An automated method and system for identifying independence requirements in common mode analysis

Abstract

The application provides an automatic identification method and system for common mode analysis independence requirements, and relates to the field of flight control system safety analysis, comprising: deriving minimal cut set data from a fault tree model; screening the minimal cut set data according to a preset screening principle, wherein the preset screening principle comprises: taking, in all minimal cut sets, minimal cut sets with any two bottom events corresponding to the same type of device as a first screening result; taking, in all minimal cut sets, minimal cut sets with any two bottom events corresponding to adjacent devices on the same preset control link as a second screening result; generating a first independence requirement according to the first screening result, and generating a second independence requirement according to the second screening result. The application converts the subjective principle of manual extraction into an objective code principle from the minimal cut set, thereby realizing the automatic generation of common mode independence requirements from the minimal cut set, and improving the common mode analysis efficiency and accuracy.

Description

Technical Field

[0001] This invention relates to the field of flight control system safety analysis technology, specifically to an automated identification method and system for independence requirements in common mode analysis. Background Technology

[0002] With the increasing diversification of functions and the gradual complexity of structures in modern civil aircraft avionics systems, the complexity and integration of aircraft systems are constantly improving, leading to increasingly higher requirements for safety analysis methods. The flight control system (hereinafter referred to as the flight control system) plays a core role in the entire aircraft and is one of the most complex and highly integrated systems. Its function is to ensure the stability and operability of the aircraft during flight. However, with the iterative updates of redundant architectures, common mode failures are introduced, meaning that two or more channels fail in the same way, resulting in the same fault outcome and the same failure mode. Various common mode failures can undermine the assumption of redundancy independence in the system, causing originally assumed independent devices to fail in the same mode, thus becoming a single failure. This single failure can trigger catastrophic failures, causing unacceptable consequences.

[0003] Common-mode analysis (CMA) is used to analyze faults affecting multiple redundant channels, identify the correlations and interactions between components in a redundant system, and thus reveal the root causes of common-mode failures. In system design and evaluation, engineers typically use methods such as fault tree analysis (FTA) and event tree analysis (ETA) to assess common-mode failures and take appropriate measures to reduce their likelihood.

[0004] In common-mode analysis of civil aircraft avionics systems, common-mode independence requirements are typically obtained by building a fault tree model, observing AND gates in the fault tree, and analyzing minimal cut sets (MCS). The traditional method for determining independence requirements through minimal cut sets involves deriving the minimal cut sets that lead to catastrophic and harmful consequences, and then extracting independence requirements from the second- and third-order minimal cut sets. Safety engineers primarily rely on engineering experience to determine whether elements in the cut sets should be independent; if so, they are considered independent requirements; otherwise, they are not. This technique is overly dependent on human experience, time-consuming, and yields subjective results.

[0005] Therefore, existing methods are time-consuming and labor-intensive, and require a high level of expertise and engineering experience from analysts. As the architecture design changes, the fault tree also changes accordingly, and the analysis of independent requirements must be carried out simultaneously, resulting in a huge workload and making it impossible to automate the analysis or iterate versions. Summary of the Invention

[0006] In view of this, embodiments of this application provide an automated identification method and system for independence requirements in common mode analysis. Starting from the minimum cut set, this invention transforms the subjective principles extracted manually into objective code principles, thereby enabling the automatic generation of common mode independence requirements from the minimum cut set. At the same time, a mapping relationship with the fault tree is established. When the fault tree changes, the independence requirements are automatically updated, improving the efficiency and accuracy of common mode analysis.

[0007] This application provides the following technical solution: an automated method for identifying independence requirements in common mode analysis, comprising the following steps:

[0008] Step 1: Derive the minimum cut set data from the fault tree model. The minimum cut set data includes at least the order of each minimum cut set and the bottom event identifier and bottom event description that constitute each minimum cut set. Step 2: Filter the minimum cut set data according to preset filtering principles, which include: First screening rule: In all minimum cut sets, the minimum cut set that corresponds to any two bottom events and the same type of device is taken as the first screening result; Second screening rule: In all minimum cut sets, the minimum cut sets of any two bottom events corresponding to adjacent devices on the same preset control link are taken as the second screening result; Step 3: Based on the first screening result, generate a first independence requirement to indicate that different physical entities of the same type of device should maintain independence, and based on the second screening result, generate a second independence requirement to indicate that different adjacent devices on the same preset control link should maintain independence.

[0009] According to one embodiment of this application, in step one, the fault tree model is a set fault tree model of type I top events and type II top events, which is constructed by connecting type I top events and type II top events through an OR gate; the minimum cut set data is exported as an Excel spreadsheet using the export function of Isograph software.

[0010] According to one embodiment of this application, the preset screening rule further includes a third screening rule: based on a preset list of weak link devices, the minimum cut set containing any device in the list of weak link devices is taken as the third screening result; the third step further includes: generating a third independence requirement based on the third screening result to indicate that the weak link device should maintain independence from other devices in the same minimum cut set.

[0011] According to one embodiment of this application, in step two, when filtering the minimal cut set data, only the minimal cut sets with order two and three are filtered.

[0012] According to one embodiment of this application, step three, when generating the first independence requirement based on the first screening result, includes: Extract the device name corresponding to the bottom event of each minimum cut set in the first filtering result; Determine whether the underlying event descriptions of each minimal cut set involve the internal board level of the device; If the underlying event description does not involve the internal board level of the device, a first type of sub-requirement is generated to indicate that different physical entities of the same type of device should remain independent; If the underlying event description involves the internal board level of the device, a second type of sub-requirement is generated to indicate that different functional units within the same type of device should remain independent.

[0013] According to one embodiment of this application, determining whether the bottom event description of each minimal cut set involves the internal board level of the device is achieved using a few-sample hint field extraction method based on a large model, specifically including: The goal of the field extraction task is defined as extracting an identifier field from the underlying event description indicating whether it involves the board level, and defining a structured output format. Select a preset number of labeled minimum cut set samples, and construct an "input-output" example pair by combining the base event description of each sample with the corresponding board level judgment result; The task instructions, the example pairs, the description text of the underlying events to be processed, and the output format constraints are integrated into a unified prompt word; The unified prompt word is input into a pre-trained large language model to obtain the structured field extraction results of the model output. Based on the extraction results, it is determined whether the underlying event description involves the internal board level of the device.

[0014] According to one embodiment of this application, when generating the second independence requirement based on the second screening result, the device names corresponding to two adjacent bottom events within each minimum cut set in the second screening result are extracted to generate an independence requirement for indicating that different adjacent devices on the same preset control link should maintain independence.

[0015] According to one embodiment of this application, the preset control link is the pitch control signal link of the flight control system, and the pitch control signal link sequentially includes cockpit sensors, actuation control unit, flight control computer, remote electronic module and power control unit.

[0016] According to one embodiment of this application, the method further includes: establishing a mapping relationship between each minimal cut set in the minimal cut set data and each independent requirement generated in step three; when the fault tree model is updated, re-executing step one and step two to obtain the updated minimal cut set data, and automatically updating the generated independent requirements according to the mapping relationship.

[0017] This application also provides an automated identification system for independence requirements in common mode analysis, including: The minimum cut set derivation module is used to derive minimum cut set data from the fault tree model. The minimum cut set data includes at least the order of each minimum cut set and the bottom event identifier and bottom event description that constitute each minimum cut set. The filtering module is used to filter the minimum cut set data according to a preset filtering principle, which includes: taking the minimum cut set of any two bottom events corresponding to the same type of device in all minimum cut sets as the first filtering result; and taking the minimum cut set of any two bottom events corresponding to adjacent devices on the same preset control link in all minimum cut sets as the second filtering result. An independence requirement generation module is used to generate a first independence requirement based on the first screening result, indicating that different physical entities of the same type of equipment should maintain independence, and to generate a second independence requirement based on the second screening result, indicating that different adjacent devices on the same preset control link should maintain independence.

[0018] Compared with the prior art, the beneficial effects that at least one technical solution adopted in the embodiments of this specification can achieve include at least: 1. Traditional methods for manually extracting independence requirements based on minimal cut sets are labor-intensive, time-consuming, and yield inaccurate results when dealing with thousands of minimal cut sets. This invention utilizes VB code to automatically filter minimal cut sets, significantly reducing workload and shortening analysis time.

[0019] 2. Traditional methods heavily rely on the personal experience and subjective judgment of security engineers, which can easily lead to biased results. This invention transforms manually extracted subjective principles into objective code principles, and automates the screening process using preset filtering principles, ensuring the objectivity and consistency of the screening results.

[0020] 3. This invention establishes a mapping relationship between the minimum cut set and the independence requirement. When the fault tree is updated due to changes in the architecture design, the minimum cut set is updated accordingly, and the independence requirement is automatically updated synchronously, realizing the automation of common mode analysis and version iteration.

[0021] 4. Security engineers only need to check the final selected independent requirements, without having to manually analyze thousands of minimal cut sets one by one. This ensures both the accuracy and completeness of the requirements and effectively improves the efficiency of common mode analysis. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of an automated identification method for independence requirements in common mode analysis according to the present invention. Detailed Implementation

[0024] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0025] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] This invention provides an automated method for identifying independence requirements in common-mode analysis, such as... Figure 1As shown, the minimum cut sets are derived from the fault tree model, VB code is written to filter them according to the selection principles, and finally, independence requirements are automatically extracted from the selected minimum cut sets. The technical solution of this invention mainly consists of three steps: First, the minimum cut sets of first and second-class top events are exported to an Excel spreadsheet using Isograph software. The minimum cut set spreadsheet must include the order, bottom event ID, and bottom event description. Then, the selection principles are implemented using VB code. If elements of the same component appear in the minimum cut set, this minimum cut set is selected and used as a library for extracting independence requirements. Similarly, if elements of components on the same control chain appear in the minimum cut set, this minimum cut set is selected and used as a library for extracting independence requirements. Adjacent components in the same control chain refer to multiple components through which a control signal in the flight control system passes. For example, the pitch control signal is sent from the cockpit sensors to the Actuator Control Unit (ACU). The ACU processes the signal and sends it to the Flight Control Computer (FCC). The FCC calculates the control law, generates a control signal, and sends it back to the ACU. Subsequently, it is sent to the Remote Electronic Module (REM), which drives the Power Control Unit (PCU) to deflect the control surfaces. The control chain for the pitch control signal is cockpit sensor-ACU-FCC-ACU-REM-PCU. The independence requirement for common mode analysis is generally performed on adjacent components. Secondly, second-order and third-order minimal cut sets are used to filter and obtain a library of independence requirements. Subsequently, the requirement of "independence between identical components" is extracted for the same components, and the requirement of "independence between adjacent components" is extracted for adjacent components in the same control chain. Safety engineers can refine the requirements based on the description. Finally, a mapping relationship is established between the minimum cut set table and the independence requirement. When the fault tree is updated, the minimum cut set is updated accordingly, and the independence requirement is also updated automatically.

[0027] The specific implementation of this invention mainly consists of the following three steps: Step 1: Derive the minimum cut set data from the fault tree model. The minimum cut set data includes at least the order of each minimum cut set and the bottom event identifier and bottom event description that constitute each minimum cut set. The fault tree model is a set of first-class and second-class top events, which is constructed by connecting the first-class and second-class top events through an OR gate; the minimum cut set data is exported as an Excel spreadsheet using the export function of Isograph software.

[0028] Specifically, the three-axis top-event fault tree model includes top events of types I, II, and III. However, in actual common-mode analysis, only top events of types I and II need to be considered, while the influence of top events of type III is very low and can be ignored. First, a new top event is created, and all top events of types I and II are connected by an OR gate. At this point, the minimal cut set is the set of cut sets of top events of types I and II. Then, the Import function of Isograph software is used to export an Excel spreadsheet of Gate Cut Sets. The headers are Number, CutSetID, CutSetDescr, and Order, which represent the minimal cut set index, cut set element ID, cut set element description, and cut set order, respectively.

[0029] Common-mode analysis, based on a common-mode list, analyzes all minimal cut sets of the fault tree. Each minimal cut set contains two or more events, requiring pairwise analysis to ensure their independence. Minimal cut set analysis exhaustively enumerates all possible failure combinations, thus avoiding omissions. In common-mode analysis, for catastrophic or hazardous events, the second- and third-order minimal cut sets of the fault tree are typically analyzed, while higher-order minimal cut sets are not considered initially. Therefore, the minimal cut sets need to be filtered using the Order method to identify second- and third-order minimal cut sets, reducing workload for subsequent independence requirements.

[0030] Step 2: Filter the minimum cut set data according to preset filtering principles, which include: First screening rule: In all minimum cut sets, the minimum cut set that corresponds to any two bottom events and the same type of device is taken as the first screening result; The second screening rule is to select the minimum cut set of any two bottom events corresponding to adjacent devices on the same preset control link from all minimum cut sets as the second screening result.

[0031] The third screening rule is as follows: Based on the preset list of weak link equipment, the minimum cut set containing any equipment in the list of weak link equipment is used as the third screening result.

[0032] Specifically, common-mode failure occurs when two or more channels fail in the same way, resulting in the same fault outcome and exhibiting the same fault mode. Various types of common-mode failures undermine the assumption of redundancy independence in the system, causing formerly independent devices to fail in the same mode, thus becoming a single fault. This single fault can trigger catastrophic failures, leading to unacceptable consequences. Redundancy architecture failure is a major source of common-mode failures. Therefore, the first minimum cutset element selection principle is to select cutsets containing devices of the same type. For example, minimum cutset 1 consists of "ACU1 loss," "ACU2 loss," and "ACU3 loss," while minimum cutset 2 consists of "ACU1 monitoring tributary failure" and "ACU1 command tributary failure." Both of these cutsets involve devices of the same type, have common-mode risk, and need to be selected to extract independence requirements.

[0033] The flight control system is primarily responsible for receiving signals from external sensors, which are then processed by the flight control computer to calculate control laws and generate control surface signals, ultimately driving the control surfaces to complete the deflection. The flight control system can only achieve normal control of the control surfaces if all devices on the control link are functioning properly. When a device on a control link fails, the severity of the damage is relatively low due to the redundancy architecture. However, when multiple devices on a control link fail simultaneously due to common mode, the severity of the damage increases significantly, potentially leading to catastrophic consequences. Because the flight control system has a monitor that monitors the signals, the impact of failures in adjacent devices on the control link is greatest. Therefore, the second minimum cut set selection principle is to select all cut sets containing adjacent devices on the same control link. For example, if the flight control system's pitch control signal link is cockpit sensor-ACU-FCC-ACU-REM-PCU, then the minimum cut sets containing {cockpit sensor, ACU}, {ACU, FCC}, {ACU, REM}, and {REM, PCU} need to be selected.

[0034] Besides the significant impact of common-mode failures on control chain equipment, other aspects of the flight control system, such as power supply and hydraulics, can also lead to catastrophic consequences. Therefore, the third screening principle is the safety engineer's experience with vulnerable components. When multiple electronic devices share a single power supply, a power supply failure can lead to common-mode failures across these devices. For example, if the Power Transition Unit (PTU) supplies power to devices like the ACU and FCC, then the minimum cut set containing {PCM, ACU} and {PCM, FCC} carries a common-mode risk and needs to be screened out. Similarly, when multiple mechanical and hydraulic devices share a single hydraulic source, a hydraulic source failure can lead to common-mode failures across these devices. This invention supports safety engineers in developing principles based on experience (such as identifying two devices with a high common-mode risk) to ensure the completeness of the minimum cut set selection results.

[0035] Step 3: Based on the first screening result, generate a first independence requirement to indicate that different physical entities of the same type of equipment should maintain independence; based on the second screening result, generate a second independence requirement to indicate that different adjacent devices on the same preset control link should maintain independence; based on the third screening result, generate a third independence requirement to indicate that the weak link device should maintain independence from the other devices in the same minimum cut set.

[0036] In this step, when generating the first independence requirement based on the first screening result, the process includes: extracting the device name corresponding to the bottom event in each minimal cut set in the first screening result; determining whether the bottom event description of each minimal cut set involves the internal board level of the device; if the bottom event description does not involve the internal board level of the device, generating a first type of sub-requirement to indicate that different physical entities of the same type of device should maintain independence; if the bottom event description involves the internal board level of the device, generating a second type of sub-requirement to indicate that different functional units within the same type of device should maintain independence.

[0037] The determination of whether the underlying event descriptions of each minimal cutset involve the internal board level of the device is achieved using a few-sample prompt field extraction method based on a large model. Specifically, this includes: defining the objective of the field extraction task as extracting an identifier field from the underlying event description indicating whether it involves the board level, and defining a structured output format; selecting a preset number of labeled minimal cutset samples, constructing an "input-output" example pair by combining the underlying event description of each sample with the corresponding board level determination result; integrating the task instruction, the example pair, the underlying event description text to be processed, and the output format constraints into a unified prompt word; inputting the unified prompt word into a pre-trained large language model, obtaining the structured field extraction result output by the model, and determining whether the underlying event description involves the internal board level of the device based on the extraction result.

[0038] In this step, when generating the second independence requirement based on the second screening result, the device names corresponding to two adjacent bottom events within each minimum cut set in the second screening result are extracted to generate an independence requirement that indicates that different adjacent devices on the same preset control link should maintain independence.

[0039] The preset control link is the pitch control signal link of the flight control system, which includes, in sequence, cockpit sensors, actuation control unit, flight control computer, remote electronic module and power control unit.

[0040] This step involves automatically extracting independence requirements based on the descriptions of the cutset elements after the minimum cutsets have been selected. Different methods are used to extract independence requirements from the minimum cutsets extracted according to different principles.

[0041] Specifically, for the smallest cut set selected based on the same device principle, the device name in the cut set element needs to be extracted first. Then, it is necessary to determine whether the fault description involves the internal board level of the device. For example, the fault "ACU1 lost" does not involve the internal board level of the device, while the fault "ACU1 COM auxiliary board FPGA output error" involves the FPGA board of the ACU1 instruction branch. Finally, different independence requirements are extracted. If the fault description does not involve it, the extracted independence requirement is "devices should be independent" (a first-class sub-requirement used to indicate that different physical entities of the same type of equipment should remain independent). For example, if the minimum cut set is {ACU1 lost, ACU2 lost}, the extracted independence requirement is "ACUs should be independent". If the fault involves the internal board level of the equipment, the extracted independence requirement is "modules within the equipment should be independent" (a second-class sub-requirement used to indicate that different functional units within the same type of equipment should remain independent). For example, if the minimum cut set is {ACU1-COM auxiliary board output signal error, ACU1-MON core board output signal error}, the extracted independence requirement is "the COM branch and MON branch of the ACU should be independent".

[0042] To determine whether the fault description involves the internal board level of the device, this invention employs a data segment extraction method based on a large model (LLM). Few-shot prompting-driven large model field extraction refers to a method that, given only k labeled examples, guides the large language model (LLM) to understand the goal, field definitions, and output format of the field extraction task by constructing structured prompt words, directly extracting predefined target fields from unstructured text and outputting structured results. This method requires no parameter fine-tuning of the large model, achieving low-data-cost and high-generalization field extraction solely through prompt engineering. The specific method is as follows: (1) Definition of Task and Field System First, clearly define the core objectives of field extraction and the structured output paradigm to provide the model with clear task boundaries. Define the domain, text type, and data characteristics of the text to be processed; organize the set of target fields to be extracted, defining the semantic boundaries, data type, and value rules for each field to form structured fields. Specify the model output format, clarifying rules such as "filling in empty values ​​when there is no corresponding field" and "field values ​​strictly matching the original text" to avoid the model outputting unstructured or ambiguous content.

[0043] (2) Construction of small sample examples Examples are the core of few-sample hints and must meet the principles of "representativeness, consistency, and simplicity." The steps are as follows: 1) Example Labeling: Small-sample labeling is performed on the selected minimal cutsets of the same device. Based on the experience of security engineers, some minimal cutsets are separated to extract independence requirements. For example, the independence requirement for minimal cutsets such as {ACU1 COM core board common partition FPGA output error, ACU1-MON core board common partition CPRE FPGA monitor not working}, {ACU1 COM core board common partition FPGA output error, ACU1-MON core board power supply discrete output error}, and {ACU1 COM core board common partition FPGA output error, ACU1 MON core board common partition FPGA output error} is "The COM branch and MON branch of ACU should be independent". The independence requirement for minimal cutsets such as {ACU1 lost, ACU2 lost}, {ACU1 lost, ACU2 MON core board common partition FPGA output error}, and {ACU1 COM core board common partition FPGA output error, ACU2 lost} is "ACUs should be independent". The same principle applies to other devices. Requirements involving the internal board level are one type of requirement, while those not involving the internal board level are another type of requirement.

[0044] 2) Structuring Examples: Organize the labeled text-field pairs into example pairs of "input text → output result". The examples should be concise and free of redundancy to avoid irrelevant information interfering with the model's understanding.

[0045] (3) Prompt word engineering design The task instructions, few sample examples, text to be processed, and output constraints are integrated into a unified prompt word. The core structure follows the logic of "instruction → example → text to be processed → output requirements".

[0046] Pre-commands: Clearly define the task objective using concise natural language, and specify the requirement to extract independence from the minimum cut set; Example embedding: Embed the prompt words with examples constructed from small samples in a one-to-one correspondence between "input and output", with the number of examples controlled to 10; Placeholder text for processing: Reserve the input space for the text to be extracted to ensure that the text is complete and untrunculated; Output constraint reinforcement: Repeatedly emphasize the output format rules to reduce the probability of incorrect model output format.

[0047] (4) Model training and result generation Input the complete prompt words, filled with the text to be processed, into the large model, and call the model's text generation interface. Based on the instructions and examples in the prompt words, the model understands the field extraction rules, locates and extracts the target fields from the text to be processed, and outputs a structured result that conforms to the preset format. Record the model output results and retain the correspondence between the original input text and the output results.

[0048] For the minimum cut set selected based on the principle of adjacent devices on the same control link, only the names of different devices in the cut set elements need to be extracted, and the independence requirement extracted is "adjacent devices should be independent". For example, if the minimum cut set is {FCC1 lost, ACU1 lost}, {FCC1-IO board ISB transmitter module output error, ACU1-COM core board normal mode partition FPGA execution monitor not working}, the independence requirement extracted is "FCC1 and ACU1 should be independent".

[0049] For the minimum cut set selected by the safety engineer based on the principle of weak link devices, the description of the weak link devices in the cut set elements needs to be extracted, and the independence requirement extracted is "weak link devices should be independent of each other". For example, if the minimum cut set is "PTU1 loses DC1 input power supply, ACU3 loses power", the independence requirement extracted is "PTU1 and ACU3 should be independent of each other".

[0050] The embodiments of the present invention further include: establishing a mapping relationship between each minimal cut set in the minimal cut set data and each independent requirement generated in step three; when the fault tree model is updated, re-execute steps one and two to obtain the updated minimal cut set data, and automatically update the generated independent requirements according to the mapping relationship.

[0051] This invention analyzes the partial minimal cut sets of top events of types I and II in a flight control system as an example, filters according to screening principles, and finally extracts the corresponding common-mode independence requirements, as shown in Table 1.

[0052] Table 1: Minimal Cut Sets of Top Events of Types I and II (Partial)

[0053] The minimum cut sets selected based on the principle of identical equipment are Number 1, 2, 5, and 6; the minimum cut sets selected based on the principle of adjacent equipment in the same control chain are Number 3 and 10; and the minimum cut set selected based on the principle of weak link equipment is Number 8. The resulting independence requirement table is shown in Table 2.

[0054] Table 2: Independence Requirements Table

[0055] This invention also provides an automated identification system for independence requirements in common mode analysis, comprising: The minimum cut set export module is used to export minimum cut set data from the fault tree model. The minimum cut set data includes at least the order of each minimum cut set and the bottom event identifier and bottom event description that constitute each minimum cut set. The filtering module is used to filter the minimum cut set data according to a preset filtering principle. The preset filtering principle includes: taking the minimum cut set in all minimum cut sets where any two bottom events correspond to the same type of device as the first filtering result; and taking the minimum cut set in all minimum cut sets where any two bottom events correspond to adjacent devices on the same preset control link as the second filtering result. An independence requirement generation module is used to generate a first independence requirement based on the first screening result, indicating that different physical entities of the same type of device should maintain independence, and to generate a second independence requirement based on the second screening result, indicating that different adjacent devices on the same preset control link should maintain independence.

[0056] The independence requirement generation module includes: a device name extraction unit, used to extract the device name corresponding to the bottom event within each minimum cut set in the screening results; a board level judgment unit, used to determine whether the bottom event description involves the internal board level of the device based on the few-sample hint field extraction method of the large model; and a requirement extraction unit, used to generate the corresponding independence requirement based on the output results of the device name extraction unit and the board level judgment unit.

[0057] This invention addresses the shortcomings of existing methods for obtaining independence requirements using minimal cut sets, which are time-consuming and labor-intensive. It proposes an automated method for identifying common-mode independence requirements, which significantly shortens the analysis time, improves the analysis accuracy, and allows the independence requirements to be updated along with the fault tree.

[0058] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An automated method for identifying independence requirements in common-mode analysis, characterized in that, Includes the following steps: Step 1: Derive the minimum cut set data from the fault tree model. The minimum cut set data includes at least the order of each minimum cut set and the bottom event identifier and bottom event description that constitute each minimum cut set. Step 2: Filter the minimum cut set data according to preset filtering principles, which include: First screening rule: In all minimum cut sets, the minimum cut set that corresponds to any two bottom events and the same type of device is taken as the first screening result; Second screening rule: In all minimum cut sets, the minimum cut sets of any two bottom events corresponding to adjacent devices on the same preset control link are taken as the second screening result; Step 3: Based on the first screening result, generate a first independence requirement to indicate that different physical entities of the same type of device should maintain independence, and based on the second screening result, generate a second independence requirement to indicate that different adjacent devices on the same preset control link should maintain independence.

2. The automated identification method for independence requirements in common-mode analysis according to claim 1, characterized in that, In step one, the fault tree model is a set fault tree model of type I top events and type II top events, which is constructed by connecting type I top events and type II top events through an OR gate; the minimum cut set data is exported as an Excel spreadsheet using the export function of Isograph software.

3. The automated identification method for independence requirements in common-mode analysis according to claim 1, characterized in that, The preset screening rules also include a third screening rule: based on the preset list of weak link equipment, the minimum cut set containing any equipment in the list of weak link equipment is taken as the third screening result; step three also includes: generating a third independence requirement based on the third screening result to indicate that the weak link equipment should maintain independence from other equipment in the same minimum cut set.

4. The automated identification method for independence requirements in common-mode analysis according to claim 1, characterized in that, In step two, when filtering the minimal cut set data, only minimal cut sets of order two and three are filtered.

5. The automated identification method for independence requirements in common-mode analysis according to claim 1, characterized in that, In step three, when generating the first independence requirement based on the first screening result, the following steps are included: Extract the device name corresponding to the bottom event of each minimum cut set in the first filtering result; Determine whether the underlying event descriptions of each minimal cut set involve the internal board level of the device; If the underlying event description does not involve the internal board level of the device, a first type of sub-requirement is generated to indicate that different physical entities of the same type of device should remain independent; If the underlying event description involves the internal board level of the device, a second type of sub-requirement is generated to indicate that different functional units within the same type of device should remain independent.

6. The automated identification method for independence requirements in common-mode analysis according to claim 5, characterized in that, To determine whether the underlying event descriptions of each minimal cut set involve internal board levels, a few-sample hint field extraction method based on a large model is used, specifically including: The goal of the field extraction task is defined as extracting an identifier field from the underlying event description indicating whether it involves the board level, and defining a structured output format. Select a preset number of labeled minimum cut set samples, and construct an "input-output" example pair by combining the base event description of each sample with the corresponding board level judgment result; The task instructions, the example pairs, the description text of the underlying events to be processed, and the output format constraints are integrated into a unified prompt word; The unified prompt word is input into a pre-trained large language model to obtain the structured field extraction results of the model output. Based on the extraction results, it is determined whether the underlying event description involves the internal board level of the device.

7. The automated identification method for independence requirements in common-mode analysis according to claim 1, characterized in that, When generating the second independence requirement based on the second screening result, the device names corresponding to two adjacent bottom events within each minimum cut set in the second screening result are extracted to generate an independence requirement that indicates that different adjacent devices on the same preset control link should maintain independence.

8. The automated identification method for independence requirements in common-mode analysis according to claim 1, characterized in that, The preset control link is the pitch control signal link of the flight control system, which includes, in sequence, cockpit sensors, actuation control unit, flight control computer, remote electronic module and power control unit.

9. The automated identification method for independence requirements in common-mode analysis according to claim 1, characterized in that, It also includes: establishing a mapping relationship between each minimal cut set in the minimal cut set data and each independent requirement generated in step three; when the fault tree model is updated, re-execute steps one and two to obtain the updated minimal cut set data, and automatically update the generated independent requirements according to the mapping relationship.

10. An automated identification system for independence requirements in common-mode analysis, characterized in that, include: The minimum cut set derivation module is used to derive minimum cut set data from the fault tree model. The minimum cut set data includes at least the order of each minimum cut set and the bottom event identifier and bottom event description that constitute each minimum cut set. The filtering module is used to filter the minimum cut set data according to a preset filtering principle, which includes: taking the minimum cut set of any two bottom events corresponding to the same type of device in all minimum cut sets as the first filtering result; and taking the minimum cut set of any two bottom events corresponding to adjacent devices on the same preset control link in all minimum cut sets as the second filtering result. An independence requirement generation module is used to generate a first independence requirement based on the first screening result, indicating that different physical entities of the same type of equipment should maintain independence, and to generate a second independence requirement based on the second screening result, indicating that different adjacent devices on the same preset control link should maintain independence.

Images