Intelligent bus bar power supply controller built-in self-detection method and power supply controller thereof

Abstract

The invention discloses an intelligent bus bar power supply controller built-in self-detection method and a power supply controller thereof. A monitoring chip and a control chip are adopted for double-track asynchronous initialization and cross validation; and the monitoring chip dynamically adjusts a test strategy according to a system state, acquires multi-source heterogeneous data for predictive analysis, and performs grading treatment according to an early warning level. According to the invention, the control chip realizes clock and discrete magnitude detection, SPI communication and control functions; and the monitoring chip realizes input processing, working mode management, protection function, self-detection and fault management. According to the method, equipment faults are detected through excitation recovery, BIT surrounding, analog quantity BIT and coding error detection, and system fault diagnosis is achieved through hardware collection and logic combination. According to the method, the fault detection time is reduced from millisecond level to microsecond level, the detection coverage rate is increased to 95% or above, predictive maintenance is realized, and the method is suitable for high-security-level applications such as aerospace.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of testability and reliability design of electrical systems, and particularly relates to an intelligent busbar power controller in-flight self-detection method and a power controller thereof for an aircraft. BACKGROUND

[0002] The busbar power controller is a key power management unit in modern electrical systems (especially in the fields of aerospace, communication, server, etc.), responsible for the distribution, switching, monitoring and protection of the multi-path power supply of the power distribution system, and its reliability is directly related to the stable operation of the entire system. Built-in test (BIT) is a key technology for improving system reliability, testability and maintainability.

[0003] With the increasing combat capability of modern aircraft, aircraft system design is developing towards high integration and complexity, covering digital electronic systems, mechanical systems, electrical systems, electromechanical systems and other aspects. The deepening of system integration makes it difficult for traditional BIT technology targeting devices or simple systems to meet the overall testability requirements of aircraft.

[0004] In the prior art, the BIT design of the busbar power controller is mostly realized by microprocessors or special management chips. Such a scheme has inherent limitations: First, the reliability problem of single-chip BIT. In the single-chip scheme, a chip plays the role of both "athlete" (executes main functions) and "referee" (executes BIT). When the controller chip itself fails, its BIT function may also fail, resulting in incorrect fault reporting and even making wrong decisions, forming a single-point bottleneck in reliability.

[0005] Second, the real-time problem of test logic. Traditional BIT testing usually adopts a single-threaded, sequential execution mode, which is difficult to perform high-concurrency, real-time monitoring on multi-path power parameters, resulting in delayed fault response and failing to meet the real-time requirements of high-reliability systems.

[0006] Third, the test coverage and flexibility are insufficient. The functions of traditional BIT circuits are fixed after hardware manufacturing, and the test depth is uniform and unchangeable, making it difficult to adjust the test strategy and diagnosis threshold for different task scenarios, and also unable to dynamically optimize test resources according to system state.

[0007] Fourth, the fault diagnosis and isolation precision is limited. Existing solutions can usually only report fault phenomena, but are difficult to accurately locate the fault to specific field replaceable units, and are mostly in a passive mode of detecting already occurred faults, and cannot realize fault prediction and preventive maintenance.

[0008] Fifth, common cause failure risk. Conventional isomorphic dual-core lockstep or software BIT schemes share clock, power supply, design tool chain, and are prone to simultaneous failure due to common causes (such as clock distortion, power supply glitch, tool chain bug).

[0009] The fault of the aircraft system level has its particularity, and is often manifested as the fault cross-linking and coupling effect between multiple devices or subsystems, the fault causes are complex, and often involve the interaction of multiple links. In addition, the system level generally adopts redundancy management, dynamic reconstruction, and fault analysis and disposal strategy, which further increases the difficulty of fault detection, diagnosis and state monitoring. Therefore, how to design a system-level BIT technology with high reliability, high test coverage, and fault prediction and accurate diagnosis has become a key technical challenge in the current aircraft testability field. SUMMARY

[0010] The purpose of the application is to solve the problems of low reliability, fault response delay, insufficient test coverage, and difficult fault isolation in the existing single-chip BIT scheme. The application provides an intelligent busbar power controller in-machine self-detection method and a power controller, which realizes the upgrade from self-detection to self-detection / inter-detection, from isomorphic redundancy to heterogeneous monitoring, and from passive detection to active monitoring.

[0011] Technical scheme: On the one hand, the application provides an intelligent busbar power controller in-machine self-detection method, comprising the following steps: S1. Double-track asynchronous initialization step: the controller chip of the monitoring function is preferentially started and enters a pre-monitoring state, the controller chip of the control function is delayed to start, and the two exchange initialization states in real time through a special initialization state channel and cross-verify; S2. State-aware dynamic test step: the controller chip of the monitoring function dynamically selects and executes an adaptive test strategy according to the current stage of the system state machine, and the current stage of the system state machine includes an initialization stage, a standby stage, a running stage and a fault handling stage; S3. Multi-source heterogeneous data acquisition step: the controller chip of the monitoring function acquires internal signals, system state machine states and timing path information of the controller chip of the control function through a special monitoring bus, and simultaneously acquires voltage, temperature and vibration physical parameters through an independent sensor interface; S4. Predictive analysis step: the controller chip of the monitoring function extracts features from the collected data, including long-term trend analysis, change rate analysis, fluctuation pattern recognition and parameter correlation analysis, and generates a health score and a trend prediction; S5. Hierarchical early warning and disposal step: the controller chip of the monitoring function takes corresponding disposal actions according to the prediction results according to the early warning level, and the early warning level includes early warning, medium-term warning and emergency warning.

[0012] Specifically, the S1. dual-track asynchronous initialization steps include: S11. Upon power-up, the controller chip with monitoring function is started first and immediately enters the pre-monitoring state to begin the initialization process of the controller chip with monitoring and control functions. S12. The controller chip for the control function starts up with a delay, and its initialization process is supervised by a third party of the controller chip for the monitoring function, including monitoring the clock frequency, power-up timing, and initialization status of key registers. S13. After the controller chip for the control function starts up, it sends initialization status information to the controller chip for the monitoring function through a dedicated initialization status channel; S14. The controller chip for monitoring functions verifies the initialization status of the controller chip for the control function, including critical register value readback, clock frequency measurement, and memory integrity check; S15. Verify the health status of the controller chip for control functions, including monitoring algorithm parameter verification, sensor calibration data verification, and response time testing. S16. After bidirectional cross-verification and confirmation between the controller chip for monitoring function and the controller chip for control function, the system enters normal working state.

[0013] Specifically, the dynamic testing steps for S2. State awareness include: environment awareness testing, load awareness testing, and health-driven testing; S21. Environmental Awareness Test: The controller chip with monitoring function dynamically adjusts the test frequency and test thresholds based on detected ambient temperature, vibration, and power supply quality parameters; specifically: a. Adjusting the test frequency and thresholds based on temperature; when the temperature exceeds the first threshold, adding high-temperature aging-related test items; b. Adjusting the test items based on vibration intensity; when the vibration intensity exceeds the second threshold, adding mechanical connection integrity tests; c. Adjusting the test strategy based on power supply quality; when power supply quality fluctuates, enhancing power integrity tests. S22. Load Awareness Test: The controller chip with monitoring function dynamically selects the test depth according to the system load; specifically: a. Under light load conditions, perform comprehensive offline testing; b. Under heavy load conditions, perform minimal online health monitoring; c. Under sudden load conditions, enhance dynamic response testing. S23. Health-Driven Testing: The controller chip for the monitoring function dynamically adjusts the testing intensity based on historical health scores; specifically: a. When the health score is higher than 90, a regular test is performed; b. When the health score is between 70 and 90, an enhanced test is performed; c. When the health score is lower than 70, a reinforced test is performed.

[0014] Specifically, S4. Predictive analytics steps include: S41. Feature extraction sub-step: The controller chip with monitoring function performs feature engineering processing on the collected historical data to extract the long-term trend, first derivative rate of change, fluctuation pattern features and correlation features between parameters of key parameters. S42. Collaborative Prediction Sub-step: The controller chip with the monitoring function performs real-time feature calculation and simple linear prediction, while the controller chip with the control function performs complex model calculation and machine learning inference. The two work together to generate prediction results. S43. Trend Analysis Sub-step: The controller chip with the monitoring function compares the current parameters with historical trends to identify parameter drift and performance degradation patterns; S44. Life Prediction Sub-step: Based on parameter degradation drift and performance degradation trend, establish a remaining useful life prediction model.

[0015] Specifically, the S5. graded early warning and response steps include: S51. Early Warning: When trend analysis indicates that the safety threshold may be exceeded within 90 days, record the warning information and recommend arranging preventive maintenance; S52. Mid-term warning: When trend analysis shows that the safety threshold may be exceeded within 30 days, a warning signal is issued to the system, and the system operating parameters are adjusted to slow down the degradation; S53. Emergency Warning: When trend analysis indicates that the safety threshold may be exceeded within 3 days, take immediate protective measures, including reducing the operating limit, switching to the backup channel, or shutting down safely.

[0016] Specifically, it also includes S6. Equipment self-fault detection steps and S7. Equipment system fault diagnosis steps; S6. The equipment's own fault detection procedure is implemented using the following BIT technology: a. Faults in discrete quantity acquisition circuits and analog quantity acquisition circuits: Excitation retrieval technology is used, and the excitation signal is output by the multiplexed functional circuit. The correctness of the output is determined by the retrieval path. b. Drive circuit failure: Use the surround BIT technology to trace the output signal back to the input terminal to verify the integrity of the signal path; c. Power supply circuit fault: Analog bit technology is used to monitor the circuit status through sensors, and the results are analyzed by the controller chip with monitoring function after A / D conversion. d. Communication circuit fault: Employ coding error detection technology and use error correction codes to verify data correctness; S7. Equipment fault diagnosis steps for the system: The system collects the status of surrounding equipment through hardware, including voltage, current, switches and contactor auxiliary contacts, and receives communication information. The controller chip with monitoring function performs logical combination to report faults.

[0017] Specifically, it also includes S8. Power-on self-test step and S9. Continuous self-test step: S8. Power-on self-test procedure: This is performed when the system is powered on. It uses BIT technology to detect circuit faults in the equipment itself, and the test results are uploaded to the avionics indication system through the communication system. S9. Continuous self-testing step: This step is continuously executed during system operation to detect faults in the power distribution system. The test results are used to trigger the control and protection functions of the equipment and are uploaded to the avionics indication system to protect other equipment and components in the power distribution system from damage.

[0018] Specifically, it also includes S10. Automated fault injection verification step, which is executed after the system is in a safe idle state and operator authorization is obtained: S101. The controller chip with monitoring function selects the fault mode to be injected, generates an injection signal, and injects the fault into the specified monitoring point or sensor; among which, the injectable fault types include: sensor fault, communication fault, power supply fault, and logic fault. S102. After confirming that the controller chip for the control function is ready, it enters the test mode to simulate the response to the injected fault; S103. The controller chip with the monitoring function verifies whether it can correctly detect the injected fault and verifies whether the controller chip with the control function can perform the correct protection action.

[0019] Specifically, it also includes the S11. Level 3 test depth step, whose control strategy is as follows: Level 1: Rapid health check, execution time less than 100 milliseconds, including: power supply voltage range check, clock signal presence check, communication link connectivity check, and critical temperature over-limit check; Level 2: Functional verification test, execution time less than 1 second, including: sensor calibration verification, drive circuit function test, protection logic verification and storage integrity check; Level 3: Comprehensive diagnostic test, execution time less than 10 seconds, performed only during the maintenance window, including full range parameter scanning, dynamic response characteristic test, environmental adaptability verification and life assessment test; The testing depth is dynamically selected based on system time constraints, resource constraints, and current health status.

[0020] On the other hand, the present invention provides an intelligent busbar power controller for implementing the above-mentioned intelligent busbar power controller internal self-detection method, comprising: A controller chip with control functions, which is used to execute the main functional logic of the busbar power controller, and includes power distribution, switching, monitoring and protection functions; The monitoring controller chip is physically independent of the control controller chip, and is powered by an independent power rail and an independent clock source. The monitoring controller chip is used to monitor the operating status of the control controller chip and perform BIT operations. A dedicated monitoring bus is provided, which connects the controller chip for the control function and the controller chip for the monitoring function. The dedicated monitoring bus is used to realize low-latency and high-reliability status exchange and data interaction. An independent sensor interface is connected to the controller chip with monitoring function. The independent sensor interface is used to collect the voltage, temperature, and vibration physical parameters of the controller chip with control function through an independent sensor. The hardware timestamp unit is integrated into the controller chip of the monitoring function to provide a time reference for nanosecond-level synchronization and support accurate timing analysis.

[0021] Compared with the prior art, the present invention has the following beneficial effects: First, a significant improvement in security: This invention achieves a fundamental shift from self-testing to external and mutual testing through the physical separation of the monitoring chip and control chip and a heterogeneous monitoring architecture. Fault detection time is reduced from milliseconds to microseconds in traditional solutions. Specific test data shows that fault response time is shortened from 120 milliseconds to 28 milliseconds, a reduction of 76.7%. Fault detection coverage increases from 82% to over 97%, and the false alarm rate decreases from 8.5% to 1.2%, a reduction of 85.9%. The advance warning time for faults shifts from when a fault has already occurred to when a fault may occur, achieving a leap from passive detection to proactive monitoring.

[0022] Secondly, a fundamental improvement in reliability: This invention achieves physical independence between the monitoring chip and the control chip. The monitoring chip is powered by an independent power rail and an independent clock source, physically isolated from the power and clock domains of the control chip. Even if the control chip experiences a power failure or clock failure, the monitoring chip can still maintain normal operation, effectively preventing system crashes caused by single points of failure. Simultaneously, the monitoring chip and control chip can be implemented using FPGAs with different design sources and architectures, reducing the risk of common-cause failures from the design stage. The monitoring logic is implemented in hardware and cannot be tampered with or bypassed by the control-side software, ensuring the absolute reliability of the monitoring function. After predictive analysis detects parameter drift, the system can automatically calibrate or adjust operating parameters, achieving online repair capabilities.

[0023] Third, a revolutionary shift in maintenance methods: This invention achieves a fundamental transformation from planned maintenance to condition-based maintenance. Traditional maintenance methods employ fixed-cycle planned maintenance, while this invention achieves condition-based maintenance based on health scores, shifting maintenance decisions from experience-based judgment to quantitative data-driven decisions. Health scores are visually presented in a 0-100 scale, making the system's health status readily apparent. The maintenance model shifts from post-failure repair to pre-failure prevention, and the remaining service life can be accurately predicted, achieving predictive maintenance.

[0024] Fourth, significantly improved system availability: This invention achieves spatiotemporal multiplexing of testing and main functions. While the control chip executes its functions, the monitoring chip continuously performs background health monitoring, ensuring that the testing process does not affect the operation of the main functions. The power-on self-test employs a tiered testing strategy, with the first-level rapid health check completed within 100 milliseconds, significantly shortening system startup time. When a fault is detected, the system can silently switch to a backup channel or maintain a safe state, rather than completely shutting down, supporting fault-run / safe modes. Based on the system load, this invention dynamically selects the testing depth, performing only minimal online monitoring under heavy loads to ensure that critical tasks are not interfered with.

[0025] Fifth, effective reduction in design complexity: This invention decouples complex BIT logic from the main business logic, achieving decoupling of functionality and security. The design of the control chip can focus more on performance optimization, while the design of the monitoring chip focuses on reliability and security, resulting in a clear division of labor. In traditional single-chip solutions, functionality and security are highly coupled, leading to high design complexity and difficulty in timing convergence. In this invention's dual-chip architecture, functionality and security are separated, reducing design complexity and verification difficulty. The focus is now on verifying the monitoring logic and the interaction between the two chips, making fault location more convenient.

[0026] Sixth, a multi-layered security protection system: This invention constructs a complete security protection system from the device itself to the system level. At the chip level, excitation retrieval technology is used to detect faults in discrete and analog quantity acquisition circuits, surround bit technology is used to detect faults in drive circuits, analog bit technology is used to detect faults in power supply circuits, and encoding error detection technology is used to detect faults in communication circuits. At the system level, the status of surrounding equipment, including voltage, current, switches, and contactor auxiliary contacts, is collected by hardware, while communication information is received. The monitoring chip performs logical combination fault reporting to achieve fault diagnosis in the power distribution system. At the maintenance level, automated fault injection verification verifies the correctness and coverage of the bit function itself in a real operating environment.

[0027] Seventh, predictive maintenance capability: This invention achieves a leap from detecting existing faults to predicting impending faults through long-term trend analysis, parameter change rate monitoring, fluctuation pattern recognition, and parameter correlation analysis. Based on parameter degradation trends, the system extrapolates and predicts the time when parameters will reach the safety threshold, generates an estimate of remaining available time, and outputs it according to a three-level early warning mechanism. Early warning focuses on maintenance economics; when trend analysis indicates a potential exceedance of the safety threshold within 90 days, early warning information is recorded and preventative maintenance is recommended. Mid-term early warning focuses on mission reliability; when trend analysis indicates a potential exceedance of the safety threshold within 30 days, an early warning signal is issued to the avionics system, and system operating parameters are adjusted to mitigate degradation. Emergency early warning focuses on flight safety; when trend analysis indicates a potential exceedance of the safety threshold within 3 days, immediate protective actions are taken, including de-rated operation, switching to a backup channel, or safe shutdown. The safety threshold setting comprehensively considers airworthiness certification restrictions, system safety assessment conclusions, component de-rated criteria, and statistical process control limits to ensure the scientific validity and reliability of the early warning. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the internal self-testing method of the intelligent busbar power controller of the present invention; Figure 2 This is a schematic diagram of the internal functional modules of the controller chip (control FPGA) for the control function of this invention; Figure 3 This is a schematic diagram of the internal functional modules of the controller chip (monitoring FPGA) for the monitoring function of this invention; Figure 4 This is a schematic diagram of the dual controller chip system structure and interconnection relationship of the present invention; Figure 5 This is a schematic diagram of the fault handling classification and implementation method of the BIT module of the present invention; Figure 6 This is a functional flowchart of PBIT and CBIT of the present invention; Figure 7 This is a schematic diagram of the dual-track asynchronous initialization and cross-validation process of the present invention; Figure 8 This is a schematic diagram of the state-aware dynamic testing strategy of the present invention; Figure 9 This is a schematic diagram of the three-level test depth control strategy of the present invention. Figure 10 This is a schematic diagram illustrating the specific process of predictive analysis in this invention; Figure 11 This is a schematic diagram illustrating the specific process of the graded early warning and response of the present invention; Figure 12 This is a schematic diagram of the automated fault injection verification process of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to specific embodiments. Those skilled in the art will understand that the following embodiments are for illustrative purposes only and are not intended to limit the scope of protection of this invention.

[0030] like Figure 1 As shown, this embodiment provides an intelligent busbar power controller internal self-testing method, including the following steps: S1. Dual-track asynchronous initialization steps: The controller chip with monitoring function starts up first and enters the pre-monitoring state, while the controller chip with control function starts up with a delay. The two exchange initialization states in real time through a dedicated initialization state channel and perform cross-verification.

[0031] S2. Dynamic testing steps for state awareness: The controller chip with monitoring function dynamically selects and executes an appropriate test strategy based on the current stage of the system state machine. The current stage of the system state machine includes the initialization stage, standby stage, running stage, and fault handling stage.

[0032] S3. Multi-source heterogeneous data acquisition steps: The controller chip with monitoring function acquires the internal signals of the controller chip with control function, the system state machine status, and timing path information through a dedicated monitoring bus. At the same time, it acquires voltage, temperature, and vibration physical parameters through independent sensor interfaces.

[0033] S4. Predictive Analysis Steps: The controller chip with monitoring functions extracts features from the collected data, including long-term trend analysis, rate of change analysis, fluctuation pattern recognition, and parameter correlation analysis, to generate a health score and trend prediction.

[0034] S5. Tiered Early Warning and Response Steps: Based on the prediction results, the controller chip with the monitoring function takes corresponding actions according to the early warning level, which includes early warning, mid-term warning and emergency warning.

[0035] The controller chip in this embodiment mainly implements global clock and reset signal output, discrete quantity detection and processing, SPI communication, working mode indication, control functions, and output drive functions. For example... Figure 2 As shown, the controller chip for control functions includes: a global clock and reset module, a discrete quantity detection and processing module, an SPI communication module, a working mode indication module, a control function module, and an output driver module. Among them: The global clock and reset module processes the external crystal oscillator input clock and reset signals, outputting global clock and reset signals for use by other submodules. This module ensures that the entire control chip has a unified timing reference and can perform a global reset of the system when necessary.

[0036] The discrete signal detection and processing module detects discrete signals and operating mode signals, performs filtering, and outputs the processed discrete signals to other modules. Filtering eliminates glitches and noise in the input signal, improving signal reliability.

[0037] The SPI communication module is used to establish SPI communication with the controller chip for monitoring functions, enabling data reception and transmission. This module is the main channel for information exchange between the two controllers.

[0038] The operating mode indication module is used to process data according to the operating mode instructions transmitted from the controller chip of the monitoring function. This enables the control chip to adjust its behavior according to the instructions of the monitoring chip.

[0039] The control module receives discrete, analog, and protection information and outputs control drive signals according to a specific logic. This module implements the core control algorithm of the busbar power controller.

[0040] The output drive module is used to receive control drive signals from the control function module, and output drive signals according to certain logic to drive external actuators such as contactors and relays.

[0041] The controller chip for monitoring functions in this embodiment mainly implements input signal processing, operating mode management, protection functions, self-testing function blocks, avionics communication, RS485 communication, SPI communication, fault management and reporting, data storage and retrieval, and output control functions. For example... Figure 3 As shown, the controller chip for monitoring functions includes: a global clock and reset module, an SPI communication module, a protection function module, an indication information processing module, an external communication module, a BIT module, a serial communication module, a discrete quantity detection module, an analog quantity detection module, a data selection module, a power control module, and an SPI Flash interface module. Furthermore, the controller chip for monitoring functions also integrates the core functional modules of this invention. Among them: The global clock and reset module provides a unified clock reference and reset control for the controller chip used in monitoring functions. This module receives the clock signal from an external crystal oscillator, and after frequency multiplication and division, generates the clock signals required by each sub-module, ensuring timing synchronization across the entire chip. Simultaneously, it receives external reset signals or reset signals triggered by the internal watchdog timer, performing a global reset operation in case of system anomalies to ensure the chip can resume normal operation after a failure. This module also features clock failure detection, automatically switching to a backup clock source when the clock signal is abnormal, improving system reliability.

[0042] The SPI communication module is used to establish high-speed serial communication with the controller chip via the SPI interface, enabling data reception and transmission. This module is the main channel for information exchange between the two controllers, responsible for transmitting the status information of the control chip, the detection commands of the monitoring chip, and handshake signals between the two parties. It supports full-duplex communication mode, ensuring the real-time performance and reliability of data interaction. The module has a built-in hardware CRC checksum to detect data errors during communication, automatically retransmitting or reporting communication faults when errors are detected.

[0043] The protection module monitors various fault conditions and triggers corresponding protection actions. This module receives processing results from the discrete and analog quantity detection modules in real time, and uses preset protection logic to determine whether faults such as overcurrent, overtemperature, open / short circuit, overvoltage, and undervoltage have occurred. When a fault condition is detected, a protection trigger signal is immediately generated, and protection actions are executed via the power control module or by directly outputting control signals, such as disconnecting the fault circuit, switching to a backup channel, or initiating an emergency shutdown, ensuring the safe operation of the system. The protection thresholds and response times of this module can be loaded from the SPI Flash, supporting field configuration updates.

[0044] The instruction information processing module processes the operating mode indication signals from the controller chip used for control functions. This module receives operating mode commands from the SPI communication module, parses them, and generates corresponding mode control signals to manage the monitoring chip's own behavior mode transitions. For example, in different states such as normal monitoring mode, maintenance mode, test mode, and sleep mode, this module adjusts the operating strategies of other modules (such as sampling frequency, detection threshold, communication rate, etc.) to ensure that correct monitoring and protection functions are executed in different modes.

[0045] The external communication module is used to communicate with the avionics system, sending and receiving communication messages. This module facilitates information exchange with the host system, responsible for uploading fault information detected by the monitoring chip, system status data, health scores, and predictive warning information to the avionics indication system. Simultaneously, it receives control commands, configuration parameters, and synchronization commands issued by the avionics system. This module supports standard aviation bus protocols to ensure reliable communication with the avionics system and has message priority management capabilities to ensure the priority transmission of critical information.

[0046] The BIT module, or self-test module, is used to perform built-in tests. This module includes Power-On Self-Test (PBIT), Continuous Self-Test (CBIT), and Operational Test (OT) functions, capable of detecting faults in the chip's internal circuitry and external interfaces. PBIT executes automatically upon system power-on, employing techniques such as excitation retrieval, surround BIT, analog BIT, and code error detection to detect circuit faults within the device itself, including discrete signal acquisition circuits, analog signal acquisition circuits, drive circuits, power supply circuits, and communication circuits. CBIT executes continuously during system operation, detecting faults in the power distribution system; the results are used to trigger the device's control and protection functions. OT executes in maintenance mode, verifying the correctness of specific functions through fault injection and other methods. The module's test results are recorded by the fault management and reporting module and stored in the SPI Flash.

[0047] The serial communication module is used for serial communication with the host computer in device maintenance mode, receiving test commands and sending status information. This module typically uses an RS485 or RS232 interface, supporting long-distance communication and multi-device networking. Maintenance personnel can access the system through this module to perform manual tests, parameter configuration, firmware upgrades, download historical data from SPI Flash, and obtain detailed fault logs, system status data, and health assessment reports. This module supports multiple baud rate selection and hardware flow control to adapt to different maintenance equipment needs.

[0048] The discrete signal detection module is used for sampling and digitally filtering discrete input signals. This module receives external discrete signals (such as switch status, contactor auxiliary contact status, mode selection switch status, etc.), and eliminates signal glitches and noise through an input filtering circuit to ensure signal stability and reliability. The module supports multi-channel parallel acquisition, and each channel can be independently configured with filtering parameters and trigger thresholds. These configuration parameters can be loaded from the SPI Flash. The processed discrete signals are sent to the protection function module, fault management and reporting module, and data selection module for subsequent monitoring and protection logic judgment.

[0049] The analog signal detection module is used for sampling and digitally filtering analog input signals. This module receives analog signals such as voltage, current, temperature, and vibration from external sensors, converts them into digital signals via a high-precision analog-to-digital converter (ADC), and performs digital filtering to remove measurement noise. The module supports multi-channel synchronous sampling and allows configuration of sampling rate, range, and filtering coefficients to adapt to the output characteristics of different sensors. Calibration coefficients and configuration parameters are loaded from SPI Flash to ensure long-term stability and interchangeability. The processed analog data is sent to the protection function module, BIT module, predictive analysis module, and data selection module for real-time monitoring, fault detection, and trend analysis.

[0050] The data selection module manages and schedules data generated by various modules, selecting data to be processed or reported based on priority and timestamp. This module implements data routing, distributing the processing results from the discrete and analog quantity detection modules to protection modules, fault management and reporting modules, BIT modules, predictive analysis modules, etc.; it also coordinates the data output order of each module to avoid bus conflicts and ensure that critical data is processed first. This module has built-in data caching and priority arbitration logic, supporting smooth processing of sudden large data volumes and preventing data loss. Data requiring long-term storage (such as fault records and trend data) is stored in SPI Flash through the data storage and retrieval module.

[0051] The power control module generates control signals to drive external devices, such as contactor drives, indicator light controls, and relay controls. This module receives instructions from the protection and handling modules, and outputs drive signals through a power amplifier circuit to control actuators such as contactors, relays, and indicator lights in the power distribution system. The module features overcurrent protection, short-circuit protection, open-circuit detection, and status readback functions. It can promptly report faults in case of drive abnormalities and automatically cut off the output to prevent the fault from escalating. Each drive channel can be independently configured with drive current and protection parameters, which are loaded from the SPI Flash.

[0052] The SPI Flash interface module is used to connect to an external SPI Flash memory, enabling read and write access to the non-volatile memory. This module communicates with the external SPI Flash chip via a dedicated SPI bus, supporting standard SPI protocol modes 0 and 3. The module has a built-in hardware command sequence generator that can automatically perform read, write, erase, and status query operations, reducing the workload on the processor core. The SPI Flash stores information including: firmware programs for monitoring chips, device configuration parameters (protection thresholds, calibration coefficients), fault history records, and health trend data. This module supports DMA data transfer, enabling high-speed, high-capacity data read and write operations, meeting the needs of black box data recording.

[0053] In addition, the controller chip for monitoring functions also includes a fault management and reporting module for detecting, locking, and reporting faults. This module receives fault information from the protection function module, BIT module, discrete quantity detection module, analog quantity detection module, etc., confirms, classifies, and locks the faults to prevent false alarms and false triggers caused by transient interference. This module maintains a real-time fault list and fault history record, supporting functions such as fault timestamp marking, fault count statistics, and fault priority sorting. When a fault is detected, this module immediately reports to the avionics system via the external communication module, simultaneously triggering corresponding protection actions, and storing the fault information (including timestamp, fault parameters, and on-site snapshot) into SPIFlash through the data storage and retrieval module, forming a traceable black box record.

[0054] like Figure 4 As shown, the busbar power controller based on a dual-controller architecture in this embodiment includes a controller chip for control functions and a controller chip for monitoring functions. The controller chip for control functions receives discrete signals and outputs drive command signals. The controller chip for monitoring functions receives discrete signals, analog signals, and communication signals, and outputs communication signals. The controller chip for control functions and the controller chip for monitoring functions interact with each other via an SPI interface.

[0055] The monitoring controller chip is powered by an independent power rail, physically isolated from the power domain of the control controller chip. Even if the control controller chip experiences a power failure or short circuit, the monitoring controller chip can still maintain normal operation. Furthermore, the monitoring controller chip has an independent clock source; its clock signal does not depend on the control controller chip, ensuring that even if the control chip's clock fails, the monitoring chip can still perform accurate fault diagnosis and timestamp recording based on its own clock.

[0056] The dedicated monitoring bus features a low-latency design, supporting nanosecond-level status synchronization and fault information exchange. A hardware timestamp unit adds a unified time reference to all collected data, supporting precise time-series analysis and fault location.

[0057] like Figure 5 As shown, the self-detection BIT module of the processor module composed of the controller chip with monitoring function and the controller chip with control function in this embodiment processes fault information including faults of the device itself and fault diagnosis of the system by the device.

[0058] S6. The fault detection steps of the equipment itself are as follows: The following BIT technologies are used: a. Discrete quantity acquisition circuit fault and analog quantity acquisition circuit fault: Excitation retrieval technology is used, the excitation signal output by the multiplexed function circuit is used, and the output is judged to be correct by the retrieval path; b. Drive circuit fault: The surround BIT technology is used, the output signal is traced back to the input terminal to verify the integrity of the signal path; c. Power supply circuit fault: The analog quantity BIT technology is used, the circuit status is monitored by the sensor, and the data is analyzed by the controller chip with monitoring function after A / D conversion; d. Communication circuit fault: The code error detection technology is used, and the data correctness is verified by the error correction code.

[0059] S7. The equipment's fault diagnosis steps for the system are as follows: The system acquires the status of surrounding equipment via hardware, including voltage, current, switches, and contactor auxiliary contacts. Simultaneously, it receives communication information, and the controller chip with monitoring functions performs logical combinations to report faults. For example, when the acquired contactor auxiliary contact status is inconsistent with the drive command, it can be determined that there is a fault in the contactor drive circuit or the contactor itself.

[0060] like Figure 6 As shown, the S8. Power-on Self-Test (PBIT) step in this embodiment is as follows: It is executed when the system is powered on, using BIT to detect circuit faults in the device itself, and the test results are uploaded to the avionics indication system through the communication system. PBIT ensures that the basic functions of the system are normal before it is put into operation.

[0061] like Figure 6 As shown, step S9, Continuous Self-Test (CBIT), in this embodiment is as follows: It is continuously executed during system operation to detect faults in the power distribution system. The detection results are uploaded to the avionics indication system via the communication system and also trigger the control and protection functions of the equipment to protect other devices in the power distribution system from damage. CBIT enables real-time monitoring and rapid protection response.

[0062] like Figure 7 As shown, the specific process of dual-track asynchronous initialization and cross-validation of the power controller chip in this embodiment is as follows: S11. Upon power-up, the controller chip with monitoring function is started first and immediately enters the pre-monitoring state to begin the initialization process of the controller chip with monitoring and control functions.

[0063] S12. The controller chip for the control function starts with a delay, and its initialization process is supervised by a third party of the controller chip for the monitoring function, including monitoring the clock frequency, power-up timing, and initialization status of key registers.

[0064] S13. After the controller chip for the control function starts up, it sends initialization status information to the controller chip for the monitoring function through a dedicated initialization status channel.

[0065] S14. Monitoring the controller chip to verify the initialization status of the controller chip, including critical register value readback, clock frequency measurement, and memory integrity check.

[0066] S15. Controller chip verification for control functions: monitoring the health status of the controller chip, including monitoring algorithm parameter verification, sensor calibration data verification, and response time testing.

[0067] S16. After bidirectional cross-verification and confirmation between the controller chip for monitoring function and the controller chip for control function, the system enters normal working state.

[0068] This dual-track asynchronous initialization mechanism can detect initialization process anomalies that traditional methods cannot find, establishes dual roots of trust, and ensures that the system starts up in a safe and reliable state.

[0069] like Figure 8 As shown, this embodiment provides the following dynamic testing process for S2. State awareness: The controller chip with monitoring capabilities has a built-in state machine that tracks the system's current state (initialization, standby, operation, fault handling) in real time. It dynamically selects the appropriate testing strategy based on the different states. a. Initialization phase: Perform basic connectivity tests to quickly confirm that basic functions are working properly.

[0070] b. Standby phase: Perform in-depth diagnostic tests to comprehensively check the system's health status.

[0071] c. Operation phase: Perform background health monitoring to minimize interference with main functions.

[0072] d. Fault handling phase: Perform fault mode verification to confirm that the fault has been handled correctly.

[0073] The dynamic testing steps for state awareness include environment awareness testing, load awareness testing, and health-driven testing. The controller chip with monitoring functions dynamically adjusts testing strategies based on multi-dimensional perception of the system's current state, achieving optimal allocation of test resources. Specifically: In this embodiment, S21. The environmental perception test is as follows: The controller chip with the monitoring function dynamically adjusts the test frequency and test threshold according to the detected ambient temperature, vibration, and power supply quality parameters.

[0074] a. Temperature sensing and dynamic adjustment The test frequency and threshold are adjusted according to temperature. When the detected ambient temperature exceeds the first threshold, high-temperature aging-related tests are added, including but not limited to MOSFET on-resistance monitoring and clock frequency drift testing. The reference value for setting the first threshold (temperature) is 60℃-80℃ (depending on the installation area). The specific setting logic is as follows: based on the operating temperature range of the selected monitoring chip, power device, and electrolytic capacitor, 80%-90% of the upper limit of the rated operating temperature is taken as the threshold for triggering enhanced testing. The triggering conditions for high-temperature aging-related tests are shown in Table 1 below.

[0075] Table 1 First Threshold Setting Table Threshold design should include a certain degree of hysteresis. For example, when the temperature exceeds 85°C and enters the high-temperature enhancement test mode, it should be reduced to 7°C before exiting to prevent frequent switching at the critical point.

[0076] In a preferred embodiment, the first threshold is configured as 85%-95% of the device's rated maximum operating temperature, or is set according to the high-temperature operating limit for the corresponding device category in RTCADO-160G Section 4.

[0077] b. Vibration sensing and dynamic adjustment Based on the vibration intensity adjustment test items, when the vibration intensity exceeds the second threshold, mechanical connection integrity testing is added, including but not limited to connector torque status monitoring and solder joint impedance monitoring. The reference value for setting the second threshold (vibration threshold) is 1.5-2.0 times the root mean square value (Grms) of the reference vibration during the current flight phase, or the power spectral density (PSD) at the resonant frequency of the critical structure exceeds the baseline by 3dB, which logically is the starting point of abnormal vibration. The specific setting logic is as follows: based on the vibration spectrum of the airborne equipment installation location (RTCA DO-160G Chapter 8), normal operating vibration and abnormal / resonant vibration are distinguished. The triggering conditions for the mechanical connection integrity test set here are shown in Table 2 below.

[0078] Table 2 Second Threshold Setting Table Vibration monitoring typically uses MEMS accelerometers, with a recommended sampling rate of 1kHz-5kHz. The root mean square value should be used for calculation, rather than the instantaneous peak value, to avoid false triggering.

[0079] c. Power quality perception and dynamic adjustment According to the power quality adjustment test strategy, when power quality fluctuations occur, enhanced power integrity tests are added, including but not limited to DC-DC output stability monitoring and undervoltage lockout response checks. Power quality fluctuations are defined as: voltage amplitude deviating from the nominal value by more than ±10%, ripple coefficient exceeding 200% of the design tolerance, or detection of transient interference events conforming to MIL-STD-704F / DO-160G Section 16 standards. The reference value for power quality fluctuation settings is ±10% voltage deviation or ripple doubling, based on the transient definition of DO-160G Sec 16. Power quality is typically measured from four dimensions: voltage drop, voltage surge, ripple / noise, and frequency drift. The triggering conditions for the enhanced power integrity test set here are shown in Table 3 below.

[0080] Table 3 Power Quality Fluctuation Setting Table In actual engineering projects, these thresholds are managed as configurable parameters.

[0081] In this embodiment, S22. The load awareness test is as follows: a full offline test is performed under light load; minimal online monitoring is performed under heavy load; and dynamic response testing is enhanced under sudden load.

[0082] Specifically, a light load state refers to a situation where the current resource utilization rate of the system is lower than a first preset threshold, and the total resource utilization rate after the predicted full test does not exceed the system's safe operating limit. A heavy load state refers to a situation where the current resource utilization rate of the system is higher than a second preset threshold, or the remaining resources are insufficient to complete the full test without affecting the deadline of the critical task. A burst load state refers to a situation where the growth rate of the system resource utilization rate within a preset time window exceeds a third preset threshold, or the instantaneous load peak exceeds a fourth preset threshold. In a preferred embodiment, for a certain type of flight control computer, the first preset threshold can be set to 40%, the second preset threshold can be set to 70%, and the third preset threshold can be set to 20% / 10ms. The specific values ​​need to be determined through worst-case execution time (WCET) analysis based on the computing power and security level (DAL) of the specific hardware platform.

[0083] In load-aware design of airborne controller chips (such as PowerPC, ARM Cortex-R / A series, or FPGA soft cores), CPU utilization, bus bandwidth utilization, or task queue depth are typically used as the main quantitative indicators, as follows: A. Light Load Condition: System resources are sufficient, and performing a full test will not affect the real-time response of critical flight missions. Typical quantitative standards are as follows: CPU utilization: <30%-40% (some high-security systems may be set to <50%). Memory usage: <60%. I / O bus load: <30%. The judgment condition is: current load + expected full test load < maximum allowable load threshold (usually 70%-80%).

[0084] At this point, the execution strategy is as follows: Perform comprehensive offline testing, including a full word-length memory scan (March C+ algorithm), full functionality verification of peripheral loops, and deep self-testing of non-critical sensors. Low-priority application tasks can be temporarily suspended at this time.

[0085] B. Heavy Load Condition: System resources are strained. Deterministic execution of critical flight control tasks must be guaranteed, and excessive resource consumption by testing activities that could lead to task timeouts is strictly prohibited. Typical quantitative standards are as follows: CPU utilization: >60%-70% (approaching the worst-case execution time (WCET) warning line). Memory usage: >80%. I / O bus load: >60%. The judgment condition is: current load > high watermark, or prediction that executing full testing will cause critical tasks to miss their deadlines.

[0086] At this point, the execution strategy is as follows: Perform minimal online health monitoring. Only perform heartbeat checks, critical register parity checks, watchdog resets, and judgments on the reasonableness of critical sensor values. Prohibit time-consuming memory scans or complex algorithm tests.

[0087] C. Sudden Load Status: System load increases sharply within a short period (with a large slope), usually triggered by external events (such as a sudden change in attitude leading to a surge in control law calculations, or a sudden burst of communication data). Typical quantification standards are as follows: Load change rate: Within a unit time window (e.g., 10ms or 50ms), CPU utilization increases by >20%-30%. Instantaneous peak: Instantly exceeding 80%-90%, but with a short duration. Queue backlog: The depth of the interrupt request queue or message queue doubles within a short period.

[0088] At this point, the execution strategy is as follows: Perform enhanced dynamic response testing. Focus on monitoring system response latency and jitter. Test whether the interrupt response time meets worst-case requirements. Verify whether the system's behavior under overload protection mechanisms (such as load) meets expectations. Suspend all unnecessary background diagnostics and concentrate resources to ensure the stability of the control loop.

[0089] The sources of basis for civil aviation test design are as follows: A. Based on WCET (Worst-Case Execution Time): According to the timing attribute requirements of DO-178C, the load threshold should be set within the reserved margin. An example formula is: Heavy load threshold = Nominal maximum load × (1 - Safety margin). Typically, the safety margin is 20%-30%.

[0090] B. Based on the BITE tiered strategy (ARINC 600 / 604 concept): Civil aviation airborne equipment generally adopts a tiered BITE strategy: a. Power-on test: corresponding to light load or shutdown state, 100% coverage is performed. b. Periodic test: corresponding to light / medium load, polling is performed. c. Continuous monitoring: corresponding to heavy / burst load, only key parameters are monitored.

[0091] C. Platform-Specific Architecture (PSA) Based on Specific Models: For example, in Integrated Modular Avionics (IMA) systems (following the ARINC 653 standard), the load threshold for a partition is defined by the configuration table of the operating system kernel (such as VxWorks 653, PikeOS). The quantification criterion is the amount of Time Budget remaining when directly reading the partition.

[0092] In this embodiment, S23. The health-driven test is as follows: The controller chip with the monitoring function maintains historical health scores and dynamically adjusts the test intensity according to the scores: a score > 90 executes a regular test; a score between 70 and 90 executes an enhanced test; and a score < 70 executes a reinforced test.

[0093] The health score is based on the following criteria: the statistical deviation of real-time operating parameters from the baseline model, the number of historical failures and redundancy switching, the cumulative environmental stress damage based on the physical failure model, and the slope of the degradation trend of key performance parameters. These criteria are used to calculate a quantitative score of 0-100 using a weighted fusion algorithm.

[0094] The health score (0-100 points) is calculated based on the following four dimensions, with the weight of each dimension dynamically allocated according to the equipment's criticality (DAL level): a. Real-time parameter deviation: the statistical distance between the current operating parameters and the "golden benchmark". b. Historical fault and reconfiguration records: the number of past faults and the number of spare parts / redundancy channel switching times. c. Cumulative environmental stress damage: the lifespan consumption based on temperature, vibration, and electrical stress according to a physical model. d. Built-in test (BIT) confidence and coverage: the pass rate and ambiguity analysis of recent self-test results.

[0095] Table 4. Health Score Setting Table As shown in Table 4 above, the health score is a weighted fusion of the five core dimensions mentioned above, and each dimension has a clear measurement basis.

[0096] like Figure 9 As shown, the specific implementation of the S11. three-level test depth control strategy in this embodiment is as follows: Level 1: Rapid health check, with the shortest execution time (typically <100ms), includes: power supply voltage range check, clock signal presence check, communication link connectivity check, and critical temperature over-limit check. This level is suitable for high-load operation, checking only the most critical parameters to ensure minimal impact on main functions.

[0097] Level 2: Functional verification testing, with a moderate execution time (typically <1s), including: sensor calibration verification, driver circuit functional testing, protection logic verification, and storage integrity check.

[0098] This level applies to standby mode and comprehensively verifies the normal operation of each functional module.

[0099] Level 3: Comprehensive diagnostic testing, with the longest execution time (typically <10s), performed only during maintenance windows. This includes: full-range parameter scanning, dynamic response characteristic testing, environmental adaptability verification, and lifespan assessment testing. This level is suitable for ground maintenance mode, providing a comprehensive health assessment and lifespan prediction for the system.

[0100] The strategy for dynamically selecting the test depth in this embodiment is based on a multi-constraint optimization algorithm, as detailed below: (1) Time constraints Time constraints refer to the maximum execution time window that the system is allowed to occupy for a BIT, which depends on the current stage of system operation and the real-time requirements of the task. The time constraints are based on the following: referencing worst-case execution time (WCET) analysis and ARINC653 partition time slice remaining, to ensure that the test task does not affect the deadline of critical flight control loops. The specific quantitative basis is shown in Table 5 below.

[0101] Table 5. Quantification Basis for Time Constraints The specific quantitative reference values ​​are as follows: Control cycle = 100μs (10kHz switching frequency) → Single BIT slice ≤ 10μs; Control cycle = 500μs (2kHz switching frequency) → Single BIT slice ≤ 25μs; The total timeout for the power-on self-test is 200ms. The first-level test must be completed within 200ms.

[0102] (2) Resource constraints Resource constraints refer to the CPU utilization, bus bandwidth, and memory space currently available to be allocated to a BIT in the system. The monitoring chip needs to monitor the availability of these resources in real time. The resource constraints are based on the following: real-time monitoring of CPU load, bus bandwidth utilization, and junction temperature. When any indicator exceeds a preset high watermark (e.g., 80%), the test depth is automatically reduced to retain a safety margin.

[0103] Table 6. Quantitative Basis for Resource Constraints Resource monitoring methods are as follows: CPU utilization: obtained by the monitoring chip by reading the RTOS task statistics information from the control chip; Bus bandwidth: Calculated by monitoring the frame interval and load rate on the bus; Memory resources: Memory usage reports are periodically submitted by the control chip.

[0104] (3) Current health status The current health status is the health score defined in S23. The health status is based on a risk-sensitive strategy, combining the S23 health score and the S5 warning level: when the health is high, in-depth testing is performed to optimize the predictive model; when the health is low or there is an emergency warning, priority is given to ensuring system survivability, and only minimal health monitoring is performed. The quantitative basis for the current health status is shown in Table 7 below: Table 7. Quantitative Basis for Current Health Status Note: Health status has the highest priority in determining the depth of testing. Even if time and resource constraints allow for higher-level testing, if health is too low (e.g., <50 points), the system should prioritize protective measures rather than adding more tests.

[0105] The final selection of test depth is determined by a combination of three dimensions, and the following logic can be adopted, as shown in Table 8.

[0106] Table 8 Test Depth Decision Table In this embodiment, the controller chip with monitoring function dynamically selects the most suitable test depth based on the system's current time constraints, resource constraints, and health status, thereby achieving optimal test efficiency in different scenarios.

[0107] like Figure 10 As shown, the specific implementation of S4. predictive analysis in this embodiment is as follows: S41. Feature extraction sub-step: The controller chip with monitoring function performs feature engineering processing on the collected historical data to extract the long-term trend, first derivative rate of change, fluctuation pattern features and correlation features between parameters of key parameters. S42. Collaborative Prediction Sub-step: The controller chip with the monitoring function performs real-time feature calculation and simple linear prediction, while the controller chip with the control function performs complex model calculation and machine learning inference. The two work together to generate prediction results. S43. Trend Analysis Sub-step: The controller chip with the monitoring function compares the current parameters with historical trends to identify parameter drift and performance degradation patterns; S44. Life Prediction Sub-step: Based on parameter degradation drift and performance degradation trend, establish a remaining useful life prediction model.

[0108] like Figure 11 As shown, step S5. Graded early warning and handling in this embodiment includes: based on the parameter degradation trend, extrapolating and predicting the time when the parameter reaches the safety threshold, generating an estimate of the remaining available time, and outputting it according to the following three-level early warning mechanism: S51. Early Warning: When trend analysis indicates that the safety threshold may be exceeded within 90 days, record the warning information and recommend arranging preventive maintenance; S52. Mid-term warning: When trend analysis indicates that the safety threshold may be exceeded within 30 days, a warning signal is issued to the avionics system and the system operating parameters are adjusted to slow down the degradation. S53. Emergency Warning: When trend analysis indicates that the safety threshold may be exceeded within 3 days, take immediate protective measures, including reducing the operating limit, switching to the backup channel, or shutting down safely.

[0109] The above-mentioned security thresholds are set based on the following criteria: a. Airworthiness certification limits: based on the absolute operating limits (Hard Limits) defined in the Type Certificate (TC) and Flight Manual (AFM). b. System Safety Assessment (SSA) Conclusion: Based on the functional performance degradation threshold determined by Failure Mode and Effects Analysis (FMEA), ensure that a single failure will not lead to catastrophic consequences; c. Component derating criteria: Long-term reliability boundaries set according to the derating design specifications of avionics / mechanical components (such as derating to 60%-80% of the rated value); d. Statistical process control limits: Based on the distribution of historical fleet operation data, the statistical confidence interval boundaries are set as the mean plus or minus three standard deviations (3σ).

[0110] Specifically, the thresholds for early, mid-term, and emergency warnings are dynamic boundary values ​​obtained by subtracting the maximum predicted degradation and the uncertainty margin of the prediction model within the corresponding time windows (90 days, 30 days, and 3 days), from the aforementioned basic safety thresholds. Safety thresholds are not arbitrary numbers; they are a comprehensive product of regulatory red lines, physical limits, safety margins, and statistical laws. The 90-day threshold focuses on maintenance economy (don't wait until it breaks down to repair). The 30-day threshold focuses on mission reliability (don't let performance become insufficient mid-mission). The 3-day threshold focuses on flight safety (absolutely no accidents).

[0111] Table 9 Safety Threshold Setting Table The safety threshold should be divided into three levels, corresponding to early warning, mid-term warning and emergency warning respectively. The specific settings are shown in Table 9 above.

[0112] like Figure 12 As shown, the automated fault injection verification process in the safe state of this embodiment is as follows: The test triggering conditions are as follows: the system is in a safe idle state (such as ground maintenance mode) and obtains operator authorization.

[0113] The test execution process is as follows: S101. The controller chip with monitoring function selects the fault mode to be injected (sensor fault, communication fault, power fault or logic fault), generates an injection signal, and injects the fault into the specified monitoring point or sensor. S102. After confirming that the controller chip for the control function is ready, it enters the test mode to simulate the response to the injected fault; S103. The controller chip with the monitoring function verifies whether it can correctly detect the injected fault and verifies whether the controller chip with the control function can execute the correct protection action. After the test is completed, the dual controllers exit the test mode and return to normal operation.

[0114] The injectable fault types include: sensor faults (offset, jamming, noise), communication faults (delay, packet loss, misalignment), power supply faults (ripple, drop, overvoltage), and logic faults (state machine error, calculation error).

[0115] This fault injection verification, performed in a real-world operating environment, ensures that BIT coverage and monitoring protection functions remain effective, providing a health certificate for the BIT function itself. Compared to traditional BIT solutions, the fault detection time of this invention is reduced from 120ms to 28ms, a reduction of 76.7%; fault detection coverage is increased from 82% to 97%; and the false alarm rate is reduced from 8.5% to 1.2%, a reduction of 85.9%.

[0116] In this embodiment, the controller chip for monitoring and control functions can be an application-specific integrated circuit (ASIC), or it can be replaced with other programmable logic devices or processors, such as field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), system-on-a-chip (SoCs), microcontroller units (MCUs), digital signal processors (DSPs), etc., depending on design requirements, cost, and processing performance.

[0117] In this embodiment, the controller chip for monitoring and the controller chip for control can be implemented using FPGA chips from different design sources and with different architectures to reduce the risk of common-cause failures. The monitoring logic of the controller chip for monitoring is implemented in hardware, and its function cannot be tampered with or bypassed by the control-side software, ensuring the absolute reliability of the monitoring function.

[0118] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A self-testing method for an intelligent busbar power controller, characterized in that: Includes the following steps: S1. Dual-track asynchronous initialization steps: The controller chip with the monitoring function starts up first and enters the pre-monitoring state, while the controller chip with the control function starts up with a delay. The two exchange initialization states in real time through a dedicated initialization state channel and perform cross-verification. S2. Dynamic testing steps for state awareness: The controller chip with monitoring function dynamically selects and executes an appropriate test strategy according to the current stage of the system state machine. The current stage of the system state machine includes the initialization stage, standby stage, running stage, and fault handling stage. S3. Multi-source heterogeneous data acquisition steps: The controller chip with monitoring function acquires the internal signals of the controller chip with control function, the system state machine status, and timing path information through a dedicated monitoring bus. At the same time, it acquires voltage, temperature, and vibration physical parameters through independent sensor interfaces. S4. Predictive Analysis Steps: The controller chip with monitoring function performs feature extraction on the collected data, including long-term trend analysis, rate of change analysis, fluctuation pattern recognition and parameter correlation analysis, to generate a health score and trend prediction; S5. Tiered Early Warning and Response Steps: Based on the prediction results, the controller chip with the monitoring function takes corresponding actions according to the early warning level, which includes early warning, mid-term warning and emergency warning.

2. The intelligent busbar power controller internal self-testing method according to claim 1, characterized in that: The S1. dual-track asynchronous initialization step includes: S11. Upon power-up, the controller chip for the monitoring function is started first and immediately enters the pre-monitoring state to begin monitoring the initialization process of the controller chip for the control function; S12. The controller chip for the control function is delayed in starting, and its initialization process is supervised by a third party of the controller chip for the monitoring function, including monitoring the clock frequency, power-up timing, and key register initialization status. S13. After the controller chip for the control function is started, it sends initialization status information to the controller chip for the monitoring function through the dedicated initialization status channel; S14. The controller chip for the monitoring function verifies the initialization state of the controller chip for the control function, including key register value readback, clock frequency measurement, and memory integrity check; S15. The controller chip for the control function verifies the health status of the controller chip for the monitoring function, including monitoring algorithm parameter verification, sensor calibration data verification, and response time test. S16. After the controller chip for the monitoring function and the controller chip for the control function undergo bidirectional cross-verification and confirmation, the system enters normal working state.

3. The intelligent busbar power controller internal self-testing method according to claim 1, characterized in that: The dynamic testing steps of S2. State awareness include: environment awareness test, load awareness test and health-driven test; S21. The environmental perception test: The controller chip of the monitoring function dynamically adjusts the test frequency and test threshold based on the detected environmental temperature, vibration, and power supply quality parameters; specifically: a. Adjust the test frequency and threshold according to the temperature. When the temperature exceeds the first threshold, add high-temperature aging related test items. b. Adjust the test items according to the vibration intensity. When the vibration intensity exceeds the second threshold, add a mechanical connection integrity test. c. Adjust the testing strategy according to the power quality; when the power quality fluctuates, enhance the power integrity test. S22. The load awareness test: The controller chip of the monitoring function dynamically selects the test depth according to the system load; specifically: a. Perform comprehensive offline testing under light load conditions; b. Under heavy load, perform minimal online health monitoring; c. Enhance dynamic response testing under sudden load conditions; S23. The health-driven test: The controller chip of the monitoring function dynamically adjusts the test intensity based on historical health scores; specifically: a. When the health score is above 90, perform the standard test; b. When the health score is 70-90, perform the enhancement test; c. When the health score is below 70, an enhanced test will be performed.

4. The intelligent busbar power controller internal self-testing method according to claim 1, characterized in that: The S4. predictive analysis step includes: S41. Feature extraction sub-step: The controller chip of the monitoring function performs feature engineering processing on the collected historical data to extract the long-term trend, first derivative rate of change, fluctuation pattern features and correlation features between parameters of key parameters; S42. Collaborative prediction sub-step: The controller chip of the monitoring function performs real-time feature calculation and simple linear prediction, and the controller chip of the control function performs complex model calculation and machine learning inference. The two work together to generate prediction results. S43. Trend Analysis Sub-step: The controller chip of the monitoring function compares the current parameters with historical trends to identify parameter drift and performance degradation patterns; S44. Life Prediction Sub-step: Based on parameter degradation drift and performance degradation trend, establish a remaining useful life prediction model.

5. The intelligent busbar power controller internal self-testing method according to claim 4, characterized in that: The S5. Tiered early warning and response steps include: S51. Early Warning: When trend analysis indicates that the safety threshold may be exceeded within 90 days, record the warning information and recommend arranging preventive maintenance; S52. Mid-term warning: When trend analysis shows that the safety threshold may be exceeded within 30 days, a warning signal is issued to the system, and the system operating parameters are adjusted to slow down the degradation; S53. Emergency Warning: When trend analysis indicates that the safety threshold may be exceeded within 3 days, take immediate protective measures, including reducing the operating limit, switching to the backup channel, or shutting down safely.

6. The intelligent busbar power controller internal self-testing method according to claim 1, characterized in that: It also includes S6. Equipment self-fault detection steps and S7. Equipment system fault diagnosis steps; The S6. Equipment self-fault detection step is implemented using the following BIT technology: a. Faults in discrete quantity acquisition circuits and analog quantity acquisition circuits: Excitation retrieval technology is used, and the excitation signal is output by the multiplexed functional circuit. The correctness of the output is determined by the retrieval path. b. Drive circuit failure: Use the surround BIT technology to trace the output signal back to the input terminal to verify the integrity of the signal path; c. Power supply circuit fault: Analog bit technology is used to monitor the circuit status through sensors, and the results are analyzed by the controller chip with monitoring function after A / D conversion. d. Communication circuit fault: Employ coding error detection technology and use error correction codes to verify data correctness; The S7. Fault diagnosis steps of the equipment for the system: The status of the surrounding equipment is collected by the hardware, including voltage, current, switches and contactor auxiliary contacts, and communication information is received. The controller chip with monitoring function performs logical combination to report the fault.

7. The intelligent busbar power controller internal self-testing method according to claim 6, characterized in that: It also includes S8. Power-on self-test step and S9. Continuous self-test step: S8. Power-on self-test step: This step is performed when the system is powered on. It uses BIT technology to detect circuit faults in the equipment itself, and the test results are uploaded to the avionics indication system through the communication system. The S9. Continuous self-testing step is executed continuously during system operation to detect power distribution system faults. The test results are used to trigger the control and protection functions of the equipment and are uploaded to the avionics indication system to protect other equipment and components in the power distribution system from damage.

8. The intelligent busbar power controller internal self-testing method according to claim 1, characterized in that: It also includes S10. Automated fault injection verification step, which is executed after the system is in a safe idle state and operator authorization is obtained: S101. The controller chip of the monitoring function selects the fault mode to be injected, generates an injection signal, and injects the fault into the designated monitoring point or sensor; wherein, the injectable fault types include: sensor fault, communication fault, power supply fault, and logic fault. S102. After confirming that the controller chip of the control function is ready, it enters the test mode to simulate the response to the injected fault; S103. The controller chip of the monitoring function verifies whether it can correctly detect the injected fault and verifies whether the controller chip of the control function can perform the correct protection action.

9. The intelligent busbar power controller internal self-testing method according to claim 1, characterized in that: It also includes the S11. Level 3 test depth step, whose control strategy is as follows: Level 1: Rapid health check, execution time less than 100 milliseconds, including: power supply voltage range check, clock signal presence check, communication link connectivity check, and critical temperature over-limit check; Level 2: Functional verification test, execution time less than 1 second, including: sensor calibration verification, drive circuit function test, protection logic verification and storage integrity check; Level 3: Comprehensive diagnostic test, execution time less than 10 seconds, performed only in the maintenance window, including full range parameter scanning, dynamic response characteristic test, environmental adaptability verification and life assessment test; The testing depth is dynamically selected based on system time constraints, resource constraints, and current health status.

10. An intelligent busbar power controller, used to implement the internal self-detection method of the intelligent busbar power controller according to any one of claims 1-9, characterized in that: include: A controller chip with control functions, which is used to execute the main functional logic of the busbar power controller, and includes power distribution, switching, monitoring and protection functions; The monitoring controller chip is physically independent of the control controller chip, and is powered by an independent power rail and an independent clock source. The monitoring controller chip is used to monitor the operating status of the control controller chip and perform BIT operations. A dedicated monitoring bus is provided, which connects the controller chip for the control function and the controller chip for the monitoring function. The dedicated monitoring bus is used to achieve low-latency and high-reliability status exchange and data interaction. An independent sensor interface is provided, which is connected to the controller chip of the monitoring function. The independent sensor interface is used to collect the voltage, temperature, and vibration physical parameters of the controller chip of the control function through an independent sensor. The hardware timestamp unit is integrated into the controller chip of the monitoring function to provide a time reference for nanosecond-level synchronization and support accurate time series analysis.

Images