IMA system cascade influence analysis method based on signal hierarchy

Abstract

The invention relates to the technical field of civil aircraft airborne avionics systems, and discloses a signal hierarchy-based IMA system cascade influence analysis method, which comprises the following steps of: determining a combination failure range, forming mapping between all signals transmitted by comprehensive modular avionics platform equipment and a combination failure mode, and dividing all signals to user systems; the user system identifies an indirect signal generated by the direct influence signal and the user system; the user system carries out indirect influence analysis on signal loss and errors; and determining direct influence analysis and indirect influence analysis of a system level corresponding to each combination failure mode, performing influence analysis, checking a system level influence analysis result of each user system, and judging whether loss or errors of functions of the user systems are caused in any combination failure mode or not so as to cause occurrence of a corresponding aircraft level failure state.

Description

Technical Field

[0001] This invention relates to the field of airborne avionics systems technology for civil aircraft, and to a method for analyzing the cascading effects of IMA systems based on signal levels, particularly for analyzing the cascading effects of airborne avionics systems employing an integrated modular architecture. Background Technology

[0002] Currently, there are only a few domestically produced civil aircraft equipped with domestically developed integrated modular architecture avionics systems, and even fewer have undergone complete safety analysis and passed civil aircraft airworthiness certification. The integrated modular architecture avionics system discussed in this article primarily refers to the integrated modular platform (IMA platform) that provides resources and services. It does not directly undertake aircraft-level functions but provides resources and services such as data computation, data transmission, and data conversion to user systems both within and outside the avionics system (e.g., display and control systems, crew warning systems, flight management systems, airborne maintenance systems, flight control systems, landing gear systems, etc.), thereby supporting their functional implementation. The integrated modular avionics system interacts and is highly coupled with numerous user systems; the failure of its equipment not only affects the functional performance of the system itself but, more importantly, impacts numerous user systems. Due to these characteristics of the integrated modular architecture avionics system, its safety assessment cannot be limited to the traditional FHA, PSSA, FMEA, and SSA defined by SAE ARP 4761. A cascading impact analysis (CEA) of the platform must be conducted to analyze the impact of single and multiple platform equipment failures on user systems and the aircraft, thereby providing a basis for determining the quantitative and qualitative indicators of the platform equipment. Especially when the platform is not developed according to Class A standards, the conclusions of cascade impact analysis need to be used as input for the system's failure management assessment (FHA) and provide strong support for determining the categories of failure states in the FHA. Summary of the Invention

[0003] The purpose of this invention is to propose a signal-level IMA system cascade impact analysis method, which enables system designers to determine the failure impact of the system before the system's FHA, thereby providing strong support for determining the failure state category in the system FHA analysis and providing a basis for determining the qualitative and quantitative indicators of each device in the system's PSSA.

[0004] The technical solution of the present invention: A method for analyzing the cascading effects of an IMA system based on signal hierarchy, the method comprising: Based on single-point failure, common-mode failure, and failure rate, the mode of combined failure is determined, which is the combination of failed device and failure type. All signals and combined failure modes transmitted through the integrated modular avionics platform equipment are mapped, and all signals are assigned to various user systems according to certain rules, serving as direct impact signals on the user systems. The user system analyzes the impact of individual signal loss and error on itself for each of its directly affecting signals, and simultaneously identifies the indirect signals generated by the directly affecting signals and the user system. The user system performs indirect impact analysis on signal loss and errors for indirect signals; Based on the identified combined failure modes, and based on the direct impact analysis results at the signal level, the granularity is improved, and the system-level direct impact analysis corresponding to each combined failure mode is summarized. Based on the identified combined failure modes, and based on the indirect impact analysis results at the signal level, the granularity is improved, and the system-level indirect impact analysis corresponding to each combined failure mode is summarized. By comprehensively analyzing the results of direct and indirect impact analysis at the system level, and taking into account flight phases and combined failure factors, a system-level impact analysis is obtained. By comparing each aircraft-level failure state with the related user system functions, we can check the system-level impact analysis results of each user system and determine whether any combination of failure modes will lead to the loss or error of these user system functions, thereby causing the corresponding aircraft-level failure state to occur.

[0005] Furthermore, when determining the scope of combined failures, only combined failures between devices of the same type are considered.

[0006] Furthermore, the confirmation of combined failures among similar devices only confirms cases where similar devices are simultaneously lost or malfunction simultaneously, excluding mixed combined failures where both loss and malfunction occur.

[0007] Furthermore, the combined failure confirmation of two or more devices of the same type is included in the scope of combined failure based on the relationship between the failure rate and the impact category.

[0008] Furthermore, based on the Interface Definition (ICD) between the integrated modular avionics platform and the user systems, all signals transmitted by the integrated modular avionics platform and the mapping relationship between signals and combined failure modes are identified, and the signals are distributed to each user system according to certain principles.

[0009] Furthermore, the signals will be distributed to each user system according to the following principles: If a signal is related to an aircraft-level functional requirement proposed by a user system, then the signal is assigned to that user system as a direct influence signal. Each signal should be assigned to the user system with the highest degree of correlation to avoid duplication and omission of analysis objects.

[0010] Furthermore, when performing direct impact analysis on signals that directly affect user systems, the impact of the simultaneous failure of two or more mutually redundant signals should also be considered. Indirect signals to be identified when performing direct impact analysis include: signals that are used by the first user system and then directly transmitted to the second user system; new signals that are processed by the first user system for use by the second user system after being used by the first user system; and signals that are not used by the first user system but are directly transmitted to the second user system for use.

[0011] Furthermore, when refining the granularity of the direct impact analysis results based on the signal level and summarizing them into the system-level direct impact analysis: firstly, the direct impacts of multiple signals under the same combined failure mode are merged. Then, based on the business logic of the user system, it is determined whether the direct impacts of multiple signals will lead to the occurrence of any system-level failure state FC in the Functional Hazard Analysis Report (FHA) of the user system. If so, the failure category of the corresponding FC in the system FHA is taken as the direct impact category of multiple signals under the combined failure mode; otherwise, it is not necessary to give the direct impact category of multiple signals under the combined failure mode.

[0012] Furthermore, when refining the granularity of the indirect impact analysis results based on the signal level and summarizing them into the system-level indirect impact analysis: firstly, the indirect impacts of multiple signals under the same combined failure mode are merged. Then, based on the business logic of the user system, it is determined whether the indirect impacts of multiple signals will lead to the occurrence of any system-level failure state FC in the Functional Hazard Analysis Report (FHA) of the user system. If so, the failure category of the corresponding FC in the system FHA is taken as the indirect impact category of multiple signals under the combined failure mode; otherwise, it is not necessary to give the indirect impact category of multiple signals under the combined failure mode.

[0013] Furthermore, when conducting aircraft-level impact analysis, the aircraft-level failure states and related system-level functions defined in the preliminary aircraft-level safety analysis document PASA are used as inputs. The results of the system-level impact analysis are combined to analyze and derive the most severe aircraft-level failure state category corresponding to each combination of failure modes.

[0014] The beneficial effects of this invention are: This invention proposes a signal-level IMA system cascade impact analysis method, which enables system designers to determine the failure impact of the system before the system's FHA, thereby providing strong support for determining the failure state category in the system FHA analysis and providing a basis for determining the qualitative and quantitative indicators of each device in the system's PSSA. Attached Figure Description

[0015] Figure 1This is a flowchart of the method for analyzing the cascading impact of avionics systems in an aircraft's integrated modular architecture; Figure 2 This is an example diagram of direct signal and signal-level direct influence analysis using the cascaded influence analysis method. Figure 3 It is the identification of indirect signals when analyzing the direct impact of communication systems. Figure 4 This is an example diagram of system-level direct impact analysis using the cascading impact analysis method. Figure 5 This is an example diagram of aircraft-level impact analysis using the cascaded impact analysis method. Detailed Implementation

[0016] The following description of embodiments provides a more detailed explanation of the specific implementation of the present invention, including the shape and structure of each component, the relative positions and connections between the parts, the function and working principle of each part, the manufacturing process, and the operation and use methods, in order to help those skilled in the art to have a more complete, accurate, and in-depth understanding of the concept and technical solution of the present invention. One embodiment of the present invention provides a method for cascading impact analysis of IMA systems based on signal hierarchy, the method comprising: Based on single-point failure, common-mode failure, and failure rate, the mode of combined failure is determined, which is the combination of failed device and failure type. All signals and combined failure modes transmitted through the integrated modular avionics platform equipment are mapped, and all signals are assigned to various user systems according to certain rules, serving as direct impact signals on the user systems. The user system analyzes the impact of individual signal loss and error on itself for each of its directly affecting signals, and simultaneously identifies the indirect signals generated by the directly affecting signals and the user system. The user system performs indirect impact analysis on signal loss and errors for indirect signals; Based on the identified combined failure modes, and based on the direct impact analysis results at the signal level, the granularity is improved, and the system-level direct impact analysis corresponding to each combined failure mode is summarized. Based on the identified combined failure modes, and based on the indirect impact analysis results at the signal level, the granularity is improved, and the system-level indirect impact analysis corresponding to each combined failure mode is summarized. By comprehensively analyzing the results of direct and indirect impact analysis at the system level, and taking into account flight phases and combined failure factors, a system-level impact analysis is obtained. By comparing each aircraft-level failure state with the related user system functions, we can check the system-level impact analysis results of each user system and determine whether any combination of failure modes will lead to the loss or error of these user system functions, thereby causing the corresponding aircraft-level failure state to occur.

[0017] In this embodiment, the method further includes: Based on the type composition of the integrated modular avionics system platform equipment, since the design principles and working methods of different types of equipment are different, the combined failure range is determined without considering the combined failure between cross-type equipment, that is, only the combined failure between equipment of the same type is considered. Based on common mode considerations (the same root cause or triggering event causes two or more devices that were originally designed to be independent and redundant to fail simultaneously), and the failure impact of simultaneous loss and simultaneous error of similar devices can cover the failure impact of mixed combination of loss and error, the combined failure between similar devices only considers the case of simultaneous loss or simultaneous error, and does not consider the combined failure of mixed combination of loss and error.

[0018] Based on the preliminary failure rate data, single-point failures, and common-mode failures of individual equipment on the integrated modular avionics platform, it is necessary to analyze single-point failures and common-mode failures (total loss or total error). Combined failures of two or more equipment of the same type should be included in the scope of combined failures as needed, based on the relationship between failure rate and impact category.

[0019] In this embodiment, the method further includes: Based on the Interface Definition Code (ICD) between the integrated modular avionics platform and user systems, all signals transmitted by the integrated modular avionics platform and the mapping relationships between signals and combined failure modes are identified. The signals are then distributed to each user system according to the following principles: If a signal is related to an aircraft-level functional requirement (such as display, alarm, control, maintenance, etc.) proposed by a user system, then the signal is assigned to that user system as a direct influencing signal. Each signal should be assigned to the user system with the highest degree of correlation to avoid duplication and omission of analysis objects.

[0020] In this embodiment, the method further includes: When performing direct impact analysis on signals that directly affect a user system, the impact of the simultaneous failure of two or more mutually redundant signals must be considered.

[0021] Indirect signals to be identified when performing direct impact analysis include: signals that are used by the first user system and then directly transmitted to the second user system; new signals that are processed by the first user system for use by the second user system after being used by the first user system; and signals that are not used by the first user system but are directly transmitted to the second user system for use.

[0022] In this embodiment, the method further includes: When refining the granularity of the direct impact analysis results based on the signal level and summarizing them into the system-level direct impact analysis: First, the direct impacts of multiple signals under the same combined failure mode are merged. Then, based on the business logic of the user system, it is determined whether the direct impacts of multiple signals will lead to the occurrence of any system-level failure state FC in the Functional Hazard Analysis Report (FHA) of the user system. If so, the failure category (I, II, III, or IV) of the corresponding FC in the system FHA is taken as the direct impact category of multiple signals under the combined failure mode. If not, it is not necessary to give the direct impact category of multiple signals under the combined failure mode.

[0023] Failure category I, II, III or IV: Category I failure: Typically results in the loss of the aircraft, leading to the death of the flight crew or loss of capability, resulting in the death of multiple passengers and crew members. Category II failure: Significantly reduces the functional characteristics or safety margin of an aircraft, causing physical pain or excessive workload to the flight crew, affecting their ability to perform their duties, and resulting in serious or fatal injuries to a small number of passengers or cabin crew. Category III failure: Significantly reduces the functional characteristics or safety margins of the aircraft, causing discomfort to the flight crew or significantly increasing the workload of the flight crew, resulting in physical pain or possible injury to the passengers; Category IV failure: A slight reduction in the functional characteristics or safety margins of an aircraft, resulting in a slight increase in the workload of the flight crew and causing discomfort to the passengers.

[0024] In this embodiment, the method further includes: When refining the granularity of indirect impact analysis results based on signal-level indirect impact analysis and summarizing them into system-level indirect impact analysis: First, the indirect impacts of multiple signals under the same combined failure mode are merged. Then, based on the user system's business logic, it is determined whether the indirect impacts of multiple signals will lead to the occurrence of any system-level failure state FC in the user system's Functional Hazard Analysis Report (FHA). If so, the failure category (I, II, III, or IV) of the corresponding FC in the system FHA is taken as the indirect impact category of multiple signals under the combined failure mode. If not, it is not necessary to give the indirect impact category of multiple signals under the combined failure mode.

[0025] In this embodiment, when performing aircraft-level impact analysis, the aircraft-level failure states and related system-level functions defined in the preliminary aircraft-level safety analysis document PASA are used as inputs. The results of the system-level impact analysis are combined to determine the most severe aircraft-level failure state category corresponding to each combination of failure modes.

[0026] The second embodiment of the present invention is as follows: The integrated modular avionics system of this embodiment includes: several general-purpose processing modules (GPMs), several remote data interface units (RDIUs), and several network switches (ARSs). Each GPM hosts application software such as flight management and crew alarms; the RDIUs handle the transmission, reception, and conversion of data using different protocols such as ARINC664, ARINC429, and discrete quantities, and support system interaction within and outside the ARINC664 network; the ARSs provide data exchange compliant with the ARINC664 standard. The ARSs and these devices form a star topology through the ARINC664 network.

[0027] The combined failure range of the cascading effect analysis method includes: loss of a single GPM, a single RDIU, two GPMs, two RDIUs, two ARSs, all GPMs, all RDIUs, and all ARSs; and errors of a single GPM, a single RDIU, a single ARS, two GPMs, two RDIUs, all GPMs, all RDIUs, and all ARSs.

[0028] Based on the system interface definitions, all thousands of signals passing through GPM, RDIU, and ARS, along with their mapping relationships to combined failure modes, were identified. Signals were then assigned to various user systems based on their association with those systems: if a signal is ultimately transmitted to the display control system, unit alarm system, or onboard maintenance system, it is assigned to the source system; otherwise, it is assigned to the user system. Examples are shown below. Figure 2 The direct impact of communication systems on signals and analysis of these impacts.

[0029] Figure 2 This paper demonstrates the direct impact analysis of signals at the local level and at the signal level on a communication system. In the direct impact analysis at the signal level, the influence of each signal on the communication system under its corresponding combined failure mode was analyzed. In this process, indirect impact signals transmitted through the communication system were also identified, such as... Figure 3 The analysis of the direct impact of communication systems includes the identification of indirect signals. These indirect signals originate from the user systems of the navigation system's LIU (Limited Institutional Unit) and the communication system's SBU (Site Management Unit), and will be included in the indirect impact analysis tables for the navigation and communication systems, respectively.

[0030] After performing the direct impact analysis of the above signal levels, a comprehensive analysis of the impact on the communication system level is conducted based on the impact of all signal levels under each combined failure mode. Preferably, a dedicated tool is used to extract and integrate all signal level impacts under each combined failure mode; then, the relevant FHAs (FHAs of communication systems, crew alarm systems, and airborne maintenance systems, etc.) of the user system are queried to determine whether these signal level impacts will lead to a system failure state. If so, the FC category in the system FHA is used as the impact level of that combined failure mode on the communication system. For example... Figure 4 System-level direct impact analysis of communication systems.

[0031] The methods for analyzing indirect effects at the system level are the same as those for analyzing direct effects at the system level.

[0032] Next, the direct and indirect impact analyses of the communication system are combined according to the combined failure modes, and the analysis method is the same as that of the system-level direct impact analysis, so as to obtain the impact analysis of the communication system under multiple combined failure modes.

[0033] Finally, an aircraft-level impact analysis was conducted; see the example below. Figure 5 The aircraft-level failure states (failure states column) and related system-level functions defined in the Preliminary Aircraft-Level Safety Assessment (PASA) are compiled. Figure 5 The ATA chapter column matrix is ​​used to first determine whether any combination of failure modes will lead to the loss or error of the functions described in the ATA communication system column. The results show that no combination of failure modes will lead to the simultaneous loss of "F-23-04 HF communication function, F-23-05 VHF communication function, and F-23-07 satellite communication function". Therefore, it will not lead to the occurrence of the Class I event "the combination of complete loss of T / F / L / B communication and all navigation information display" in the corresponding aircraft-level failure state.

[0034] In summary, this invention provides a signal-level-based IMA system cascading impact analysis method. The method includes: determining the scope of combined failures (i.e., combinations of failed devices and failure types) based on factors such as single-point failures, common-mode failures, and failure rates; mapping all signals and combined failure modes transmitted through equipment on the integrated modular avionics platform and assigning them to various user systems according to certain rules, as direct impact signals for the user systems; analyzing the impact of each signal loss and error on the user systems for their own direct impact signals, simultaneously identifying indirect signals and user systems; and performing indirect impact analysis on the user systems for indirect signals. Based on the determined range of combined failures, and based on the direct impact analysis results at the signal level, the granularity is increased to derive the system-level direct impact analysis. Similarly, based on the determined range of combined failures, and based on the indirect impact analysis results at the signal level, the granularity is increased to derive the system-level indirect impact analysis. The system-level direct and indirect impact analysis results are then comprehensively analyzed, taking into account factors such as flight phases, to derive the system-level impact analysis corresponding to each combined failure mode. Finally, the impact analysis results at each system level are examined one by one against the relevant functions of each system in the aircraft-level failure state to determine whether a certain combined failure will lead to the loss, partial loss, or error of related system functions, thereby causing the corresponding aircraft-level failure state.

[0035] It should be noted that the above embodiments are merely illustrative examples of the present invention, intended to help understand the technical solution and core ideas of the present invention. Those skilled in the art should understand that any modifications, equivalent substitutions, or improvements made based on the concept of the present invention without departing from its principles should be considered within the scope of protection of the present invention, and the specific scope of protection is determined by the claims.

Claims

1. A method for analyzing the cascading effects of an IMA system based on signal hierarchy, characterized in that, The method includes: Based on single-point failure, common-mode failure, and failure rate, the mode of combined failure is determined, which is the combination of failed device and failure type. All signals and combined failure modes transmitted through the integrated modular avionics platform equipment are mapped, and all signals are assigned to various user systems according to certain rules, serving as direct impact signals on the user systems. The user system analyzes the impact of individual signal loss and error on itself for each of its directly affecting signals, and simultaneously identifies the indirect signals generated by the directly affecting signals and the user system. The user system performs indirect impact analysis on signal loss and errors for indirect signals; Based on the identified combined failure modes, and based on the direct impact analysis results at the signal level, the granularity is improved, and the system-level direct impact analysis corresponding to each combined failure mode is summarized. Based on the identified combined failure modes, and based on the indirect impact analysis results at the signal level, the granularity is improved, and the system-level indirect impact analysis corresponding to each combined failure mode is summarized. By comprehensively analyzing the results of direct and indirect impact analysis at the system level, and taking into account flight phases and combined failure factors, a system-level impact analysis is obtained. By comparing each aircraft-level failure state with the related user system functions, we can check the system-level impact analysis results of each user system and determine whether any combination of failure modes will lead to the loss or error of these user system functions, thereby causing the corresponding aircraft-level failure state to occur.

2. The method for analyzing the cascading effects of an IMA system based on signal hierarchy according to claim 1, characterized in that, When determining the scope of combined failures, only combined failures between devices of the same type should be identified.

3. The method for analyzing the cascading effects of an IMA system based on signal hierarchy according to claim 2, characterized in that, The confirmation of combined failures among similar equipment only confirms cases where similar equipment is lost or malfunctions simultaneously, excluding mixed combined failures where both loss and malfunction occur.

4. The method for analyzing the cascading effects of an IMA system based on signal hierarchy according to claim 3, characterized in that, For the confirmation of combined failures of two or more devices of the same type, the combined failures are included in the scope of combined failures based on the relationship between the failure rate and the impact category.

5. The method for analyzing the cascading effects of an IMA system based on signal hierarchy according to claim 4, characterized in that, Based on the Interface Definition (ICD) between the integrated modular avionics platform and user systems, all signals transmitted by the integrated modular avionics platform and the mapping relationship between signals and combined failure modes are identified, and the signals are distributed to various user systems according to certain principles.

6. The method for cascading impact analysis of IMA systems based on signal hierarchy according to claim 5, characterized in that, The signals will be distributed to each user system according to the following principles: If a signal is related to an aircraft-level functional requirement proposed by a user system, then the signal is assigned to that user system as a direct influence signal. Each signal should be assigned to the user system with the highest degree of correlation to avoid duplication and omission of analysis objects.

7. The method for cascading impact analysis of IMA systems based on signal hierarchy according to claim 6, characterized in that, When performing direct impact analysis on signals that directly affect a user system, the impact of the simultaneous failure of two or more mutually redundant signals should also be considered. Indirect signals to be identified when performing direct impact analysis include: signals that are used by the first user system and then directly transmitted to the second user system; new signals that are processed by the first user system for use by the second user system after being used by the first user system; and signals that are not used by the first user system but are directly transmitted to the second user system for use.

8. The method for analyzing the cascading effects of an IMA system based on signal hierarchy according to claim 7, characterized in that, When refining the granularity of the direct impact analysis results at the signal level and summarizing them into a system-level direct impact analysis: First, the direct impacts of multiple signals under the same combined failure mode are merged. Then, based on the business logic of the user system, it is determined whether the direct impacts of multiple signals will lead to the occurrence of any system-level failure state FC in the Functional Hazard Analysis Report (FHA) of the user system. If so, the failure category of the corresponding FC in the system FHA is taken as the direct impact category of multiple signals under the combined failure mode. If not, it is not necessary to give the direct impact category of multiple signals under the combined failure mode.

9. The method for cascading impact analysis of IMA systems based on signal hierarchy according to claim 8, characterized in that, When refining the granularity of indirect impact analysis results based on signal-level indirect impact analysis and summarizing them into system-level indirect impact analysis: First, the indirect impacts of multiple signals under the same combined failure mode are merged. Then, based on the business logic of the user system, it is determined whether the indirect impacts of multiple signals will lead to the occurrence of any system-level failure state FC in the Functional Hazard Analysis Report (FHA) of the user system. If so, the failure category of the corresponding FC in the system FHA is taken as the indirect impact category of multiple signals under the combined failure mode. If not, it is not necessary to give the indirect impact category of multiple signals under the combined failure mode.

10. The method for cascading impact analysis of IMA systems based on signal hierarchy according to claim 9, characterized in that, When conducting aircraft-level impact analysis, the aircraft-level failure states and related system-level functions defined in the preliminary aircraft-level safety analysis document PASA are used as inputs. The results of the system-level impact analysis are combined to determine the most severe aircraft-level failure state category corresponding to each combination of failure modes.

Images