CN109426675B

CN109426675B - Stateflow-based redundancy management method for airborne electromechanical integrated management system

Info

Publication number: CN109426675B
Application number: CN201710728850.7A
Authority: CN
Inventors: 郭鹏; 李亚晖; 孙允明
Original assignee: Xian Aeronautics Computing Technique Research Institute of AVIC
Current assignee: Xian Aeronautics Computing Technique Research Institute of AVIC
Priority date: 2017-08-23
Filing date: 2017-08-23
Publication date: 2023-01-13
Anticipated expiration: 2037-08-23
Also published as: CN109426675A

Abstract

Aiming at the defects of redundancy management function development of the traditional electromechanical integrated management system, a Stateflow tool of Simulink is adopted, a Stateflow-based airborne electromechanical integrated management system redundancy management method is provided, an airborne electromechanical integrated management system architecture model is established, and a state machine model of an electromechanical integrated management computer is designed; and designing redundancy management logic based on a truth table. The method can be used for designing the redundancy management method of the airborne electromechanical integrated management system in the early development stage of the airborne electromechanical integrated management system, can find system faults in advance, improve development efficiency, save development cost, reduce the complexity of the design of the airborne electromechanical integrated management system, enable the model to be far higher than documents and codes in comprehensibility, and reduce the communication difficulty of requirements, design and realization of relevant engineers.

Description

Stateflow-based redundancy management method for airborne electromechanical integrated management system

Technical Field

The invention relates to a redundancy management method, in particular to a Stateflow-based onboard electromechanical integrated management system redundancy management method.

Background

An airborne electromechanical system refers to equipment on an airplane for ensuring the normal operation of systems such as flight control and avionics and the safety of personnel on the airplane. The airborne electromechanical system comprises a dozen of systems such as a power supply system, a fuel system, a hydraulic system, an environmental control system, a brake system, an undercarriage system, an engine system and an auxiliary power system. The aviation industry departments at home and abroad introduce an electromechanical integrated management system, and change the electromechanical system from a traditional combined architecture to an integrated or deep integrated architecture.

The redundancy management function of the current airborne electromechanical integrated management system is mainly realized by C language codes, along with the higher and higher degree of integration of the electromechanical integrated management system, system developers are difficult to communicate through codes and documents, the complexity of design is higher and higher, and the portability of the codes is also poorer and poorer. It is urgent to change the above situation.

Stateflow is a graphical design and development tool in Matlab/Simulink series products, and is a graphical implementation tool of a finite state machine. The method is mainly used for expressing the control and detection logic relation in Simulink. When a user carries out Simulink simulation, the graphical tool can be used for realizing conversion among various states, and the problem of complex monitoring logic is solved. The method can realize graphical modeling and simulation of a complex system based on the finite-state machine theory, design, develop and determine the detected control system, and modify the design, evaluate the result and verify the performance of the system more easily at different stages of the design. The state of the art.

Disclosure of Invention

The purpose of the invention is as follows:

while the onboard electromechanical integrated management system gains enormous benefits, a series of problems are brought about, including development, design and integration difficulties introduced by the increase in the scale of the system, "domino effect" caused by failure in reliability, and re-evaluation of safety from loose coupling to tight coupling.

The aviation industry department urgently needs to establish an airborne electromechanical comprehensive management system by adopting an advanced and scientific method. The modeling and simulation technology is an effective means, the complexity of the design of the airborne electromechanical integrated management system can be reduced through modeling/simulation, the comprehensibility degree of the model is far higher than that of documents and codes, and the communication difficulty of requirements, design and realization of related engineers is reduced; secondly, the design defects of the system can be found at the early stage of product development through modeling/simulation, the high repair cost is reduced, and the product delivery cycle is shortened; and thirdly, forming a standard system designed for the airborne electromechanical comprehensive management system through modeling/simulation, standardizing the design flow and guiding the electromechanical system designer.

The technical scheme of the invention is as follows:

in order to achieve the purpose of the invention, the technical scheme adopted by the invention is as follows: redundancy management method of the airborne electromechanical integrated management system based on Stateflow.

The redundancy management method of the airborne electromechanical integrated management system based on Stateflow comprises the following three steps: establishing an airborne electromechanical integrated management system architecture model; designing a state machine model of an electromechanical integrated management computer; and designing redundancy management logic based on a truth table.

Step 1, establishing an airborne electromechanical integrated management system architecture model

And according to the actual condition of the electromechanical system, using Chart of Stateflow to establish an architecture model for detecting and processing faults of the airborne electromechanical system. Each state represents an electromechanical integrated management computer, and the priority relationship of all the electromechanical integrated management computers is up, down, left and right.

Step 2, designing a state machine model of the electromechanical integrated management computer

And (3) designing a state machine model of the electromechanical comprehensive management computer on the basis of the step 1. Each state in the Stateflow represents one electromechanical integrated management computer, each electromechanical integrated management computer is composed of 5 sub-states, passive, standby, off and Isolated, and the 5 sub-states respectively represent different modes of the electromechanical integrated management computer.

Passive: the method comprises the steps that an initialization state of a periodic task is entered after an electromechanical comprehensive management computer is powered on;

active: indicating that the electromechanical integrated management computer is in an active state, namely that the IEMC is in master control;

the standby state indicates that the electromechanical comprehensive management computer is in a backup state and does not output instructions;

off, representing the fault state of the electromechanical integrated management computer, and entering a detection state once the electromechanical integrated management computer detects an instantaneous fault;

and e, the isolated state represents the isolated state, and according to the specific logic of the system, when the instantaneous fault reaches a certain threshold value, the isolated state is entered, and the system takes safety measures.

Step 3, designing redundancy management logic based on truth table

On the basis of step 2, firstly, establishing a migration relationship of a child state in each parent state, including from an initial state to a Passive state, from the Passive state to an Active or Standby state, and from the Standby state to the Active state. Off state to Isolated state. The condition for the Passive/Standby state to the Active state of the IEMSC is that the IEMSC is currently in the Passive state. The condition for the Passive/Active/Standby state to the Off state of the IEMSC is go Off (i.e., the system detects a failure). The condition of the Off state to the Isolated state of the IEMSC is [ failures > = n ], i.e., the failures are accumulated up to n times. The Off-to-Off state condition of the IEMSC is go Off [ failures < n ], i.e. the IEMSC1 is still in the Off state when the number of consecutive failures is less than n.

And (3) adopting a truth table of Stateflow as input according to a monitoring result of the airborne electromechanical integrated management system to realize redundancy management logic of the airborne electromechanical management computer. The truth table includes a condition table and an action table. In the Condition table, each Condition in the Condition column is determined whether the monitoring signal is valid (T) or invalid (F) first. Each Decision column implies an AND operation of various conditions. The last decision in the table is called the default decision, which contains all other decisions except the previously listed decisions. The Action (Action) represents the result of the decision. The action table is a concrete action of the condition table, and the action needs to specifically represent the number of valid values of the monitoring signal. As shown in tables 1 and 2.

TABLE 1 Fault processing Condition Table for airborne electromechanical comprehensive management System

Description of the preferred embodiment

Conditions of

D1 (decision 1)

D2

D3

……

DM (default decision)

1

Validity[1]

T

F

……

-

2

Validity[2]

F

T

F

……

-

3

Validity[3]

F

T

F

……

-

……

N

Validity[N]

……

-

Movement of

1

2

3

……

X

TABLE 2 airborne electromechanical integrated management system action table

	Description of the invention	Movement of
			1		num＝1
2
			……	……	……
X		num＝x

Drawings

FIG. 1 architecture model for on-board electromechanical system fault detection and handling

FIG. 2 is a computer state machine model for airborne electromechanical integrated management

Detailed Description

The landing gear retraction control system is taken as a case, an RIU (remote interface unit) receives an operation instruction (retraction/extension/emergency extension) of a pilot, the RIU controls valves of different types in a landing gear system, meanwhile, an IEMSC (integrated electromechanical management computer) with dual redundancy receives landing gear switching signals collected by the RIU, the IEMSC votes the switching signals with redundancy, monitors the effectiveness of the switching signals, sends a voting value and a monitoring result to the RIU and continuously controls a landing gear mechanical device. The present invention will be described in further detail with reference to the accompanying drawings and examples.

1. Establishing airborne electromechanical integrated management system architecture model

Because the electromechanical integrated management system in the case is dual-redundancy, an architecture model for detecting and processing faults of the airborne electromechanical system is established by using Chart of Stateflow, and the two states of the architecture model are IEMSC1 and IEMSC2. Each state represents an electromechanical integrated management computer, as shown in fig. 1, with IEMSC1 at the upper left of IEMSC2, i.e. with IEMSC1 as the master node and IEMSC2 as the slave node.

2. State machine model for designing electromechanical integrated management computer

And designing a state machine model of the electromechanical comprehensive management computer. Each state in the Stateflow represents one electromechanical integrated management computer, each electromechanical integrated management computer is composed of 5 sub-states, and the 5 sub-states represent different states of the electromechanical integrated management computer respectively.

3. Designing truth table based redundancy management logic

And establishing a migration relationship of the child states in each parent state IEMSC, wherein the migration relationship comprises a state from an initial state to a Passive state, a Passive state to an Active state or a Standby state, and a Standby state to an Active state. Off state to Isolated state. The specific migration relationships are shown in table 1.

Table 3 details the migration relationships for the different states in this case. The condition for the Passive/Standby state to Active state of IEMSC1 is that IEMSC2 is currently in the Passive state. The condition of the Passive/Active/Standby state to the Off state of IEMSC1 is go Off (i.e. the system detects a failure). The condition of the Off state to the Isolated state of the IEMSC1 is [ fail > =3], that is, the failure is accumulated up to 3 times. The Off-to-Off state condition of the IEMSC1 is go Off <3, i.e. the IEMSC1 is still in the Off state when the number of consecutive failures is less than 3.

And (3) realizing redundancy management logic of the airborne electromechanical management computer by adopting a truth table of Stateflow and inputting dual-redundancy RIU. The truth table includes a condition table and an action table. In the condition table 4, a Front lifting Door drop-in-place end switch 1 (Front _ Door _ delay _ State 1) and a Front lifting Door drop-in-place end switch 2 (Front _ Door _ delay _ State 2) are used as inputs. Action 1 is triggered when Front _ Door _ delay _ State1 is true and Front _ Door _ delay _ State2 is true. Action 2 is triggered when Front _ Door _ delay _ State1 is false and Front _ Door _ delay _ State2 is true. Action 3 is triggered when Front _ Door _ delay _ State1 is true and Front _ Door _ delay _ State2 is false. Action 4 is triggered when Front _ Door _ delay _ State1 is false and Front _ Door _ delay _ State2 is false. In the action table of table 5, action 1 is the default action and is null. Action 2 represents that the onboard electromechanical integrated management computer 1 has an instantaneous fault, send (go _ off, iemsc. Iemscc 1); action 3 represents that the onboard electromechanical integrated management computer 2 has an instantaneous fault, send (go _ off, iemsc. Iemscc 2); action 4 indicates that instantaneous fault occurs in both the onboard electromechanical integrated management computers 1 and 2, send (go _ off, iemsc. Iemscc 1), send (go _ off, iemsc. Iemscc 2).

TABLE 3 electromechanical integrated management computer state relationship

Initial state

Passive

Active

Standby

Off

Isolated

Initial state

\

Automatic

\

go_off[！in(off)]

\

Passive

\

！IEMSC2_act()

IEMSC2_act()

go_off[！in(off)]

、

Active

\

IEMSC2_act()

go_off[！in(off)]

\

Standby

\

！IEMSC2_act()

\

go_off[！in(off)]

\

Off

[validity1]

\

go_off[fails<3]

[fails>＝3]

Isolated

\

Surface 4 undercarriage retraction-oriented airborne electromechanical integrated management system fault handling condition table

Description of the invention

Conditions of

D1

D2

D3

D4

1

Forward-lift cabin door put-down in-place terminal switch 1

Front_Door_Deploy_State1

T

F

T

F

Forward-lift cabin door put-down in-place terminal switch 2

Front_Door_Deploy_State2

T

F

Movement of

1

2

3

4

Surface 5 undercarriage-oriented airborne electromechanical integrated management system fault handling action table

Claims

1. A redundancy management method of an airborne electromechanical integrated management system based on Stateflow is characterized by comprising the following steps: the method comprises the following three steps: establishing an airborne electromechanical integrated management system architecture model; designing a state machine model of an electromechanical integrated management computer; designing redundancy management logic based on a truth table; the method comprises the following specific steps:

step 1: establishing airborne electromechanical integrated management system architecture model

According to the actual situation of the electromechanical system, using Chart of Stateflow to establish a system structure model for detecting and processing faults of the airborne electromechanical integrated management system; each state represents an electromechanical integrated management computer, and the priority relations of all the electromechanical integrated management computers are up, down, left and right;

and 2, step: state machine model for designing electromechanical integrated management computer

Designing a state machine model of the electromechanical integrated management computer on the basis of the step 1; each state in the Stateflow represents an electromechanical integrated management computer, each electromechanical integrated management computer is composed of 5 sub-states, and the 5 sub-states respectively represent different modes of the electromechanical integrated management computer;

the Passive: the method comprises the steps that an initialization state of a periodic task is entered after an electromechanical comprehensive management computer is powered on;

the Active: indicating that the electromechanical integrated management computer is in an active state, namely that the IEMC is in master control;

the Standby represents that the electromechanical comprehensive management computer is in a backup state and does not output instructions;

the Off represents the fault state of the electromechanical integrated management computer, and the electromechanical integrated management computer enters a detection state once detecting an instantaneous fault;

the Isolated state represents an isolation state, and according to the specific logic of the system, when the instantaneous fault reaches a certain threshold value, the system enters the isolation state and takes safety measures;

and step 3: designing truth table based redundancy management logic

On the basis of the step 2, firstly establishing a migration relationship of a child state in each parent state, wherein the migration relationship comprises a state from an initial state to a Passive state, a state from the Passive state to an Active state or a state from the Standby state to the Active state, and a state from the Standby state to the Active state; off state to Isolated state; the condition from the Passive/Standby state to the Active state of the IEMSC is that the IEMSC is currently in the Passive state; the condition from Passive/Active/Standby state to Off state of the IEMSC is go Off, i.e. the system detects a failure; the condition from the Off state to the Isolated state of the IEMSC is [ fail > = n ], i.e. the fault accumulation reaches n times; the Off-to-Off state condition of the IEMSC is go Off [ failures < n ], i.e. when the number of consecutive failures is less than n, the IEMSC1 is still in the Off state;

and (3) adopting a truth table of Stateflow as input according to a monitoring result of the airborne electromechanical integrated management system to realize redundancy management logic of the airborne electromechanical management computer.

2. The Stateflow-based airborne electromechanical integrated management system redundancy management method according to claim 1, characterized in that: the truth table comprises a condition table and an action table; in the Condition table, each Condition in the Condition column is to determine whether the monitoring signal is valid (T) or invalid (F) first; each Decision column implies an AND operation of various conditions; the last decision in the table, called the default decision, contains all other decisions except the previously listed decision; the Action (Action) represents the result of the decision; the action table is a concrete action of the condition table, and the action needs to specifically represent the number of valid values of the monitoring signal.