definition of the IMA health management status summary message includes data validity definition, field name definition, field size definition, field data type definition and data set definition.

6. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The S3 includes: S3.1: If the IMA health management status summary message sent by another health management instance is not received within the scheduled period, the health management instance is set as the primary instance and IBIT management is not performed; S3.2: If an IMA health management status summary message is received from another health management instance according to a predetermined period, the cabinet location where the health management instance resides is determined; S3.3: If the cabinet location where this health management instance resides is the left cabinet, the role information of this health management instance is set to the master instance and IBIT management is not performed; if the cabinet location where this health management instance resides is the right cabinet, the role information of this health management instance is maintained as a slave instance.

7. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 1, characterized in that: The S5 includes: obtaining the role information of another health management instance in the received IMA health management status summary message according to the structure definition of the IMA health management status summary message; performing normal arbitration based on the role information of the other health management instance and the judgment result of whether the IMA health management status summary message of the other health management instance is received according to the predetermined period.

8. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 7, characterized in that: The normal arbitration includes: If the current health management instance is a master instance and has not been managed by IBIT, and the role information received from another health management instance is a slave instance, when the current health management instance meets the preset conversion conditions, the role information of the current health management instance will be switched to a slave instance within 2 seconds; If the health management instance is the primary instance and IBIT management is not performed, and if it fails to receive the IMA health management status summary message from another health management instance for three consecutive times, the role information of the health management instance will be kept as the primary instance and IBIT management will not be performed. If the health management instance is the master instance and does not perform IBIT management, and the health management instance on the other side is a slave instance, and an IBIT request is received from the airborne health management system and the test ID is not the master device, then after determining that the module corresponding to the test ID specified by the airborne health management system can perform IBIT and the IBIT of the module is started, the health management instance will set the role information to the master instance and perform IBIT management; If the health management instance is the master instance and is not managed by IBIT, and the health management instance on the other side is the master instance and is managed by IBIT, then the health management instance will be set as a slave instance. If the health management instance is the primary instance and is not managed by IBIT, and the health management instance on the other side is the primary instance and is not managed by IBIT, and the cabinet where the health management instance resides is the left cabinet, then the health management instance remains the primary instance and is not managed by IBIT. If the health management instance is the master instance and is not managed by IBIT, the health management instance on the other side is the master instance and is not managed by IBIT, and the cabinet where the health management instance resides is the right cabinet, then set the health management instance as a slave instance. If this health management instance is the master instance and performs IBIT management, and the other health management instance is the slave instance, after the module performing IBIT management is tested, the role information of this health management instance is set to the master instance and IBIT management is not performed; If the current health management instance is the primary instance and is managed by IBIT, and the health management instance on the other side is the primary instance and is not managed by IBIT, then the current health management instance will be kept as the primary instance and managed by IBIT. If the health management instance is a slave instance and has not received the IMA health management status summary message from another health management instance for three consecutive times, the role information of the health management instance is set to the master instance and IBIT management is not performed; If the health management instance is a slave instance, and the role information of the health management instance on the other side remains the master instance for at least 3 seconds without IBIT management, and the role information of the other health management instance is set to the slave instance for 2 seconds, the health management instance is set to the master instance within 2 seconds without IBIT management; If the health management instance is a slave instance, the role information of the health management instance on the other side is a slave instance, and the cabinet where the health management instance resides is the left cabinet, the role information of the health management instance is set to the master instance and IBIT management is not performed; If the current health management instance is a slave instance, the role information of the other health management instance is a slave instance, and the cabinet where the current health management instance resides is the right cabinet, the current health management instance is kept as a slave instance.

9. The dual-redundancy instance master-slave management method for avionics core processing platform health management according to claim 8, characterized in that: The preset conversion condition includes one selected from the following conditions: The connection between this health management instance and the onboard health management system is lost; This health management instance receives an IBI T request from the onboard health management system and the test ID is the host GPM; The main power supply of the host GPM of this health management instance is lost or a data load request is accepted.

Images