Monitor performance analysis

1. A system, comprising:

a processor;

a memory system in communication with the processor, the memory system storing instructions that when executed by the processor result in the system being operable to:

identify a system hazard boundary of a monitored system and a system nuisance boundary of the monitored system;

determine a must-trip condition based on the system hazard boundary and a must-not-trip condition based on the system nuisance boundary;

conduct a tolerance stack-up at the must-trip condition to calculate a first estimation error; and

output a protection margin for the monitored system based on the system hazard boundary, the first estimation error and a difference between the must-trip condition and the must-not-trip condition; and

a monitor of the monitored system, the monitor being configured to receive a monitored input from the monitored system, and, based on the monitored input, trip before the monitored system exceeds the system hazard boundary.

2. The system of claim 1 , wherein the system is further operable to calculate a threshold protection limit based on a difference between the must-trip condition and the first estimation error.

3. The system of claim 2 , wherein the protection margin for the monitored system comprises a ratio of a difference between the threshold protection limit and a selected threshold divided by the difference between the must-trip condition and the must-not-trip condition.

4. The system of claim 2 , wherein the system is further operable to output a nuisance margin for the monitored system based on the system nuisance boundary and the difference between the must-trip condition and the must-not-trip condition.

5. The system of claim 4 , wherein the system is further operable to conduct a tolerance stack-up at the must-not-trip condition to calculate a second estimation error.

6. The system of claim 5 , wherein the system is further operable to calculate a threshold nuisance limit based on a difference between the must-not-trip condition and the second estimation error.

7. The system of claim 6 , wherein the nuisance margin for the monitored system comprises a ratio of a difference between the selected threshold and the threshold nuisance limit divided by the difference between the must-trip condition and the must-not-trip condition.

8. The system of claim 7 , wherein the system is further operable to perform a margin check of the selected threshold relative to the threshold protection limit and the selected threshold relative to the threshold nuisance limit.

9. The system of claim 8 , wherein the system is further operable to perform a design guidance check to confirm that a ratio of a difference between the selected threshold and the threshold nuisance limit divided by the second estimation error exceeds a minimum value.

10. The system of claim 9 , wherein the design guidance check further comprises confirming that a selected confirmation time exceeds a minimum confirmation value.

11. The system of claim 10 , wherein the design guidance check further comprises confirming that a difference between the protection margin and the nuisance margin is less than a margin difference threshold.

12. The system of claim 11 , wherein a corrective action is initiated based on a determination that one or more of the margin check and the design guidance check are not satisfied.

13. The system of claim 12 , wherein the corrective action is one of: a requirements change for the monitored system, a design change to the monitored system, or a reviewed and confirmed deviation.

14. The system of claim 1 , wherein the monitored system is a control system of an aircraft.

15. The system of claim 1 , wherein the system is further operable to confirm that a selected confirmation time for the monitored system is between a nuisance confirmation time limit and a protection confirmation time limit.

16. The system of claim 1 , wherein the system is further operable to record results for multiple monitored systems.

17. A method for performance analysis of a monitor of a monitored system, the method comprising:

identifying a system hazard boundary of the monitored system and a system nuisance boundary of the monitored system;

determining a must-trip condition based on the system hazard boundary and a must-not-trip condition based on the system nuisance boundary;

conducting a tolerance stack-up at the must-trip condition to calculate a first estimation error;

outputting a protection margin for the monitored system based on the system hazard boundary, the first estimation error and a difference between the must-trip condition and the must-not-trip condition;

receiving, at the monitor of the monitored system, a monitored input from the monitored system; and

causing tripping of the monitor before the monitored system exceeds the system hazard boundary based on the monitored input.

18. The method of claim 17 , further comprising:

calculating a threshold protection limit based on a difference between the must-trip condition and the first estimation error.

19. The method of claim 18 , wherein the protection margin for the monitored system comprises a ratio of a difference between the threshold protection limit and a selected threshold divided by the difference between the must-trip condition and the must-not-trip condition.

20. The method of claim 18 , further comprising:

outputting a nuisance margin for the monitored system based on the system nuisance boundary and the difference between the must-trip condition and the must-not-trip condition.

21. The method of claim 20 , further comprising:

conducting a tolerance stack-up at the must-not-trip condition to calculate a second estimation error.

22. The method of claim 21 , further comprising:

calculating a threshold nuisance limit based on a difference between the must-not-trip condition and the second estimation error.

23. The method of claim 22 , wherein the nuisance margin for the monitored system comprises a ratio of a difference between the selected threshold and the threshold nuisance limit divided by the difference between the must-trip condition and the must-not-trip condition.

24. The method of claim 23 , further comprising:

performing a margin check of the selected threshold relative to the threshold protection limit and the selected threshold relative to the threshold nuisance limit.

25. The method of claim 24 , further comprising:

performing a design guidance check to confirm that a ratio of a difference between the selected threshold and the threshold nuisance limit divided by the second estimation error exceeds a minimum value.

26. The method of claim 25 , wherein the design guidance check further comprises confirming that a selected confirmation time exceeds a minimum confirmation value.

27. The method of claim 26 , wherein the design guidance check further comprises confirming that a difference between the protection margin and the nuisance margin is less than a margin difference threshold.

28. The method of claim 27 , wherein a corrective action is initiated based on a determination that one or more of the margin check and the design guidance check are not satisfied.

29. The method of claim 28 , wherein the corrective action is one of: a requirements change for the monitored system, a design change to the monitored system, or a reviewed and confirmed deviation.

30. The method of claim 17 , wherein the monitored system is a control system of an aircraft.

31. The method of claim 17 , further comprising:

confirming that a selected confirmation time for the monitored system is between a nuisance confirmation time limit and a protection confirmation time limit.

32. The method of claim 17 , further comprising:

recording results for multiple monitored systems.

33. A computer program product for performance analysis of a monitor of a monitored system, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code readable/executable by a computer, processor or logic circuit to perform a method comprising:

identifying a system hazard boundary of the monitored system and a system nuisance boundary of the monitored system;

determining a must-trip condition based on the system hazard boundary and a must-not-trip condition based on the system nuisance boundary;

outputting a protection margin for the monitored system based on the system hazard boundary and a difference between the must-trip condition and the must-not-trip condition; and

causing tripping of the monitor before the monitored system exceeds the system hazard boundary based on a monitored input from the monitored system.

34. A system comprising:

a processor;

a memory system in communication with the processor, the memory system storing instructions that when executed by the processor result in the system being operable to:

identify a system hazard boundary of a monitored system and a system nuisance boundary of the monitored system;

determine a must-trip condition based on the system hazard boundary and a must-not-trip condition based on the system nuisance boundary;

confirm that a selected confirmation time for the monitored system is between a nuisance confirmation time limit and a protection confirmation time limit; and

output a protection margin for the monitored system based on the system hazard boundary and a difference between the must-trip condition and the must-not-trip condition; and

a monitor of the monitored system, the monitor being configured to receive a monitored input from the monitored system, and, based on the monitored input, trip before the monitored system exceeds the system hazard boundary.

35. A method for performance analysis of a monitor of a monitored system, the method comprising:

identifying a system hazard boundary of the monitored system and a system nuisance boundary of the monitored system;

determining a must-trip condition based on the system hazard boundary and a must-not-trip condition based on the system nuisance boundary;

confirming that a selected confirmation time for the monitored system is between a nuisance confirmation time limit and a protection confirmation time limit;

outputting a protection margin for the monitored system based on the system hazard boundary and a difference between the must-trip condition and the must-not-trip condition;

receiving, at the monitor of the monitored system, a monitored input from the monitored system; and

causing tripping of the monitor before the monitored system exceeds the system hazard boundary based on the monitored input.