CN102592011A - Layering aviation operation system HM/FM (health monitoring/fault management) modeling and evaluating method based on stochastic Petri net - Google Patents

Abstract

A layering aviation operation system HM/FM (health monitoring/fault management) modeling an evaluating method based on a stochastic Petri net comprises the following steps: firstly, establishing a stochastic Petri net model of all components, including a monitored object model, an HM model and an FM model, and secondly, combining the models to construct a complete stochastic Petri net model; then simplifying and solving the complete stochastic Petri net to obtain the stability probability distribution of separated Petri sub models and the stability probability distribution of compressed Petri sub models; and finally analyzing and evaluating the models. According to the method, the sub models of the components of the system are established and can be combined flexibly according the structure of the practical system to obtain the complete model of the system, namely flexibility, the models are subjected to approximation analysis, a large-scale practical system can be processed, namely the solving of a complicated model.

Description

HM/FM modeling of layering aviation operating system and evaluation method based on stochastic Petri net

Technical field

The invention belongs to aviation operating system performance assessment technique field, relate to a kind of HM/FM modeling of layering aviation operating system and evaluation method based on stochastic Petri net.

Background technology

Synthesization avionics (IMA) is current airborne equipment Development Trend, and it can effectively reduce life cycle cost (LLC), improve the performance of airborne equipment and make things convenient for the updating maintenance of soft hardware equipment.Compare with the association type avionics, a notable feature of synthesization avionics is function " software implementation ", promptly utilizes software on general hardware platform, to realize the function of original specialized hardware.

Health monitoring/fault management in the synthesization avionics (HM/FM) function is used for the assurance system when software fault occurring, still can run well.The health monitoring module is responsible for identification, location and is reported software fault.Fault management module then is responsible for taking some measures and is carried out fault and get rid of.

Modern avionics system generally all adopts the structure of layering, so that the influence of minimization system bottom transfer pair upper level applications.At present, also to the achievement of the quantitative analysis of the HM/FM of layering avionics operating system.And these analysis results have great reference significance for the avionics operating system of design implementation high-performance high reliability.The target of this patent addresses this problem exactly.

Stochastic Petri net is information handling system to be described one of mathematical tool with modeling.The key property of stochastic Petri net comprises: concurrency, uncertainty, asynchronous and to the descriptive power and the analysis ability of distributed system are a kind of patterned modeling description tools.Stochastic Petri net has very strong model analysis ability, can be applied in the middle of the modeling and evaluation of complication system such as network etc.

Summary of the invention

In order to overcome the deficiency of above-mentioned prior art; The object of the present invention is to provide a kind of HM/FM modeling of layering aviation operating system and evaluation method based on stochastic Petri net; This method can be set up the stochastic Petri pessimistic concurrency control to the layering avionics system according to reality; And the method that adopts the time order of magnitude to decompose carries out approximate solution to model, at last each monitored object in the system carried out fail-safe analysis.

To achieve these goals, the technical scheme of the present invention's employing is:

HM/FM modeling of layering aviation operating system and evaluation method based on stochastic Petri net may further comprise the steps:

Step 1 is set up the stochastic Petri pessimistic concurrency control of all component, comprises monitored object model, HM model and FM model,

Wherein,

Monitored object model is divided into simple object and coupling object,

Simple object is meant independent monitored object; Represent that by a bright state Petri net delay parameter of working transition is set to the mean free error time of this object, in case object gets into the state that breaks down; Do not having under the situation of foreign intervention, it can't return normal operating conditions;

Coupling object is divided into the AND/OR coupling object and propagates coupling object, and the working transition of AND/OR coupling object are transition immediately, utilizes the guard function to keep the synchronized relation of " with or " mistake; Propagating coupling object expresses with time transition propagating and relevant guard function;

The HM model has reflected the behavior of health monitoring module, comprises this layer poll, lower floor's poll and response, and this layer poll is meant the periodically monitored object of poll current layer of HM model; If do not find mistake; Then return,, then excite the FM model of current layer if find mistake; And return, the HM model is accepted the error reporting that lower floor's FM model sends over simultaneously; Lower floor's poll is meant the poll of being initiated by the downward one deck of HM model, and awaits a response, and when response is returned, then transition Replied takes place, if do not find fault, then returns idle condition.If find fault, it can excite the FM module and return; Response is meant that the HM model receives the polling request of upper strata HM model, the health and fitness information of intelligence-collecting object, and information returned to upper strata HM model;

The FM model is reported formation by a series of failure processors and a fault and is in series successively; First failure processor receives the FM model from the HM model and excites request; At first, it checks whether its monitored object of being responsible for is positioned at normal operating conditions, if; Then skip maintenance process, and get into next failure processor; Otherwise, fault object is keeped in repair, if the maintenance failure then will be keeped in repair failure information and put fault report formation into, fault is reported formation and is collected all maintenance failure informations, and notice upper strata HM model, next failure processor carries out this course of work in order;

Step 2, carry out the combination of model:

Three standards are followed in the model combination; Be fault coupling scheme, layer coupling mode and the FM mode of excitation of system object; The fault coupling scheme of system object are divided into coupling of AND/OR fault and fault propagation coupling; The layer coupling mode is non-for not carrying out lower floor's poll and carry out lower floor's poll, and the FM mode of excitation is divided into this layer FM and excites with the FM of lower floor and excite, according to the coupling scheme of these physical systems; Petri net model in the step 1 is coupled together, make up complete stochastic Petri pessimistic concurrency control;

Step 3 is carried out abbreviation to complete stochastic Petri pessimistic concurrency control and is found the solution, and method is following:

Step 3.1, the speed according to transition are implemented is divided into two set with all transition, and promptly fast enforcement is gathered and is implemented set slowly, and wherein all Working transition all are transition at a slow speed, and other transition all are quick transition;

Step 3.2 is similar to and thinks that all transition of implementing in the set slowly all can not trigger the Petri submodel that obtains separating;

Step 3.3, the probability of stability of finding the solution the Petri submodel of separation distributes, and with the transition firing rate of this Petri submodel that obtains compressing;

Step 3.4, the probability of stability of finding the solution the Petri submodel of compression distributes;

Step 4, model is carried out A+E:

Step 4.1, the availability of define system and average reflection time two kinds of metric;

Step 4.2 utilizes the probability of stability of resulting compression submodel in the step 3.4 to distribute, and calculates above two kinds and refers to target value, carries out performance evaluation.

In the said step 3, the Petri submodel of each separation is compressed into a position, promptly substitutes the Petri submodel of described separation, and the transition between the submodel are kept, obtained the Petri pessimistic concurrency control of a compression with a position.

It is to utilize general stochastic Petri net method for solving to draw that the probability of stability of the Petri submodel of said separation distributes, and promptly at first tries to achieve the reachability graph of Petri net, and the transfer rate between definite reachability graph; Secondly, foundation is based on reachability graph's Markov process continuous time; At last, to continuous time Markov process find the solution, then can obtain the probability of stability of former Petri pessimistic concurrency control.

The method of the transition firing rate order of magnitude service time classification of the Petri submodel of said compression obtains: try to achieve the probability of stability of each Petri net model, and according to these probability, obtain the transition firing rate of compact model.

The probability of stability of the Petri submodel of said compression distributes and utilizes general stochastic Petri net method for solving to draw, and promptly at first tries to achieve the reachability graph of Petri net, and the transfer rate between definite reachability graph; Secondly, foundation is based on reachability graph's Markov process continuous time; At last, to continuous time Markov process find the solution, then can obtain the probability of stability of former Petri pessimistic concurrency control.

Compare with existing network performance evaluation method, the invention has the advantages that:

1) set up the submodel of system component, can flexibly submodel have been made up, obtained the complete model of system, i.e. " dirigibility " according to the architecture of real system.

2) model is carried out approximate solution, can handle fairly large real system, be i.e. " finding the solution of complex model ".

Description of drawings

Fig. 1 is a layering aviation operating system synoptic diagram.

Fig. 2 is independent monitored object and propagation coupling fault figure.

Fig. 3 is a complicated AND/OR coupling fault figure.

Fig. 4 is a HM module stochastic Petri net illustraton of model.

Fig. 5 is a FM module stochastic Petri net illustraton of model.

The poll interactive mode figure that Fig. 6 possibly take for system.

Fig. 7 is three layers of complete HM/FM instance model figure.

The HM submodel figure of Fig. 8 for decomposing.

Fig. 9 is the system model figure of compression.

Embodiment

Below in conjunction with accompanying drawing and embodiment the present invention is explained further details.

(1), as shown in Figure 1, set up the logical model of real system, a HM model and FM model are arranged in every layer;

(2), confirm the mode of communication between each layer and the call relation between the HM/FM, the mechanism that the hard objectives system is taked, as shown in Figure 2.Fig. 2-a is the mechanism that does not have lower floor's poll, and this mechanism is the simplest; Fig. 2-b is lower floor's poll, calls the mechanism of this layer FM after the discovery fault; This mechanisms consume resource is bigger, but can obtain system reliability preferably; Fig. 2-c is lower floor's poll, calls the mechanism of the FM of lower floor after the discovery fault, and its performance and system overhead are all between preceding two kinds of mechanism;

(3),,, set up the stochastic Petri pessimistic concurrency control of system, comprise monitored object model, HM model and FM model according to aforementioned rule according to the logical model of system and the mechanism of being taked,

Wherein,

Object model is divided into simple object and coupling object,

Simple object is meant independent monitored object, and its model representes that by a bright state Petri net position on representes this object operate as normal shown in Fig. 3 left-half, and position off representes that this object breaks down.The delay parameter of working transition is set to the mean free error time (MTTF) of this object, in case object gets into the state that breaks down, is not having under the situation of foreign intervention, and it can't return normal operating conditions;

Coupling object is divided into the AND/OR coupling object and propagates coupling object, and the propagate errors model is expressed propagate errors with time transition propagating and relevant guard function shown in Fig. 3 right half part.With or wrong waveform as shown in Figure 4, its working transition be transition immediately generally speaking, utilize the guard function keep with or the synchronized relation of mistake.

The HM model has reflected the behavior of health monitoring module, and is as shown in Figure 5, and it comprises this layer poll (CQ), lower floor's poll (SQ) and responds (RP); This layer of poll (CQ) is meant the periodically monitored object (Query_C) of poll current layer of HM model, if do not find mistake, then returns (No_Error_C); If find mistake; Then excite the FM model of current layer, and return (Return2), the HM model is accepted the error reporting that lower floor's FM model sends over simultaneously; Lower floor's poll is meant the poll (Query_S and the arc 5 of leaving away) of being initiated by the downward one deck of HM model, and awaits a response, and returns (getting into arc 6) when response, and then transition Replied takes place, if do not find fault, then returns idle condition (No_Error_S).If find fault, otherwise it can excite the FM module and return (Activate_FM2); Respond (RP) and be meant that the HM model receives the polling request of upper strata HM model (getting into arc 1), the health and fitness information of intelligence-collecting object (Collecting), and information returned to upper strata HM model (Reply with leave away arc 2);

The FM model is as shown in Figure 6; Report formation by a series of failure processors and a fault and be in series successively, first failure processor receives the FM model from the HM model and excites request (getting into arc 1), at first; It checks whether its monitored object of being responsible for is positioned at normal operating conditions; If then skip maintenance process (No_Error), and get into next failure processor (Next_Handler); Otherwise, fault object is keeped in repair (Fixing), maintenance process is (Success) successfully, and (Fail) also possibly fail.If the maintenance failure then will be keeped in repair failure information and put fault report formation into.Fault is reported formation and is collected all maintenance failure informations (getting into arc 2), and notice upper strata HM (arc 3 of leaving away).Upper strata HM can excite corresponding FM to handle the problem of these maintenance failures, and next failure processor carries out this course of work in order.

(4), confirm the delay and the probability parameter of all transition in the model.

Transition delay and probability generally obtain through measuring real system.

(5), define system reliability and other performance metrics.

Reliability and performance isometry generally can draw according to the probability of stability of the Petri pessimistic concurrency control of being set up.

(6), operate time order of magnitude decomposition technique carries out abbreviation to model, obtains compact model.

Method is following:.

At first, the speed according to transition are implemented is divided into two set with all transition, and promptly fast enforcement is gathered and implemented set slowly, and wherein all Working transition all are transition at a slow speed, and other transition all are quick transition;

Secondly, be similar to all transition of thinking in implementing slowly to gather and all can not trigger the Petri submodel that obtains separating;

Then, the probability of stability of finding the solution the Petri submodel of separation distributes, and with the transition firing rate of this Petri submodel that obtains compressing;

At last, find the solution the probability of stability distribution of the Petri submodel of compression.

The probability of stability distributes and utilizes general stochastic Petri net method for solving to draw, and promptly at first tries to achieve the reachability graph of Petri net, and the transfer rate between definite reachability graph; Secondly, foundation is based on reachability graph's Markov process continuous time; At last, to continuous time Markov process find the solution, then can obtain the probability of stability of former Petri pessimistic concurrency control.

(7), utilize compact model, approximate performance metric of being entangled with definition in the step (5).

An object lesson: layered operating system health monitoring/fault management modeling and the evaluation method that proposes among utilization the present invention based on stochastic Petri net, the layered operating system HM/FM in the ASSAC of NATO standard is carried out modeling.

Total system is divided into three layers, is respectively aircraft layer (AC), integrated avionics layer (IA) and resource element layer (RE).System adopts lower floor's poll, excites the FM of lower floor strategy.The SPN model of this system is as shown in Figure 7.

Two objects of AC layer object and IA layer are AND fault coupled relation; IA layer object 1 is OR fault coupled relation with two object of RE layer; IA layer object 2 is the fault propagation coupled relation with RE layer object 1; Two objects of RE layer are standalone object.

Utilize time order of magnitude decomposition technique, the HM submodel that at first can obtain decomposing, as shown in Figure 8, and the model of compression, as shown in Figure 9.From the HM submodel that decomposes, can calculate parameter shown in the table 1.These parameters can help to carry out approximate solution.

Table 1

1) the bottom transition postpone.We provide and calculate d _{Repar_b_1_c}, i.e. the method for transition Repar_b_1_c delay.The delay of transition Repair_b_1_c, Repair_b_2_c is also capable of using to be obtained with quadrat method.

At first, observe maintenance process following possible path arranged:

Path 1, bottom HM has found fault through this layer poll, and has excited bottom FM to come maintenance failure.

Path 1.1, bottom FM success maintenance failure;

Path 1.2, the failure of bottom FM maintenance failure will be failed to report and give middle level HM, and excited middle level FM, middle level FM success maintenance failure;

Path 1.3, identical with path 1.2, but the not successful yet maintenance failure of middle level FM, report fault to top layer FM this moment, and excite top layer FM, top layer FM success maintenance failure.

Path 2, middle level HM has found fault through lower floor's poll, and has excited bottom FM to come maintenance failure.

Identical with path 1.1, bottom FM success maintenance failure;

Identical with path 1.2, middle level FM success maintenance failure;

Identical with path 1.3, top layer FM success maintenance failure.

At this moment, can get d _{Repair_b_1_c}=∑ P _i* T _i, P wherein _iWith T _iBe respectively the probability that maintenance process is path i, with path i spent averaging time.There is following result to set up

P _1.1＝P _CQb×W _{Success_b_1}

P _1.2＝P _CQb×W _{Failed_b_1}×W _{Success_m_2}

P _1.3＝P _CQb×W _{Failed_b_1}×W _{Failed_m_2}

P _2.1＝P _SQm×W _{Success_b_1}

P _2.2＝P _SQm×W _{Failed_b_1}×W _{Success_m_2}

P _2.3＝P _SQm×W _{Failed_b_1}×W _{Failed_m_2}

T _iRelevant with state probability, can calculate as follows:

T _1.1＝d _{Activate_FM1_b}+d _{Fixing_b_1}

$T_{1.2}=\left\{\begin{array}{c}{T}_{1.1}+T_m+d_{\mathrm{Fixing}\_m\_2},\mathrm{if}\#\mathrm{off}\_m\_1=0\\ T_{1.1}+T_m+d_{\mathrm{Fixing}\_m\_1}+d_{\mathrm{Fixing}\_m\_2},\mathrm{if}\#\mathrm{off}\_m\_1=1\end{array}\right.$

T _1.3＝T _1.2+T _t+d _{Fixing_t}

T _2.1＝d _{Activate_FM2_m}+d _{Fixing_b_1}

$T_{2.2}=\left\{\begin{array}{c}{T}_{2.1}+T_m+d_{\mathrm{Fixing}\_m\_2},\mathrm{if}\#\mathrm{off}\_m\_1=0\\ T_{2.1}+T_m+d_{\mathrm{Fixing}\_m\_1}+d_{\mathrm{Fixing}\_m\_2},\mathrm{if}\#\mathrm{off}\_m\_1=1\end{array}\right.$

T _2.3＝T _2.2+T _t+d _{Fixing_t}

Wherein,

$T_n=\frac{d_{\mathrm{Sub}\_\mathrm{Report}\_m}}{\#\mathrm{Idle}\_m=1}+d_{\mathrm{Activate}\_\mathrm{<figure-callout\; id="1"\; label="FM"\; filenames="HDA0000127361810000011.png,HDA0000127361810000012.png"\; state="\{\{state\}\}">FM</figure-callout>}1\_m}$

$T_t=\frac{d_{\mathrm{Sub}\_\mathrm{Report}\_t}}{\#\mathrm{Idle}\_t=1}+d_{\mathrm{Activate}\_\mathrm{<figure-callout\; id="1"\; label="FM"\; filenames="HDA0000127361810000011.png,HDA0000127361810000012.png"\; state="\{\{state\}\}">FM</figure-callout>}1\_t}$

2) middle level and top layer transition postpone.The generation of middle level transition Repair_b_1_c postpones and can be calculated by same method, and unique difference is that fault can only be handled by middle level or top layer HM/FM.Transition Repair_m_2_c and Repair_t_1_c need not to revise, because these are to liking the coupling of AND/OR fault, these transition can only be played synchronous effect.

3) definition of tolerance.The unavailability of object is defined as the probability that object is positioned at the down state, and its expression formula does

P(#on_m_1＝1)

P(#on_m_2＝1)

Lower floor's poll stand-by period, be defined as upper strata HM required stand-by period when the HM of poll lower floor.Utilize the little theorem, can get its expression formula and do

$E(\#P17)\&times;(P(\#\mathrm{idle}\_m=1|\#\mathrm{Error}\_\mathrm{Report}\_\mathrm{pool}\_b=0)\&times;\frac{{\mathrm{\&lambda;}}_{\mathrm{Timer}\_s\_\mathrm{<figure-callout\; id="2"\; label="m"\; filenames="HDA0000127361810000011.png,HDA0000127361810000012.png"\; state="\{\{state\}\}">m</figure-callout>}}^2}{{\mathrm{\&lambda;}}_{\mathrm{Timer}\_S\_m}+{\mathrm{\&lambda;}}_{\mathrm{Timer}\_C\_m}}$

$+P(\#\mathrm{idle}\_m=1|\#\mathrm{Error}\_\mathrm{Report}\_\mathrm{pool}\_b>0)\&times;\frac{{\mathrm{\&lambda;}}_{\mathrm{Timer}\_s\_\mathrm{<figure-callout\; id="2"\; label="m"\; filenames="HDA0000127361810000011.png,HDA0000127361810000012.png"\; state="\{\{state\}\}">m</figure-callout>}}^2}{{\mathrm{\&lambda;}}_{\mathrm{Timer}\_S\_m}+{\mathrm{\&lambda;}}_{\mathrm{Timer}\_C\_m}+{\mathrm{\&lambda;}}_{\mathrm{Sub}\_\mathrm{Report}\_m}})$

Thereby can carry out model analysis and quantitative performance evaluation.

More than, specifically describe with reference to the accompanying drawing specific embodiments of the invention, but should not assert that practical implementation of the present invention is confined to these explanations.For those skilled in the art, not breaking away under the present invention's design and the prerequisite, can also make some simple deduction or replace the protection domain that claims limited, all should be regarded as belonging to protection scope of the present invention.

Claims (5)

1. based on the HM/FM modeling of layering aviation operating system and the evaluation method of stochastic Petri net, it is characterized in that, may further comprise the steps:

Step 1 is set up the stochastic Petri pessimistic concurrency control of all component, comprises monitored object model, HM model and FM model,

Wherein,

Monitored object model is divided into simple object and coupling object,

Simple object is meant independent monitored object; Represent that by a bright state Petri net delay parameter of working transition is set to the mean free error time of this object, in case object gets into the state that breaks down; Do not having under the situation of foreign intervention, it can't return normal operating conditions;

Coupling object is divided into the AND/OR coupling object and propagates coupling object, and the working transition of AND/OR coupling object are transition immediately, utilizes the guard function to keep the synchronized relation of " with or " mistake; Propagating coupling object expresses with time transition propagating and relevant guard function;

The HM model has reflected the behavior of health monitoring module, comprises this layer poll, lower floor's poll and response, and this layer poll is meant the periodically monitored object of poll current layer of HM model; If do not find mistake; Then return,, then excite the FM model of current layer if find mistake; And return, the HM model is accepted the error reporting that lower floor's FM model sends over simultaneously; Lower floor's poll is meant the poll of being initiated by the downward one deck of HM model, and awaits a response, and when response is returned, then transition Replied takes place, if do not find fault, then returns idle condition, if find fault, it can excite the FM module and return; Response is meant that the HM model receives the polling request of upper strata HM model, the health and fitness information of intelligence-collecting object, and information returned to upper strata HM model;

The FM model is reported formation by a series of failure processors and a fault and is in series successively; First failure processor receives the FM model from the HM model and excites request; At first, it checks whether its monitored object of being responsible for is positioned at normal operating conditions, if; Then skip maintenance process, and get into next failure processor; Otherwise, fault object is keeped in repair, if the maintenance failure then will be keeped in repair failure information and put fault report formation into, fault is reported formation and is collected all maintenance failure informations, and notice upper strata HM model, next failure processor carries out this course of work in order;

Step 2, carry out the combination of model:

Three standards are followed in the model combination; Be fault coupling scheme, layer coupling mode and the FM mode of excitation of system object; The fault coupling scheme of system object are divided into coupling of AND/OR fault and fault propagation coupling; The layer coupling mode is non-for not carrying out lower floor's poll and carry out lower floor's poll, and the FM mode of excitation is divided into this layer FM and excites with the FM of lower floor and excite, according to the coupling scheme of these physical systems; Petri net model in the step 1 is coupled together, make up complete stochastic Petri pessimistic concurrency control;

Step 3 is carried out abbreviation to complete stochastic Petri pessimistic concurrency control and is found the solution, and method is following:

Step 3.1, the speed according to transition are implemented is divided into two set with all transition, and promptly fast enforcement is gathered and is implemented set slowly, and wherein all Working transition all are transition at a slow speed, and other transition all are quick transition;

Step 3.2 is similar to and thinks that all transition of implementing in the set slowly all can not trigger the Petri submodel that obtains separating;

Step 3.3, the probability of stability of finding the solution the Petri submodel of separation distributes, and with the transition firing rate of this Petri submodel that obtains compressing;

Step 3.4, the probability of stability of finding the solution the Petri submodel of compression distributes;

Step 4, model is carried out A+E:

Step 4.1, the availability of define system and average reflection time two kinds of metric;

Step 4.2 utilizes the probability of stability of resulting compression submodel in the step 3.4 to distribute, and calculates above two kinds and refers to target value, carries out performance evaluation.

2. the method for estimating according to claim 1; It is characterized in that; In the said step 3, the Petri submodel of each separation is compressed into a position, promptly substitutes the Petri submodel of described separation with a position; And, obtained the Petri pessimistic concurrency control of a compression with the reservation of the transition between the submodel.

3. the method for estimating according to claim 1; It is characterized in that; It is to utilize general stochastic Petri net method for solving to draw that the probability of stability of the Petri submodel of said separation distributes, and promptly at first tries to achieve the reachability graph of Petri net, and the transfer rate between definite reachability graph; Secondly, foundation is based on reachability graph's Markov process continuous time; At last, to continuous time Markov process find the solution, then can obtain the probability of stability of former Petri pessimistic concurrency control.

4. the method for estimating according to claim 1; It is characterized in that; The method of the transition firing rate order of magnitude service time classification of the Petri submodel of said compression obtains: the probability of stability of trying to achieve each Petri net model; And, obtain the transition firing rate of compact model according to these probability.

5. the method for estimating according to claim 1; It is characterized in that; The probability of stability of the Petri submodel of said compression distributes and utilizes general stochastic Petri net method for solving to draw, and promptly at first tries to achieve the reachability graph of Petri net, and the transfer rate between definite reachability graph; Secondly, foundation is based on reachability graph's Markov process continuous time; At last, to continuous time Markov process find the solution, then can obtain the probability of stability of former Petri pessimistic concurrency control.

Images