CN118034016A - Dual-redundancy input signal twice monitoring voting method - Google Patents

Abstract

The present application belongs to the field of redundancy management technology, and particularly relates to a method for twice monitoring and voting of dual-redundancy input signals. The method includes step S1, periodically monitoring the effective bit of the signal to determine whether the effective bit of the signal is effective; step S2, when the effective bit of the signal is effective, periodically monitoring whether the floating point number is illegal; step S3, when the floating point number is legal, periodically monitoring the signal jump to determine whether the signal jump occurs; step S4, performing the primary and standby selection of the dual-redundancy signal, determining the first voting value, and performing a second vote on the first voting values of the four voting modules to determine the second voting value. The present application improves the reliability of the four-redundancy monitoring voting and ensures the flight safety of the aircraft.

Description

A double-redundancy input signal double monitoring voting method

Technical Field

The present application belongs to the field of redundancy management technology, and in particular relates to a double-redundancy input signal double monitoring and voting method.

Background technique

The redundancy management of the four-redundancy system is an important part of the aircraft management system design. In a highly integrated aircraft management system, the signal monitoring logic is complex. By designing a signal comprehensive effectiveness monitoring method, it is of great significance to simplify the signal monitoring logic of redundancy management.

In order to simplify equipment and management, usually only two equipment sources are set up, which do not correspond one to one with the four redundant systems. The current four redundant systems have the problem of voting confusion, that is, the data of the two equipment sources need to be sent to the four redundant systems respectively, and the four redundant systems vote.

Summary of the invention

In order to solve the above problems, the present application provides a double-redundancy input signal twice monitoring and voting method to solve the monitoring and voting problem of the signal generated by the two-redundancy device source in the four-redundancy system.

The double-redundancy input signal double monitoring voting method provided by the present application mainly includes:

Step S1, periodically monitoring the signal valid bit to determine whether the signal valid bit is valid. When the signal valid bit is invalid, the redundancy signal is marked as invalid.

Step S2, when the signal valid bit is valid, periodically monitor whether the floating point number is illegal, when the floating point number is illegal, perform illegal floating point number counting, suspend signal jump monitoring, when the illegal floating point number count exceeds the set value, the redundancy signal is marked as invalid, and all monitoring is stopped;

Step S3, when the floating point number is legal, periodically monitor the signal jump. For two continuously collected signals, if the difference exceeds the set value, it is determined that the signal jumps. When two consecutive signal jumps occur, the signal jump count is performed. When the signal jump count exceeds the set value, the redundancy signal is marked as invalid and all monitoring is stopped.

Step S4, input the dual redundancy signal into each voting module in the quad-redundancy system respectively, in each voting module, perform primary and standby selection of the dual redundancy signal according to the redundancy signal mark, determine the first voting value, perform secondary voting on the first voting values of the four voting modules, and determine the second voting value.

Preferably, in step S1 to step S3, the monitoring period is 20 ms.

Preferably, in step S1, the state of the signal valid bit is set to have a recoverable property, and when the signal valid bit changes from invalid to valid, the floating point number illegal count and the signal jump count are cleared.

Preferably, in step S2, after the illegal counting of floating-point numbers begins, an illegal number transient fault is marked, and before the illegal counting of floating-point numbers exceeds a set value, if the floating-point number is legal, the illegal counting of floating-point numbers is cleared, and in the illegal number transient fault state, the previous beat signal value at the start of the illegal counting of floating-point numbers is used to participate in subsequent voting.

Preferably, in step S3, for continuous quantity signals, the set value is 50% of the maximum range, and for discrete quantity and enumerated quantity, the set value is 0.

Preferably, in step S3, after the signal jump count starts, the signal jump transient fault is marked, and when the data returns to normal during the jump transient fault, the jump fault counter is cleared, and in the signal jump transient fault state, the upper beat value at the start of the signal jump count is used to participate in subsequent voting.

Preferably, in step S4, in each voting module, when the dual-redundancy signals are marked as invalid, the corresponding voting module channel fails, and a secondary vote is performed based on the remaining voting modules. When there are three or four voting module channel failures, the preset safety value is used as the second voting value.

Preferably, in step S4, when performing secondary voting, when both the dual redundancy signals of a voting module have illegal number transient faults or signal jump transient faults, for continuous quantity signals, the current beat signal is used for secondary voting, and for enumerated quantity and discrete quantity signals, the previous beat signal is used for secondary voting.

This application improves the reliability of quadruple-redundancy monitoring voting and ensures the flight safety of the aircraft.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flow chart of a preferred embodiment of the double-redundancy input signal double-monitoring voting method of the present application.

Detailed ways

In order to make the purpose, technical scheme and advantages of the implementation of this application clearer, the technical scheme in the implementation of this application will be described in more detail in combination with the drawings in the implementation of this application. In the drawings, the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The described implementation is a part of the implementation of this application, not all of the implementations. The implementation described below with reference to the drawings is exemplary and is intended to be used to explain this application, and cannot be understood as a limitation on this application. Based on the implementation in this application, all other implementations obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. The implementation of this application is described in detail below in combination with the drawings.

The present application provides a double-redundancy input signal double monitoring voting method, as shown in FIG1 , mainly comprising:

Step S1, periodically monitoring the signal valid bit to determine whether the signal valid bit is valid. When the signal valid bit is invalid, the redundancy signal is marked as invalid.

Step S2, when the signal valid bit is valid, periodically monitor whether the floating point number is illegal, when the floating point number is illegal, perform illegal floating point number counting, suspend signal jump monitoring, when the illegal floating point number count exceeds the set value, the redundancy signal is marked as invalid, and all monitoring is stopped;

Step S3, when the floating point number is legal, periodically monitor the signal jump. For two continuously collected signals, if the difference exceeds the set value, it is determined that the signal jumps. When two consecutive signal jumps occur, the signal jump count is performed. When the signal jump count exceeds the set value, the redundancy signal is marked as invalid and all monitoring is stopped.

Step S4, input the dual redundancy signal into each voting module in the quad-redundancy system respectively, in each voting module, perform primary and standby selection of the dual redundancy signal according to the redundancy signal mark, determine the first voting value, perform secondary voting on the first voting values of the four voting modules, and determine the second voting value.

The present application addresses the problem of monitoring and voting on signals generated by two redundant device sources in a four-redundancy system. First, each voting module in the four-redundancy system receives the signals generated by two redundant device sources respectively. During data transmission, each voting module can determine whether each redundant signal is valid according to steps S1 to S3. For example, if the voting module B1 determines that the redundant signal A1 is valid and the redundant signal A2 is invalid, then the value of the redundant signal A1 is used as the first voting value of the voting module B1. When the voting module B2 determines that the redundant signal A1 is valid and the redundant signal A2 is valid, then according to a preset primary-backup selection algorithm, one of them is determined to be the primary signal and the other is the secondary signal. For example, the redundant signal A1 is used as the primary signal and its value is used as the first voting value of the voting module B2.

Then the four voting modules process the first voting values recognized by them based on the secondary voting, for example, excluding the maximum and minimum values, and averaging the remaining two values to obtain the second voting value for subsequent operations. In this embodiment, the secondary voting algorithm can adopt the existing redundancy voting algorithm.

In some optional implementations, in step S1 to step S3, the monitoring period is 20 ms.

In some optional implementations, in step S1, the signal valid bit state is set to have a recoverable attribute, and when the signal valid bit changes from invalid to valid, the floating point number illegal count and the signal jump count are cleared.

In the above two embodiments, the signal valid bit monitoring is time-free and recoverable, the monitoring period is 20ms, and the monitoring method is to determine whether the signal valid bit is valid. When the signal valid bit is invalid, the signal is invalid. The signal valid bit state is not latched (recoverable). The signal valid bit failure is recorded and the valid bit monitoring of the signal continues, and the illegal number and jump of the input signal are no longer monitored. After the signal valid bit is restored to valid, the signal returns to normal, and the counters for illegal number and jump monitoring are cleared.

In some optional embodiments, in step S2, after the illegal counting of the floating point number begins, an illegal number transient fault is marked. Before the illegal counting of the floating point number exceeds the set value, the floating point number is legal, and the illegal counting of the floating point number is cleared. In the illegal number transient fault state, the previous beat signal value when the illegal counting of the floating point number begins is used to participate in subsequent voting.

In this embodiment, when the signal valid bit is valid, the floating point number is monitored to see if it is an illegal number (the source code is determined by the software), and the monitoring period is 20ms. If an illegal number appears in the signal and the signal failure reaches N times in a row (determined according to the specific situation), the signal is considered to have a permanent failure, and the signal illegal number permanent failure is latched. The software records transient faults and permanent faults. When the data is normal during a transient fault, the fault counter is cleared, and it cannot be recovered after a permanent fault. After the illegal number monitoring is completed, the normal floating point number needs to be converted to integer data immediately. When an illegal number transient fault occurs, the signal jump monitoring is no longer performed, and the illegal number cannot be used in any subsequent process. The previous signal value is directly used.

In some optional implementations, in step S3, for continuous quantity signals, the set value is 50% of the maximum range, and for discrete quantities and enumerated quantities, the set value is 0.

In this embodiment, for continuous quantities, the difference between the current beat value and the previous beat value is monitored. If it exceeds 50% of the maximum range (the maximum value of the absolute value of the signal range), a jump occurs. For discrete quantities and enumerated quantities, the current beat value and the previous beat value are monitored for consistency. If they are inconsistent, a jump occurs.

In some optional implementations, in step S3, after the signal jump count starts, the signal jump transient fault is marked, and when the data returns to normal during the jump transient fault, the jump fault counter is cleared, and in the signal jump transient fault state, the upper beat value at the start of the signal jump count is used to participate in subsequent voting.

In this embodiment, if two consecutive transitions are satisfied, the transition fault counter increases from 0 to 1, and then the transition fault counter increases by 1. In case of transient fault, the previous value is taken to participate in the vote. The signal transition monitoring period is 20ms. If the signal transient fault reaches N times in a row (determined according to the specific situation), the signal is considered to be a permanent fault, and the signal transition permanent fault is latched. When the data returns to normal during the transition transient fault, the transition fault counter is cleared; when the signal valid bit and illegal number transient fault are restored, the transition fault is counted again.

In some optional embodiments, in step S4, in each voting module, when the dual redundancy signals are all marked as invalid, the corresponding voting module channel fails, and a secondary vote is performed based on the remaining voting modules. When there are three or four voting module channel failures, the preset safety value is used as the second voting value.

In this embodiment, if only one voting module's signal channel is valid, or when all four redundancies fail, comparative monitoring cannot be performed, and the signal is directly judged as a failure, and a safe value is selected as the second voting value for output. If a singular failure occurs in the four voting module signal channels, and after a certain delay, the monitoring algorithm determines that all the signals fail, and the safe value is also taken as the second voting value for output.

In some optional implementations, in step S4, when performing secondary voting, when both dual-redundancy signals of a voting module have illegal number transient faults or signal jump transient faults, for continuous quantity signals, the current beat signal is used for secondary voting, and for enumerated quantity and discrete quantity signals, the previous beat signal is used for secondary voting.

This application improves the reliability of quadruple-redundancy monitoring voting and ensures the flight safety of the aircraft.

The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims (8)

1. A method for twice monitoring and voting of a dual-redundancy input signal, characterized by comprising: Step S1, periodically monitoring the signal valid bit to determine whether the signal valid bit is valid. When the signal valid bit is invalid, the redundancy signal is marked as invalid. Step S2, when the signal valid bit is valid, periodically monitor whether the floating point number is illegal, when the floating point number is illegal, perform illegal floating point number counting, suspend signal jump monitoring, when the illegal floating point number count exceeds the set value, the redundancy signal is marked as invalid, and all monitoring is stopped; Step S3, when the floating point number is legal, periodically monitor the signal jump. For two continuously collected signals, if the difference exceeds the set value, it is determined that the signal jumps. When two consecutive signal jumps occur, the signal jump count is performed. When the signal jump count exceeds the set value, the redundancy signal is marked as invalid and all monitoring is stopped. Step S4, input the dual redundancy signal into each voting module in the quad-redundancy system respectively, in each voting module, perform primary and standby selection of the dual redundancy signal according to the redundancy signal mark, determine the first voting value, perform secondary voting on the first voting values of the four voting modules, and determine the second voting value. 2. The method for twice monitoring and voting on a dual-redundancy input signal as claimed in claim 1, wherein in steps S1 to S3, the monitoring period is 20 ms. 3. The double-redundancy input signal double-monitoring voting method as described in claim 1 is characterized in that in step S1, the signal valid bit state is set to have a recoverable attribute, and when the signal valid bit changes from invalid to valid, the floating point number illegal count and the signal jump count are cleared. 4. The double-redundancy input signal twice monitoring voting method as described in claim 1 is characterized in that in step S2, after the illegal counting of the floating point number begins, the illegal number transient fault is marked, and before the illegal counting of the floating point number does not exceed the set value, the floating point number is legal, then the illegal counting of the floating point number is cleared, and in the illegal number transient fault state, the previous beat signal value when the illegal counting of the floating point number begins is used to participate in subsequent voting. 5. The method for twice monitoring and voting of dual-redundancy input signals as claimed in claim 1, characterized in that in step S3, for continuous quantity signals, the set value is 50% of the maximum range, and for discrete quantities and enumerated quantities, the set value is 0. 6. The dual-redundancy input signal double monitoring voting method as described in claim 1 is characterized in that, in step S3, after the signal jump counting starts, the signal jump transient fault is marked, and when the data returns to normal during the jump transient fault, the jump fault counter is cleared, and in the signal jump transient fault state, the upper beat value at the start of the signal jump counting is used to participate in subsequent voting. 7. The dual-redundancy input signal twice monitoring voting method as described in claim 1 is characterized in that in step S4, in each voting module, when the dual-redundancy signals are all marked as invalid, the corresponding voting module channel fails, and a secondary vote is performed based on the remaining voting modules. When there are three or four voting module channel failures, a preset safety value is used as the second voting value. 8. The method for twice monitoring and voting on dual-redundancy input signals as described in claim 1 is characterized in that, in step S4, when performing secondary voting, when the dual-redundancy signals of a certain voting module all have illegal number transient faults or signal jump transient faults, for continuous quantity signals, the current beat signal is used for secondary voting, and for enumerated quantity and discrete quantity signals, the previous beat signal is used for secondary voting.