A safety analysis method for a triple-redundancy flight control system based on time automata

Abstract

The application belongs to the technical field of civil aircraft flight control system verification, and particularly relates to a three-redundancy flight control system safety analysis method based on time automata. The method comprises the following steps: determining the clock period and random drift range of each component; constructing a clock model by using the time automata and the clock period and random drift range of the components of the three-redundancy flight control system, wherein the modeling semantics of the time automata comprise location, guard, invariant and channel; constructing a formal model of the three-redundancy flight control system based on the architecture of the three-redundancy flight control system and the clock model; constructing a fault model on the basis of the formal model of the three-redundancy flight control system, wherein the faults comprise deadlocks, bus transmission and transient faults; performing safety analysis on the three-redundancy flight control system, obtaining the safety properties of the three-redundancy flight control system, and expressing the safety properties as formal specifications; and verifying whether the fault model satisfies the formal specifications by using a formal verification tool.

Description

Technical Field

[0001] This invention belongs to the technical field of civil aircraft flight control system verification, specifically relating to a safety analysis method for a triple-redundant flight control system based on a time automaton. Background Technology

[0002] A triple-redundant flight control system distributes flight control functions (primary / backup decision-making and fault handling) across three flight control computers (FCMs) and four flight control actuation electronics (ACEs) to meet system reliability requirements. Therefore, these seven components and related bus transmissions need to reach a consensus on the current primary / backup decision-making process, such as which FCM is currently the primary computer. For a triple-redundant flight control system, internal faults are frequent and unpredictable, and the clocks of the seven components are independent. Therefore, various combinations of faults and the asynchronicity of components within the system can lead to abnormal situations where faults and asynchronous clocking occur concurrently.

[0003] Traditional system safety analysis methods are highly subjective, and the accuracy of the analysis results depends heavily on the engineer's skill level. For the same system, different engineers may build very different safety analysis models due to differences in knowledge and thinking. In addition, for triple-redundant flight control systems with dynamic reconfiguration characteristics, fault timing correlation, and logical correlation, it is no longer practical to analyze the fault logic relationships of the system through manual reasoning. Even if it is possible, its comprehensiveness and accuracy are difficult to guarantee. However, if sufficient safety analysis is not conducted on triple-redundant flight control systems, it will further affect the safety of the aircraft in the future. Summary of the Invention

[0004] Purpose of the invention: To provide a safety analysis method for a triple-redundant flight control system based on a time automaton, thereby improving the comprehensiveness and accuracy of fault logic relationships.

[0005] Technical solution:

[0006] A safety analysis method for a triplexed flight control system based on a time automata, comprising:

[0007] Step 1: Determine the clock period and random drift range of each component based on the crystal oscillator frequency and drift of the clocks used by the seven components of the triplet flight control system;

[0008] Step 2: Construct a clock model using the clock cycles and random drift ranges of components of a time automaton and a triple-redundant flight control system. The modeling semantics of the time automaton include: location, guard, invariant, and channel.

[0009] Step 3: Based on the architecture and clock model of the triple-redundant flight control system, construct a formal model of the triple-redundant flight control system based on a time automaton;

[0010] Step 4: Construct a fault model based on the formal model of the triplet flight control system based on time automata. Faults include system crashes, bus transmission failures, and transient failures.

[0011] Step 5: Perform a safety analysis on the triple-redundant flight control system, obtain the safety attributes based on the triple-redundant flight control system, and express them as a formal specification;

[0012] Step 6: Use formal verification tools to verify whether the fault model meets the formal specifications.

[0013] Preferably, in step 1, the clock period of the component is taken from the crystal oscillator frequency of the clock used by the component, and the random drift range of the clock of the component is taken from the crystal oscillator drift of the clock used by the component.

[0014] Preferably, step 2 specifically includes:

[0015] Step 21: Construct a clock array using time automata semantics. The clock array has 7 elements, corresponding to the 7 components of the triplet flight control system.

[0016] Step 22: For each clock array element, construct the starting location and loop location of the clock using time automata semantics;

[0017] Step 23: Add guard and invariant conditions for the time automaton between the starting location and the cyclic location based on the clock period and the random drift range. The guard condition is "t>[clock period - maximum drift]", and the invariant condition is "t<=[clock period + maximum drift]".

[0018] Step 24: Using time automata semantics, add a clock channel to the guard to emit a signal.

[0019] Preferably, step 3 specifically includes:

[0020] Step 31: Abstract and summarize the functional architecture of the triple-redundant flight control system using object-oriented methods, and abstract two classes: Flight Control Computer (FCM) and Flight Control Actuator (ACE). Based on this, create empty templates for the FCM and ACE based on the time automaton.

[0021] Step 32: Based on the time automaton, fill the primary / backup switching function logic of the flight control computer (FCM) into the empty template of the FCM to form a formal model template of the flight control computer (FCM).

[0022] Step 33: Based on the time automaton, fill the primary and backup voting function logic of the flight control actuation electronic ACE into the empty template of the flight control actuation electronic ACE to form a formal model template of the flight control actuation electronic ACE;

[0023] Step 34: Create 3 instances based on the formal model template of the flight control computer (FCM) to form a triple-redundant flight control computer (FCM);

[0024] Step 35: Create 4 instances based on the formal model template of the flight control actuation electronics ACE to form a 4-redundant flight control actuation electronics ACE;

[0025] Step 36: Drive the triple-redundant flight control computer FCM and the quadruple-redundant flight control actuation electronics ACE based on the clock array, where each clock array element corresponds to a corresponding instance, and each instance receives the signal sent by the clock channel in step 24, forming a formal model of the triple-redundant flight control system.

[0026] Preferably, step 4 specifically includes:

[0027] Step 41: Based on the modeling semantics of time automata, set up system crashes, bus transmissions, and transient faults, which are independent of each other and can occur at any time;

[0028] Step 42: Add the set faults to the formal model of the time-based automaton-based triplet flight control system to obtain the fault model.

[0029] Preferably, in step 41,

[0030] The system crash occurs when the clock is driven multiple times in a row, causing the functional logic of this component to fail to run.

[0031] Bus transmission failure is caused by incorrect data sent by the component or incorrect data received by the component;

[0032] A transient fault is a fault that suddenly occurs at a certain moment and immediately returns to normal the next moment.

[0033] Preferably, step 5 specifically includes:

[0034] Step 51: Conduct a safety analysis on the triple-redundant flight control system to determine its safety attributes;

[0035] Step 52: Use the Time Automaton Formal Reduction Semantics (TCTL), invariant form, and system runtime to describe the security attributes as formal reductions.

[0036] Preferably, step 6 specifically includes:

[0037] If the fault model satisfies the formal specification, the formal verification result is satisfied; otherwise, the formal verification result is not satisfied. The running scenario of the fault model that does not satisfy the formal specification is a counterexample. The counterexample is the running sequence of the triple-redundant flight control system. The sequence includes the key nodes of component clock triggering, component functional logic operation, and fault occurrence, which are used by system designers to understand and modify the system design.

[0038] Beneficial effects:

[0039] The method of this invention, targeting a triple-redundant flight control system, employs a formal fault modeling and verification approach. It utilizes model detection to exhaustively search the entire state space of the triple-redundant flight control system, including various asynchronous clock triggering sequences and interleaved execution sequences, ensuring the safety of the system design. Specifically, it has the following beneficial effects: 1. Automated verification of whether the triple-redundant flight control system meets safety attributes under various faults and their combinations; 2. Reduced workload for designers, increased verification efficiency and accuracy; 3. High versatility, applicable to verification methods for similar systems in other fields; 4. Improved safety of the triple-redundant flight control system. Attached Figure Description

[0040] To more clearly illustrate the technical solutions implemented in this invention, the accompanying drawings used in this invention will be briefly explained below. Obviously, the drawings described below are merely some embodiments of this invention. Those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0041] Figure 1 A schematic diagram illustrating the formal modeling principle of injected faults in a triple-redundant flight control system provided in an embodiment of the present invention.

[0042] Figure 2 This is a schematic diagram of clock modeling based on a time automaton, provided for an embodiment of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

[0044] As explained in the background section, traditional methods for safety analysis of triple-redundant flight control systems are highly subjective, and the accuracy of the analysis results depends heavily on the engineer's skill level. For the same system, different engineers may establish very different safety analysis models due to differences in knowledge and thinking methods. In addition, for triple-redundant flight control systems with dynamic reconfiguration characteristics, fault timing correlation, and logical correlation, it is no longer practical to analyze the fault logic relationship of the system through manual reasoning. Even if it is possible to analyze, its comprehensiveness and accuracy are difficult to guarantee.

[0045] The technical solution provided by this invention, for a triple-redundant flight control system, uses a formal fault modeling and verification method. It employs mathematical methods to exhaustively enumerate various asynchronous clock triggering sequences and interleaved execution sequences of the triple-redundant flight control system, ensuring the safety of the system design. Automated verification of whether the triple-redundant flight control system meets safety attributes under various faults and their combinations reduces the workload of designers and increases verification efficiency and accuracy. It is highly versatile and can be applied to the verification of similar systems in other fields, thus improving the safety of the triple-redundant flight control system.

[0046] The present invention provides the following specific embodiments, which can be combined with each other. For the same or similar concepts or processes, they may not be described again in some embodiments.

[0047] The safety analysis method for a triple-redundant flight control system provided in this invention includes the following steps:

[0048] Step 1: Based on the crystal oscillator frequency and drift of the clocks used by the seven components of the triplet flight control system, including the three flight control computers (FCM) and the four flight control actuation electronics (ACE), determine the clock period and random drift range of each component.

[0049] Step 2: Construct a clock model using the clock cycles and random drift ranges of components of a time automaton and a triple-redundant flight control system. The modeling semantics of the time automaton include: location, guard, invariant, and channel.

[0050] Step 3: Based on the architecture and clock model of the triple-redundant flight control system, construct a formal model of the triple-redundant flight control system based on a time automaton;

[0051] Step 4: Construct a fault model based on the formal model of the triple redundancy flight control system based on time automata. Faults include system crashes, bus transmission failures, and transient failures.

[0052] Step 5: Perform a safety analysis on the triple-redundant flight control system, obtain the safety attributes based on the triple-redundant flight control system, and express them as a formal specification;

[0053] Step 6: Use formal verification tools to verify whether the fault model meets the formal specifications, that is, whether the triple-redundant flight control system meets the safety attributes.

[0054] In another embodiment of the present invention, in step 1 above, the clock period of the component is taken from the crystal oscillator frequency of the clock used by the component, and the random drift range of the clock of the component is taken from the crystal oscillator drift of the clock used by the component.

[0055] In step 2, a clock model is constructed using the clock periods and random drift ranges of components from a time automaton and a triple-redundant flight control system, referring to... Figure 2 An automatic time mechanism is used to construct a clock template, which contains two locations: initial and stick. The local time t <= [clock period + maximum drift] of this template is set as the invariant condition of the location, and t > [clock period - maximum drift] is set as the guard condition of the location migration. The randomness of the migration constitutes the randomness of the clock drift. Whenever the migration is successful, the local time t is reset to 0, and the timing of the next cycle begins.

[0056] In one embodiment of the present invention, the specific implementation process of step 2 above may include:

[0057] Step 21: Construct a clock array using time automata semantics. The clock array has 7 elements, corresponding to the 7 components of the triplet flight control system.

[0058] Step 22: For each clock array element, construct the starting location and loop location of the clock using time automata semantics;

[0059] Step 23: Add guard and invariant conditions of the time automaton between the starting location and the cyclic location based on the clock period and the random drift range. The guard condition is "t>[clock period - maximum drift]" and the invariant condition is "t<=[clock period + maximum drift]".

[0060] Step 24: Using time automata semantics, add a clock channel to the guard to emit a signal.

[0061] In another embodiment of the present invention, the specific implementation process of step 3 above may include:

[0062] Step 31: The functional architecture of the triple-redundant flight control system is abstracted and summarized using an object-oriented approach, and two classes, Flight Control Computer (FCM) and Flight Control Actuator (ACE), are abstracted. Based on the time automaton, empty templates for FCM and ACE are created.

[0063] Step 32: Based on the time automaton, fill the primary / backup switching function logic of the flight control computer (FCM) into the empty template of the flight control computer (FCM) to form a formal model template of the flight control computer (FCM).

[0064] Step 33: Based on the time automaton, fill the primary and backup voting function logic of the flight control actuation electronic ACE into the empty template of the flight control actuation electronic ACE to form a formal model template of the flight control actuation electronic ACE;

[0065] Step 34: Create 3 instances based on the formal model template of the flight control computer (FCM) to form a triple-redundant flight control computer (FCM);

[0066] Step 35: Create 4 instances based on the formal model template of the flight control actuation electronics ACE to form a 4-redundant flight control actuation electronics ACE;

[0067] Step 36: Drive the triple-redundant flight control computer FCM and the quadruple-redundant flight control actuation electronics ACE based on the clock array, where each clock array element corresponds to a corresponding instance, and each instance receives the signal emitted by the clock channel in step 24, forming a formal model of the triple-redundant flight control system.

[0068] In this embodiment of the invention, the specific implementation process of step 4 above may include:

[0069] Step 41: Based on the modeling semantics of time automata, set up system crashes, bus transmissions, and transient faults, which are independent of each other and can occur at any time;

[0070] Among them, the system crash is caused by multiple consecutive clock drives, which prevents the functional logic of this component from running successfully.

[0071] Bus transmission failure is caused by incorrect data sent by the component or incorrect data received by the component;

[0072] A transient fault is a fault that suddenly occurs at a certain moment and immediately returns to normal the next moment.

[0073] Step 42: Add the set faults to the formal model of the time-based automaton-based triplet flight control system to obtain the fault model. For example... Figure 1 As shown in the figure, the black dots indicate the location of the fault.

[0074] In this embodiment of the invention, the specific implementation process of step 5 above may include:

[0075] Step 51: Perform a safety analysis on the triple-redundant flight control system to form safety attributes. For example, at any time during the operation of the triple-redundant flight control system, all three flight control computers (FCMs) must be backup systems.

[0076] Step 52: Using the Time Automaton Formal Reduction Semantics (TCTL), invariant form, and system runtime, the security attributes are described as formal reductions.

[0077] In this embodiment of the invention, the specific implementation process of step 6 above may include:

[0078] In step 6, if the fault model satisfies the formal specification, the formal verification result is satisfied; otherwise, the formal verification result is not satisfied.

[0079] The operation scenarios of fault models that do not meet the formal specifications form counterexamples. The counterexamples are the operation sequences of the triple-redundant flight control system. The sequences include key nodes of component clock triggering, component functional logic operation, and fault occurrence, which facilitates system designers to understand and modify the system design.

[0080] For example, in the counterexample of formal verification, the sequence of component operation and failure occurrence in a triple-redundant flight control system is as follows: "Currently, FCM1 is already the master FCM. First, the FCM1 clock is triggered, but the 'self-master' flag sent by FCM1 to FCM2 fails during transmission, incorrectly transmitting the 'self-master' flag from True to False. Then, the FCM2 clock is triggered. After receiving the information that the 'self-master' flag of FCM1 is False, FCM2 mistakenly believes that the triple-redundant flight control system does not yet have a master FCM, so it upgrades itself to the master FCM. At this time, the triple-redundant flight control system has two master FCMs, FCM1 and FCM2." This violates the safety property that the system cannot have two or more master FCMs. The key nodes of component clock triggering, component functional logic operation, and failure occurrence shown in this counterexample can help system designers quickly understand and modify the fault handling method of the triple-redundant flight control system.

[0081] This method is characterized by strong design operability and good verification effect, which can significantly improve the safety analysis effect of triple redundancy flight control system.

[0082] In some possible implementations of embodiments of the present invention, the safety analysis method for the specified triplet flight control system employs any tool that can support time-based automata modeling.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should be covered within the protection scope of the present invention.

Claims

1. A safety analysis method for a triple-redundant flight control system based on a time automaton, characterized in that, include: Step 1: Determine the clock period and random drift range of each component based on the crystal oscillator frequency and drift of the clocks used by the seven components of the triplet flight control system; Step 2: Construct a clock model using the clock cycles and random drift ranges of components of a time automaton and a triple-redundant flight control system. The modeling semantics of the time automaton include: location, guard, invariant, and channel. Step 3: Based on the architecture and clock model of the triple-redundant flight control system, construct a formal model of the triple-redundant flight control system based on a time automaton; Step 4: Construct a fault model based on the formal model of the triplet flight control system based on time automata. Faults include system crashes, bus transmission failures, and transient failures. Step 5: Perform a safety analysis on the triple-redundant flight control system, obtain the safety attributes based on the triple-redundant flight control system, and express them as a formal specification; Step 6: Use formal verification tools to verify whether the fault model meets the formal specifications.

2. The method according to claim 1, characterized in that, In step 1, the clock period of the component is taken from the crystal oscillator frequency of the clock used by the component, and the random drift range of the clock of the component is taken from the crystal oscillator drift of the clock used by the component.

3. The method according to claim 2, characterized in that, Step 2 specifically includes: Step 21: Construct a clock array using time automata semantics. The clock array has 7 elements, corresponding to the 7 components of the triplet flight control system. Step 22: For each clock array element, construct the starting location and loop location of the clock using time automata semantics; Step 23: Add guard and invariant conditions for the time automaton between the starting location and the cyclic location based on the clock period and the random drift range, where the guard condition is "t>[clock period - maximum drift]" and the invariant condition is "t<=[clock period + maximum drift]". Step 24: Using time automata semantics, add a clock channel to the guard to emit a signal.

4. The method according to claim 3, characterized in that, Step 3 specifically includes: Step 31: Abstract and summarize the functional architecture of the triple-redundant flight control system using object-oriented methods, and abstract two classes: Flight Control Computer (FCM) and Flight Control Actuator (ACE). Based on this, create empty templates for the FCM and ACE based on the time automaton. Step 32: Based on the time automaton, fill the primary / backup switching function logic of the flight control computer (FCM) into the empty template of the FCM to form a formal model template of the flight control computer (FCM). Step 33: Based on the time automaton, fill the primary and backup voting function logic of the flight control actuation electronic ACE into the empty template of the flight control actuation electronic ACE to form a formal model template of the flight control actuation electronic ACE; Step 34: Create 3 instances based on the formal model template of the flight control computer (FCM) to form a triple-redundant flight control computer (FCM); Step 35: Create 4 instances based on the formal model template of the flight control actuation electronics ACE to form a 4-redundant flight control actuation electronics ACE; Step 36: Drive the triple-redundant flight control computer FCM and the quadruple-redundant flight control actuation electronics ACE based on the clock array, where each clock array element corresponds to a corresponding instance, and each instance receives the signal sent by the clock channel in step 24, forming a formal model of the triple-redundant flight control system.

5. The method according to claim 4, characterized in that, Step 4 specifically includes: Step 41: Based on the modeling semantics of time automata, set up system crashes, bus transmissions, and transient faults, which are independent of each other and can occur at any time; Step 42: Add the set faults to the formal model of the time-based automaton-based triplet flight control system to obtain the fault model.

6. The method according to claim 5, characterized in that, In step 41, The system crash occurs when the clock is driven multiple times in a row, causing the functional logic of this component to fail to run. Bus transmission failure is caused by incorrect data sent by the component or incorrect data received by the component; A transient fault is a fault that suddenly occurs at a certain moment and immediately returns to normal the next moment.

7. The method according to claim 6, characterized in that, Step 5 specifically includes: Step 51: Conduct a safety analysis on the triple-redundant flight control system to determine its safety attributes; Step 52: Use the Time Automaton Formal Reduction Semantics (TCTL), invariant form, and system runtime to describe the security attributes as formal reductions.

8. The method according to claim 7, characterized in that, Step 6 specifically includes: If the fault model satisfies the formal specification, the formal verification result is satisfied; otherwise, the formal verification result is not satisfied. The running scenario of the fault model that does not satisfy the formal specification is a counterexample. The counterexample is the running sequence of the triple-redundant flight control system. The sequence includes the key nodes of component clock triggering, component functional logic operation, and fault occurrence, which are used by system designers to understand and modify the system design.

Images