A reference time definition method and system based on integrated modular avionics system

Abstract

The application relates to the field of airborne avionics technology and discloses a reference time definition method and system based on an integrated modular avionics system. The application receives bus time messages periodically output by a flight tube and completes protocol conversion; validity verification is carried out on the converted time messages, and the message validity and time source update authority are determined step by step, and if there is no valid data source at any link, a local clock self-checking calibration is started; the local real-time clock is synchronously refreshed according to the hardware capacity, and if the hardware is abnormal, a fault is reported and a null message is output. The application periodically monitors the precision of the local clock, collects redundant clock data of multiple cabinets when the precision exceeds a threshold, optimally completes clock correction, and externally publishes the time when the precision reaches the standard, so that the avionics reference time is continuously controlled through cyclic iteration. The application relies on a multi-source verification and multi-cabinet redundant correction mechanism to ensure that the avionics system reference time is stable and accurate.

Description

Technical Field

[0001] This invention relates to the field of airborne avionics technology, specifically to a reference time definition method and system based on an integrated modular avionics system. Background Technology

[0002] The IMA platform is a system that implements a comprehensive and modular avionics architecture, providing common computing, communication, and interface functions, and providing residency and operational services for multiple aircraft-level functions. The IMA platform possesses a set of shared hardware resources, including a Central Processing Module (CPM), remote switches, internal switches, a Remote Data Conversion Unit (RDCU), and a Power Supply Module (PSM). It provides common computing, network communication, and interface functions for residency systems, and performs shared resource management, health monitoring, and fault management. It offers operational capabilities with different security levels to meet the varying isolation, partitioning, and fault tolerance requirements of residency applications.

[0003] The PSM module on the IMA platform has RTC functionality, and the PSM communicates with the CPM via the I2C bus. The PSM maintains the RTC function through redundant power supply and clock maintenance. The redundant power supply uses dual power supplies and a battery to achieve uninterrupted power supply, ensuring continuous operation of the RTC clock. The FPGA updates the RTC clock and performs calibration based on the date and time information received via the I2C bus, and can also upload the RTC time information via an external bus. Therefore, the CPM can both obtain and modify the RTC time information via the I2C bus.

[0004] Flight Management System (FMS) is a fundamental component of modern passenger aircraft avionics. It is an advanced area navigation, guidance, and performance management system centered on a computer. Time is the core basic data in the FMS, and its core function is to enable critical functions such as flight planning, navigation calculations, and operational monitoring. When reference time from satellite navigation systems (such as GPS and BeiDou) is available, the FMS uses this reference time as its operating time. However, when the reference time from satellite navigation systems is unavailable, for example due to signal loss or component malfunction, resulting in incorrect FMS time, it directly impacts flight safety. The most significant impact is on navigation and track calculation inaccuracies, leading to amplified position calculation errors. This can cause the aircraft to deviate from its planned flight path, increasing the risk of collisions with other aircraft or terrain features. Summary of the Invention

[0005] In order to overcome the defects of the existing technology, the purpose of this invention is to provide a reference time definition method and system based on an integrated modular avionics system, so as to solve the technical problems of inaccurate FMS time caused by the unavailability of aircraft date and time information during aircraft startup, resulting in inaccurate navigation and track calculation, air traffic control coordination and flight interval spatiotemporal issues, and critical system linkage failures.

[0006] This invention is achieved through the following technical solution: In a first aspect, the present invention provides a reference time definition method based on an integrated modular avionics system, comprising: Step 1: Receive the first bus mode time message periodically output by the flight tube, and complete the bus protocol conversion to obtain the second bus mode time message; Step 2: Receive the converted second bus standard time message. If no valid message is received, proceed to the local clock self-test calibration process. Step 3: Parse multiple time messages according to preset priority and perform multi-dimensional validity checks. If all message checks fail, proceed to the local clock self-test calibration process. Step 4: Select target time sources with local clock update permissions from the valid time messages that have passed the verification. If no time source with the required permissions is found, proceed to the local clock self-test calibration process. Step 5: Determine whether the local real-time clock supports hardware updates. If it can be updated, then synchronize and refresh the local real-time clock within a limited time. If it cannot be updated, then report a hardware fault and output a null time message. Step 6: Periodically read local real-time clock data and calculate clock accuracy error in real time. If the accuracy exceeds the threshold, execute the multi-rack redundant clock correction process. Step 7: Collect multi-cabinet, multi-channel redundant real-time clock data, and select the optimal redundant clock source to correct the local real-time clock with out-of-tolerance accuracy. Step 8: Publish the local real-time clock with the required accuracy to the external network; Step 9: Iterate through steps 1 to 8 to periodically and continuously collect, verify, update and publish the avionics system reference time.

[0007] Preferably, in step 1, the first bus standard is ARINC429 and the second bus standard is ARINC664. The process of converting the bus protocol to obtain the second bus standard time message includes: It receives three types of ARINC429 format time calendar messages periodically published by FMS. The three types of messages include Flight Control Time 1, Flight Control Time 2, and Flight Control Time 3, respectively. It completes the conversion between the two bus formats through the data conversion function of RDCU, and the converted data is transmitted via ARINC664 bus.

[0008] Furthermore, in step 2, ARINC664 format time and date messages are received through the message receiving port of the CPM module's common reference time function; if a message is successfully received, proceed to step 3; if no message is received, jump directly to step 6.

[0009] Furthermore, the preset priority order of step 3 is set as flight control time 1 > flight control time 2 > flight control time 3, and at most 3 ARINC664 format time and date messages are parsed in order of priority, and four validity judgments are completed simultaneously. The criteria for judging validity include: a. The FSB function status byte value is 0x03; b. The hour, minute, and second identifier L150_Label is 0x13, and the year, month, and day identifier L260_Label is 0x0D; c. The values ​​of L150_SDI and L260_SDI are consistent. Among them, 0 represents an invalid packet, 1 represents flight control time 1, i.e., left flight control time, 2 represents flight control time 2, i.e. right flight control time, and 3 represents flight control time 3, i.e. backup flight control time. d.L150_SSM is valid if it has a value of 2 or 3, and L260_SSM is valid if it has a value of 2 or 0. If all four conditions are met, the corresponding message is deemed valid. If none of the messages meet the verification conditions, proceed to step 6. Where FSB is the functional status byte, Label is the ARINC429 message field ID number, SDI is the source / destination identifier, and SSM is the symbol / state matrix.

[0010] Furthermore, the specific process of filtering target time sources with local clock update permissions from the valid time messages that have passed verification in step 4, and proceeding to the local clock self-test calibration process if no time source with the required permissions is found, includes: Messages with local RTC update permissions are filtered based on the L150_Source field. L150_Source is used to identify whether local RTC updates using FMS time are allowed. If L150_Source equals 1, it means that update permissions are granted and proceeds to step 5. If L150_Source is not 1 for any of the three messages, step 6 is executed directly.

[0011] Preferably, step 5 determines whether the local real-time clock supports hardware updates via the I2C bus link; if the hardware can be updated, the local RTC synchronization update must be completed within 100 milliseconds after receiving valid FMS time information before proceeding to step 6, with the preset RTC accuracy standard being ±0.5s per hour; if the hardware cannot be updated, an RTC hardware fault is reported, and a message with all time and FSB fields set to 0 is pushed to the ADN network.

[0012] Preferably, step 6, which involves periodically reading local real-time clock data and calculating clock accuracy error in real time, and then executing a multi-rack redundant clock correction process if the accuracy exceeds a threshold, includes: The system checks the readable RTC time. If reading the RTC time fails, it reports an RTC hardware failure to the upstream health management function and generates a message with all zero values ​​in the time and FSB fields, which is then pushed to the ADN network. Otherwise, it reads the local RTC time at a 1-second interval and continuously performs RTC accuracy detection after the system starts. The accuracy detection logic is as follows: During system initialization, the initial operating system time Ts0 and the initial RTC time Tr0 are obtained. Every second, the current operating system time Ts1 and the current RTC time Tr1 are collected, and T1=Ts1-Ts0 and T2=Tr1-Tr0 are calculated. |T1-T2| is taken as the real-time accuracy error value of RTC. The error value is cleared to zero every hour. If the accuracy error meets the standard of ±0.5s per hour, then step 8 is executed; if the accuracy does not meet the standard, then step 7 is executed.

[0013] Preferably, in step 7, the process of collecting multi-rack, multi-channel redundant real-time clock data and selecting the optimal redundant clock source to correct the local real-time clock with out-of-tolerance accuracy includes: The RTC time of the redundant PSM in the same side rack is read through the I2C bus. The accuracy of the RTC time in the same side rack is obtained through messages. The two RTC time and accuracy data of the opposite rack are obtained through interactive messages with a period of 1 second. The clock source that meets the accuracy standard and has the smallest error value is selected from all redundant RTC clocks. The local RTC with out-of-tolerance accuracy is corrected using the data from this clock source. After the correction is completed, step 8 is executed.

[0014] Furthermore, step 8 involves uniformly publishing the local RTC time that has completed accuracy verification and whose error meets the standard to the ADN network for FMS function calls.

[0015] Secondly, the present invention also provides a reference time definition system based on an integrated modular avionics system, comprising: The protocol conversion module receives the first bus mode time message periodically output by the flight tube, and completes the bus protocol conversion to obtain the second bus mode time message; The message receiving module receives the converted second bus format time message. If there is no valid message, it enters the local clock self-test calibration process. The message verification module parses multiple time messages according to preset priorities and performs multi-dimensional validity verification. If all message verifications fail, the local clock self-test calibration process is initiated. The source filtering module filters target time sources with local clock update permissions from valid time messages that have passed verification. If no time source with the required permissions is found, the local clock self-test calibration process is initiated. The clock update module determines whether the local real-time clock can be updated by hardware. If it can be updated, it will synchronously refresh the local real-time clock within a limited time. If it cannot be updated, it will report a hardware fault and output a null time message. The accuracy detection module periodically reads local real-time clock data and calculates clock accuracy error in real time. If the accuracy exceeds the threshold, it executes a multi-rack redundant clock correction process. The clock correction module collects multi-cabinet, multi-channel redundant real-time clock data and selects the optimal redundant clock source to correct local real-time clocks with outdated accuracy. The time publishing module publishes the local real-time clock with the required accuracy to the external network. The cyclic scheduling module executes iteratively, periodically and continuously collecting, verifying, updating, and publishing the avionics system reference time.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: This invention provides a reference time definition method based on an integrated modular avionics system. By constructing an independent common time reference system for the IMA platform through a closed-loop process including protocol conversion, message reception, multi-priority validity verification, time source filtering, local clock timed updates, periodic clock accuracy detection, multi-rack redundant clock optimization correction, and continuous high-precision time publishing, this system can serve as a backup time benchmark for the FMS. During aircraft startup or when the FMS's primary time source fails or date and time information is missing, the system can quickly switch to the standard time output by this method without waiting, effectively solving navigation and track calculation deviations and air traffic control time-space coordination issues caused by FMS time inaccuracies. To address issues such as timing errors and failures in the timing linkage of critical airborne systems, the method's cyclical operation can continuously and periodically push compliant time data to the FMS. Simultaneously, it implements accuracy detection, multi-rack redundancy correction, and hardware fault reporting mechanisms for the local RTC throughout the process, stabilizing the RTC's operational accuracy within ±0.5 seconds per hour. This ensures the long-term stability and reliability of the time reference supplied to the FMS, maintains the consistency of timing linkage between airborne navigation calculations, air-to-ground air traffic control interaction, and the entire aircraft's avionics systems, avoids various cascading operational failures induced by timing errors, eliminates flight safety hazards from the underlying time reference dimension, and comprehensively improves the operational reliability and flight safety of the integrated modular avionics system. Attached Figure Description

[0017] Figure 1 This is a flowchart of the reference time definition method based on an integrated modular avionics system in an embodiment of the present invention; Figure 2 This is a schematic diagram of a multi-rack redundant clock interaction architecture in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the communication principle between CPM and RTC in an embodiment of the present invention; Figure 4This is a flowchart of the reference time definition method in an embodiment of the present invention; Figure 5 This is a flowchart of the accuracy detection process in an embodiment of the present invention; Figure 6 This is a flowchart illustrating the accuracy correction process in an embodiment of the present invention. Figure 7 This is a flowchart of the reference time definition system based on the integrated modular avionics system in an embodiment of the present invention; In the diagram: 1. Protocol conversion module; 2. Message receiving module; 3. Message verification module; 4. Source filtering module; 5. Clock update module; 6. Accuracy detection module; 7. Clock correction module; 8. Time publishing module; 9. Loop scheduling module. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] This invention discloses a reference time definition method and system based on an integrated modular avionics system, which is applied to the airborne integrated modular avionics (IMA) platform. It provides an independent backup calendar time reference for the flight management system (FMS), solves the timing inaccuracy problem caused by the failure of the time source of the FMS itself during the aircraft startup phase, avoids flight safety risks such as navigation track calculation deviation, air traffic control spatiotemporal coordination disorder, and airborne subsystem linkage failure, and ensures that the local RTC clock accuracy is stably maintained at ±0.5s per hour throughout the entire process.

[0020] The present invention will now be described in further detail with reference to the accompanying drawings: Example 1 See Figure 1 , Figure 2 and Figure 4 This embodiment provides a reference time definition method based on an integrated modular avionics system. It uses a calendar time from the IMA platform that meets the backup requirements of the FMS (Flexible Media Storage System), which serves as a backup for the FMS time. It receives valid FMS time updates to the local clock and periodically publishes the RTC (Real-Time Clock) time. The RTC time undergoes accuracy detection, accuracy correction, and fault reporting to ensure time accuracy meets ±0.5 seconds per hour. When the first time source of the FMS is unavailable, the FMS obtains the calendar time of this invention as its time source. The process includes the following steps: Step 1: Receive the first bus-format time message periodically output by the flight control unit (FMU), and complete the bus protocol conversion to obtain the second bus-format time message. In this step, the first bus format is ARINC429, and the second bus format is ARINC664. The RDCU continuously receives three types of ARINC429 format time calendar messages periodically issued by the FMS: FMU Time 1, FMU Time 2, and FMU Time 3. The RDCU utilizes its built-in data conversion function to uniformly complete the ARINC429 to ARINC664 protocol conversion. The standardized time message after conversion is then transmitted downstream via the ARINC664 bus.

[0021] Step 2: Receive the converted second bus format time message. If no valid message is received, proceed to the local clock self-test calibration process. This step involves reading the ARINC664 format time and date message from the message receiving port corresponding to the CPM module's common reference time function. If the port successfully captures the converted time message, proceed to step 3. If no ARINC664 format time message is received, proceed directly to step 6 to start the local RTC clock self-test calibration process.

[0022] Step 3: Parse multiple time messages according to preset priorities and perform multi-dimensional validity checks. If all message checks fail, proceed to the local clock self-test calibration process. The preset message priority order in this step is: Flight Control Time 1 > Flight Control Time 2 > Flight Control Time 3. The common reference time function parses up to three ARINC664 format time and date messages one by one according to priority, simultaneously performing four mandatory validity checks. All four conditions must be met simultaneously for a single message to be considered valid. a. The FSB function status byte value is 0x03; b. The hour, minute, and second identifier L150_Label is 0x13, and the year, month, and day identifier L260_Label is 0x0D; c. The values ​​of L150_SDI and L260_SDI are completely consistent. A value of 0 represents an invalid message, a value of 1 represents flight control time 1, i.e., the left flight control time, a value of 2 represents flight control time 2, i.e. the right flight control time, and a value of 3 represents flight control time 3, i.e. the backup flight control time. d. A value of 2 or 3 for L150_SSM is considered valid, and a value of 2 or 0 for L260_SSM is considered valid.

[0023] Where FSB is the function status byte, Label is the ARINC429 message field ID number, SDI is the source / destination identifier, and SSM is the symbol / status matrix. If no valid message is found after verification of the three flight tube time messages, the process will directly jump to step 6 to start the local clock self-test calibration process.

[0024] Step 4: Select target time sources with local clock update permissions from the valid time messages that have passed the verification. If no time source with the required permissions is found, proceed to the local clock self-test calibration process.

[0025] This step iterates through all valid FMS messages that passed the verification in step 3, and reads the built-in L150_Source field of each message to complete the permission determination. The L150_Source field is used to indicate whether updating the local RTC with the current FMS time is allowed. If the L150_Source field is equal to 1, it means that the message has the permission to update the local RTC clock. The message with the highest priority is selected and the process jumps to step 5. If the L150_Source field values ​​of the three FMS time messages are all not 1, there is no time source with update permission, and the process jumps directly to step 6.

[0026] Step 5: Determine if the local real-time clock supports hardware updates. If it can be updated, synchronize and refresh the local real-time clock within a limited time. If it cannot be updated, report a hardware fault and output a null time message. This step uses the I2C bus communication link to determine whether the local PSM-equipped RTC hardware supports time write updates. If the hardware supports updates, the local RTC synchronous refresh must be completed within 100 milliseconds after capturing valid FMS time information. The default RTC operating accuracy standard for the entire machine is ±0.5s per hour. After the refresh is completed, proceed to step 6. If the I2C link interaction determines that the RTC hardware cannot be updated, immediately report the RTC hardware fault to the upstream health management function, and simultaneously push a null message with all time and FSB fields set to 0 to the ADN network. Fault reporting and message delivery are then complete. For the I2C bus interaction logic between the CPM module and the PSM internal RTC hardware, please refer to [link to relevant documentation]. Figure 3 .

[0027] Step 6: Periodically read local real-time clock data and calculate clock accuracy error in real time. If the accuracy exceeds the threshold, execute the multi-rack redundant clock correction process.

[0028] This step first determines whether the RTC time can be read. If reading the RTC time fails, an RTC hardware failure is reported to the upstream health management function, and a message with all time and FSB fields set to zero is generated and pushed to the ADN network. Otherwise, the local RTC time is read at a 1-second interval, and RTC accuracy testing is continuously performed after system startup. For complete accuracy testing logic, please refer to [link to full logic]. Figure 5During the system power-on initialization phase, the system calls the standard operating system interface function to acquire the initial operating system time Ts0 and reads the local initial RTC time Tr0 via the I2C bus. Subsequently, the current operating system time Ts1 and the current local RTC time Tr1 are acquired synchronously every 1 second, and the duration difference T1=Ts1-Ts0 and T2=Tr1-Tr0 are calculated. The absolute value |T1-T2| is taken as the real-time RTC accuracy error value. The system automatically clears the error value to zero after accumulating one hour of operation and restarts the error accumulation calculation. The real-time error value is compared with the accuracy threshold of ±0.5s per hour. If the error meets the accuracy standard, the system directly jumps to step 8; if the error exceeds the threshold, the accuracy is determined to be substandard, and step 7 is executed to start the multi-rack redundant clock correction process.

[0029] Step 7: Collect multi-rack, multi-channel redundant real-time clock data, and select the optimal redundant clock source to correct local real-time clocks with out-of-tolerance accuracy. For the complete accuracy correction process, please refer to [link to documentation]. Figure 6 After the local RTC determines that the accuracy exceeds the standard, it first reads the real-time time data of the RTC on the other PSM in the same rack via the I2C bus, and obtains the accuracy of the RTC time in the same rack through messages; secondly, it receives the interaction messages periodically sent by the CPM module in the other rack at a 1-second interval, parses the messages to obtain the time and accuracy parameters of the RTC built into the two PSMs in the opposite rack; it summarizes all the data of the three redundant RTCs on the same and opposite sides, selects the redundant clock that simultaneously meets the accuracy standard and has the smallest error value as the optimal clock source, and uses the time data of the optimal clock source to overwrite and correct the local RTC with excessive accuracy. After the correction operation is completed, step 8 is executed. For the hardware topology of dual PSM and dual CPM inside the left and right APR racks of the whole machine, and the multi-rack redundant clock interaction architecture, please refer to Figure 2 .

[0030] Step 8: Publish the local real-time clock with the required accuracy to the external network.

[0031] This step encapsulates the local RTC standard time, which has been verified for accuracy in step 6 and whose error meets the standard of ±0.5s per hour, and publishes it to the ADN aircraft data network. The FMS can read this standard time from the ADN network in real time as its own backup time reference. When the FMS's own primary time source fails or there is no valid time input during the aircraft startup phase, the FMS can immediately obtain the standard time issued in this step and complete its own timing maintenance without additional waiting, ensuring the consistency of timing linkage between navigation calculation, air traffic control coordination, and the entire aircraft's avionics system.

[0032] Step 9: Iterate through steps 1 to 8 to periodically and continuously collect, verify, update and publish the avionics system reference time.

[0033] After all steps 1 to 8 of a single round are completed, the system automatically resets and restarts step 1, continuously collecting the flight control time messages issued by the FMS periodically, repeating the complete logic of parsing, verifying, updating the clock, detecting and correcting accuracy, and publishing to the network, and continuously providing a stable backup time base for the IMA platform and FMS.

[0034] This embodiment constructs an independent public time reference system as a dedicated backup time source for the FMS, which can effectively solve the problem of FMS timing inaccuracy caused by the failure of the FMS master time source or the loss of time information during aircraft startup. It avoids navigation track calculation deviations, air traffic control flight interval spatiotemporal errors, and timing linkage failures of critical airborne systems. The system continuously pushes standard RTC time to the ADN network at a 1-second cycle. When the FMS master time source fails, it can seamlessly switch to obtain backup time without waiting delay. At the same time, it is equipped with full-process RTC accuracy detection, multi-cabinet multi-channel redundant clock optimization correction, and hardware fault reporting mechanism, which keeps the RTC operating accuracy within ±0.5s per hour in the long term, eliminates various flight chain risks caused by timing errors, and comprehensively improves the operational reliability and flight safety of the integrated modular avionics system.

[0035] In this embodiment, a backup time reference for the aircraft's time and date is provided using the embedded real-time clock (RTC) of the Power Switching Module (PSM). When the FMS receives calendar time information via the Aircraft Data Network (ADN), the public time reference function determines the validity and availability of the FMS-published time. If conditions are met, the local PSM's RTC time is updated using the FMS time within a specified timeframe, the RTC accuracy is checked and corrected, and the backup calendar time obtained from the local RTC is periodically published to the ADN network. Simultaneously, any local RTC time failures are reported to ensure the accuracy of the published calendar time information is ±0.5 seconds per hour. When the FMS time source is unavailable, the FMS receives calendar time information published by the public time reference function for time updates and maintenance.

[0036] Example 2 according to Figure 7As shown, this embodiment is a reference time definition system based on an integrated modular avionics system, used to fully implement the reference time definition method based on the integrated modular avionics system. The system is deployed in the IMA integrated modular avionics platform in the left and right APR cabinets of the aircraft. The hardware includes CPM_c1 and CPM_c4 common processing modules, PSM_cA and PSM_cB power conversion modules, RDCU remote data conversion unit, ADN aircraft data network, ARINC664 bus, and health management function unit. The functions of each module are as follows: Protocol conversion module 1 receives the first bus mode time message periodically output by the flight tube, and completes the bus protocol conversion to obtain the second bus mode time message; The specific steps are as follows: It continuously receives three types of time calendar messages in ARINC429 standard: Flight Control Time 1, Flight Control Time 2, and Flight Control Time 3, issued periodically by the FMS. It completes the data format conversion based on the software function of the RDCU, and the RDCU hardware completes the ARINC429 to ARINC664 bus protocol conversion. After conversion, the time message is pushed to the ARINC664 bus for transmission.

[0037] Message receiving module 2 receives the converted second bus format time message. If there is no valid message, it enters the local clock self-test calibration process. The specific steps are as follows: Deployed within the common reference time function of the CPM module, it reads ARINC664 format time and date messages through a dedicated message receiving port. When no valid message is received, it directly sends a trigger signal to the accuracy detection module to start the local clock self-test calibration process.

[0038] Message verification module 3 parses multiple time messages according to preset priority and performs multi-dimensional validity verification. If all message verifications fail, it enters the local clock self-test calibration process. The specific steps are as follows: According to the preset priority of Flight Control Time 1 > Flight Control Time 2 > Flight Control Time 3, up to 3 ARINC664 time messages are parsed one by one, and the validity of FSB, Label, SDI and SSM in four dimensions is determined simultaneously. If all message verifications fail, a jump instruction is sent to the accuracy detection module.

[0039] Source filtering module 4 filters target time sources with local clock update permissions from valid time messages that have passed verification. If no time source with the required permissions is found, the local clock self-test calibration process is initiated. The specific steps are as follows: Read the valid time message output by the message verification module, parse the L150_Source field of each message to filter the target time source with local RTC update permission, and trigger the local clock self-test calibration process when there is no compliant time source.

[0040] Clock update module 5 determines whether the local real-time clock can be updated by hardware. If it can be updated, it will synchronously refresh the local real-time clock within a time limit; if it cannot be updated, it will report a hardware fault and output a null time message. The specific steps are as follows: The system interacts with the local PSM's built-in RTC hardware via the I2C bus to determine whether the RTC supports time updates. If the hardware is updatable, the local RTC is refreshed with a filtered valid FMS time within a 100-millisecond time limit. If the hardware is not updatable, the system reports an RTC hardware failure to the upstream health management function and simultaneously generates a message with all time and FSB fields set to 0 and pushes it to the ADN network.

[0041] The accuracy detection module 6 periodically reads local real-time clock data and calculates clock accuracy error in real time. If the accuracy exceeds the threshold, it executes the multi-rack redundant clock correction process. The specific steps are as follows: The system checks the readable RTC time. If reading the RTC time fails, it reports an RTC hardware failure to the upstream health management function and generates a message with all zero values ​​in the time and FSB fields, which is then pushed to the ADN network. Otherwise, it reads the local RTC time at a 1-second interval and continuously performs RTC accuracy detection after the system starts. The real-time accuracy error |T1-T2| is calculated according to the acquisition logic of Ts0, Tr0, Ts1, and Tr1, and the cumulative error value is automatically cleared every hour. The error is compared with the accuracy threshold of ±0.5s per hour. If the accuracy exceeds the threshold, a correction trigger command is sent to the clock correction module. If the accuracy meets the threshold, the time publishing module is directly driven to work.

[0042] Clock correction module 7 collects multi-cabinet multi-channel redundant real-time clock data and selects the optimal redundant clock source to correct the local real-time clock with outdated accuracy. The specific steps are as follows: The RTC time of the redundant PSM in the same side rack is read through the I2C bus. The accuracy of the RTC time in the same side rack is obtained through messages. The two RTC data from the opposite rack are obtained through a 1-second cycle of interactive messages. The optimal clock source that meets the accuracy and minimum error is selected from the three redundant clocks. The RTC hardware time with excessive local accuracy is covered and corrected. After the correction is completed, it is output to the time publishing module.

[0043] Time publishing module 8 publishes the local real-time clock with the required accuracy to the external network; The specific steps are as follows: The system receives the compliant RTC standard time output by the accuracy detection module or clock correction module, encapsulates the message, and continuously publishes it to the ADN aircraft data network, providing the onboard FMS with real-time access as a backup time reference.

[0044] The cyclic scheduling module 9 executes iteratively, periodically and continuously completing the collection, verification, updating and release of the avionics system reference time.

[0045] The specific steps are as follows: After completing the entire process of single-round data collection, verification, update, accuracy detection and correction, and network publishing, the automatic reset drives the protocol conversion module to restart a new round of message reception, achieving uninterrupted periodic operation of the entire process.

[0046] This system relies on a dual CPM and dual PSM redundant hardware architecture in the left and right cabinets. It completes full-module data interaction through I2C bus, ARINC664 bus, and ADN network. The modular functional units fully reproduce all the logic of the reference time definition method of this invention. The multi-redundant RTC clock, multi-priority FMS time verification, timed clock update, periodic accuracy self-check correction, and fault reporting functions work together to continuously provide a highly reliable and high-precision backup time source for the FMS. This solves the flight timing safety hazards caused by the failure of a single master time source of the FMS and is adapted to the long-term stable operation requirements of the airborne integrated modular avionics platform.

[0047] In summary, this invention provides a reference time definition method and system based on an integrated modular avionics system. A common time reference scheme serves as a backup date and time for the Flight Management System (FMS), ensuring the accuracy of the FMS time. When the FMS is in operation during aircraft startup or when aircraft date and time information is unavailable, the time provided by the common time reference function is used to ensure the accuracy of the FMS time. The accuracy of the FMS time directly affects flight safety, with a core impact on ensuring navigation precision, air traffic control coordination, and consistency in system linkage. Inaccurate time can trigger a chain of risks. By periodically providing the FMS with date and time, when the primary time source of the FMS is unavailable, the time provided by the common time reference function can be obtained immediately without waiting, ensuring the accuracy of the FMS time. The accuracy of the Real-Time Control (RTC) time in the PSM is detected, corrected, and fault reported to maintain the RTC accuracy within ±0.5 seconds per hour.

Claims

1. A reference time definition method based on an integrated modular avionics system, characterized in that, include: Step 1: Receive the first bus mode time message periodically output by the flight tube, and complete the bus protocol conversion to obtain the second bus mode time message; Step 2: Receive the converted second bus standard time message. If no valid message is received, proceed to the local clock self-test calibration process. Step 3: Parse multiple time messages according to preset priority and perform multi-dimensional validity checks. If all message checks fail, proceed to the local clock self-test calibration process. Step 4: Select target time sources with local clock update permissions from the valid time messages that have passed the verification. If no time source with the required permissions is found, proceed to the local clock self-test calibration process. Step 5: Determine whether the local real-time clock supports hardware updates. If it can be updated, then synchronize and refresh the local real-time clock within a limited time. If it cannot be updated, then report a hardware fault and output a null time message. Step 6: Periodically read local real-time clock data and calculate clock accuracy error in real time. If the accuracy exceeds the threshold, execute the multi-rack redundant clock correction process. Step 7: Collect multi-cabinet, multi-channel redundant real-time clock data, and select the optimal redundant clock source to correct the local real-time clock with out-of-tolerance accuracy. Step 8: Publish the local real-time clock with the required accuracy to the external network; Step 9: Iterate through steps 1 to 8 to periodically and continuously collect, verify, update and publish the avionics system reference time.

2. The reference time definition method based on an integrated modular avionics system according to claim 1, characterized in that, In step 1, the first bus standard is ARINC429 and the second bus standard is ARINC664. The process of converting the bus protocol to obtain the second bus standard time message includes: It receives three types of ARINC429 format time calendar messages periodically published by FMS. The three types of messages include Flight Control Time 1, Flight Control Time 2, and Flight Control Time 3, respectively. It completes the conversion between the two bus formats through the data conversion function of RDCU, and the converted data is transmitted via ARINC664 bus.

3. The reference time definition method based on an integrated modular avionics system according to claim 2, characterized in that, In step 2, ARINC664 format time and date messages are received through the message receiving port of the CPM module's common reference time function; if a message is successfully received, proceed to step 3; otherwise, jump directly to step 6.

4. The reference time definition method based on an integrated modular avionics system according to claim 2, characterized in that, The preset priority order of step 3 is set as flight control time 1 > flight control time 2 > flight control time 3. At most 3 ARINC664 format time and date messages are parsed in order of priority, and four validity judgments are completed simultaneously. The criteria for judging validity include: a. The FSB function status byte value is 0x03; b. The hour, minute, and second identifier L150_Label is 0x13, and the year, month, and day identifier L260_Label is 0x0D; c. The values ​​of L150_SDI and L260_SDI are consistent. Among them, 0 represents an invalid packet, 1 represents flight control time 1, i.e., left flight control time, 2 represents flight control time 2, i.e. right flight control time, and 3 represents flight control time 3, i.e. backup flight control time. d.L150_SSM is valid if it has a value of 2 or 3, and L260_SSM is valid if it has a value of 2 or 0. If all four conditions are met, the corresponding message is deemed valid. If none of the messages meet the verification conditions, proceed to step 6. Where FSB is the functional status byte, Label is the ARINC429 message field ID number, SDI is the source / destination identifier, and SSM is the symbol / state matrix.

5. A reference time definition method based on an integrated modular avionics system according to claim 4, characterized in that, The specific process of filtering target time sources with local clock update permissions from the valid time messages that have passed verification in step 4, and proceeding to the local clock self-test calibration process if no time source with the required permissions is found, includes the following: Messages with local RTC update permissions are filtered based on the L150_Source field. L150_Source is used to identify whether local RTC updates using FMS time are allowed. If L150_Source equals 1, it means that update permissions are granted and proceeds to step 5. If L150_Source is not 1 for any of the three messages, step 6 is executed directly.

6. A reference time definition method based on an integrated modular avionics system according to claim 1, characterized in that, Step 5 determines whether the local real-time clock supports hardware updates via the I2C bus link. If the hardware can be updated, the local RTC synchronization update must be completed within 100 milliseconds after receiving valid FMS time information before proceeding to step 6. The preset accuracy standard for the RTC is ±0.5s per hour. If the hardware cannot be updated, an RTC hardware failure is reported, and a message with all time and FSB fields set to 0 is pushed to the ADN network.

7. The reference time definition method based on an integrated modular avionics system according to claim 1, characterized in that, Step 6 involves periodically reading local real-time clock data and calculating clock accuracy error in real time. If the accuracy exceeds the threshold, a multi-rack redundant clock correction process is executed, which includes: The system checks the readable RTC time. If reading the RTC time fails, it reports an RTC hardware failure to the upstream health management function and generates a message with all zero values ​​in the time and FSB fields, which is then pushed to the ADN network. Otherwise, it reads the local RTC time at a 1-second interval and continuously performs RTC accuracy detection after the system starts. The accuracy detection logic is as follows: During system initialization, the initial operating system time Ts0 and the initial RTC time Tr0 are obtained. Every second, the current operating system time Ts1 and the current RTC time Tr1 are collected. T1=Ts1-Ts0 and T2=Tr1-Tr0 are calculated. |T1-T2| is taken as the real-time accuracy error value of RTC. The error value is cleared to zero every hour. If the accuracy error meets the standard of ±0.5s per hour, then step 8 is executed; if the accuracy does not meet the standard, then step 7 is executed.

8. The reference time definition method based on an integrated modular avionics system according to claim 1, characterized in that, Step 7, which involves collecting multi-rack, multi-channel redundant real-time clock data and selecting the optimal redundant clock source to correct local real-time clocks with out-of-tolerance accuracy, includes the following: The RTC time of the redundant PSM in the same side rack is read through the I2C bus. The accuracy of the RTC time in the same side rack is obtained through messages. The two RTC time and accuracy data of the opposite rack are obtained through interactive messages with a period of 1 second. The clock source that meets the accuracy standard and has the smallest error value is selected from all redundant RTC clocks. The local RTC with out-of-tolerance accuracy is corrected using the data from this clock source. After the correction is completed, step 8 is executed.

9. A reference time definition method based on an integrated modular avionics system according to claim 7, characterized in that, Step 8 involves uniformly publishing the local RTC time that has completed accuracy verification and whose error meets the standard to the ADN network for FMS function calls.

10. A reference time definition system based on an integrated modular avionics system, characterized in that, include: The protocol conversion module receives the first bus mode time message periodically output by the flight tube, and completes the bus protocol conversion to obtain the second bus mode time message; The message receiving module receives the converted second bus format time message. If there is no valid message, it enters the local clock self-test calibration process. The message verification module parses multiple time messages according to preset priorities and performs multi-dimensional validity verification. If all message verifications fail, the local clock self-test calibration process is initiated. The source filtering module filters target time sources with local clock update permissions from valid time messages that have passed verification. If no time source with the required permissions is found, the local clock self-test calibration process is initiated. The clock update module determines whether the local real-time clock can be updated by hardware. If it can be updated, it will synchronously refresh the local real-time clock within a limited time. If it cannot be updated, it will report a hardware fault and output a null time message. The accuracy detection module periodically reads local real-time clock data and calculates clock accuracy error in real time. If the accuracy exceeds the threshold, it executes a multi-rack redundant clock correction process. The clock correction module collects multi-cabinet, multi-channel redundant real-time clock data and selects the optimal redundant clock source to correct local real-time clocks with outdated accuracy. The time publishing module publishes the local real-time clock with the required accuracy to the external network. The cyclic scheduling module executes iteratively, periodically and continuously collecting, verifying, updating, and publishing the avionics system reference time.

Images