DE102010018186B4 - Method for error detection of an unmanned missile coupled to a carrier aircraft in a wing flight and unmanned missile - Google Patents

Abstract

Method for error detection of an unmanned missile (1) coupled to a carrier aircraft (2) in aerofoil, - the missile (1) having a central on-board computer (30) on which control software for operating the missile stored in a program memory (34) (1) can be executed, and has a volatile working memory (32) and a non-volatile, reprogrammable data memory (33), - the missile (1) having a first energy supply (42) for electrical energy which is fed by the carrier aircraft (2) ; - The missile (1) has a second, autonomous energy supply (44) for electrical energy which can be supplied with electrical energy by an energy store (5) provided in the missile (1), and - wherein the energy store (5) in the missile ( 1) supplies the missile (1) with electrical energy via the second energy supply (44) when the missile (1) receives a corresponding activation signal from a weapon control computer (29) in the carrier aircraft (2); characterized by the steps of: a) carrying out a triggered and periodic system check of the missile (1) in aerofoil while the missile (1) is supplied with energy by the carrier aircraft (2) via the first energy supply (42); b) detecting error data occurring in the missile during this system check and storing this error data in the volatile working memory (32); c) generating a mission abort signal when a fatal error occurs; d) copying the error data stored in the main memory (32) into at least one free memory segment of the non-volatile data memory (33), for example a flash memory, as soon as a fatal error leading to a mission termination has been detected and stored in the main memory; e) delayed transmission of the mission abort signal to the weapon control computer (29) of the carrier aircraft (2) after the copying process in step d) and f) then switching off the first energy supply (42).

Description

TECHNICAL AREA

The present invention relates to a method for error detection during a system test or during the periodic functional check of a flightplane coupled to a carrier aircraft, unmanned missile according to the preamble of claim 1. It further relates to an unmanned missile according to the preamble of claim. 6

Before an unmanned missile is decoupled from a carrier aircraft and fired, a system test of the components of the missile is carried out, independently initiated or triggered by the carrier aircraft, while it is still coupled to the carrier aircraft. After the fault-free system test, the subsystems and assemblies of the missile are then periodically checked for correct function. A clearance of the missile for firing is granted only after successfully passed system test and error-free operation during subsequent operation.

During the system test and also after the system test, the missile is still supplied with electrical energy via the umbilical cable connecting it to the carrier aircraft. If the system test has been successfully completed and no malfunction has subsequently been identified by the cyclic tests, in the case of the firing event the carrier aircraft sends among other things a signal to the missile which activates an autonomous energy source provided in the missile, for example a thermal battery. which then takes over the power supply of the missile, before disconnecting the missile from the carrier aircraft, the power supply is interrupted by the carrier aircraft.

If a fatal error occurs during the system test or during the periodic functional tests, that is to say an error which inevitably leads to the termination of the mission, the missile is not disconnected from the carrier aircraft and also the autonomous energy storage of the missile is not put into operation if the mission abort does not occur within the departure sequence (decoupling the missile from the carrier aircraft). In addition, the power supply from the carrier aircraft to the missile is shut off during the mission abort, so that the missile receives no electrical energy and is thus free from external electrical voltage.

This energy shutdown of the missile causes the volatile memory is not supplied with energy and thus the memory contents in the volatile memory of the central onboard computer of the missile including all stored there error information is lost. This in turn means that after the landing of the carrier aircraft no detailed picture of the error situation (fault pattern) is present and thus no conclusions can be drawn on the reason of the mission cancellation.

STATE OF THE ART

So far, a tape data recorder has been installed in such a case instead of the warhead provided in the missile, so that then after one or more further test flights, in which the error possibly occurred again, corresponding error data were stored on the data recorder. This procedure is extremely cumbersome because the missile must be retrofitted each time and the necessary to retrofit expansion of a part of the weapon, namely the warhead, must be made under high safety conditions.

From the DE 10 2006 054 340 A1 A method is known for checking the ability to interact between an aircraft and an armed, unmanned missile that can be coupled thereto. This known verification method consists of three phases, namely first an isolated test of the missile and an independent test of the weapon station of the aircraft and then, after attaching the missile to the aircraft, a test of the missile on the aircraft with the aircraft on the ground , The correct function of both the missile and the weapon station of the missile (one at a time) and the correct interaction of missile and aircraft are to be determined before the mission starts before the aircraft with the missile attached thereto starts a mission. Occurs in the third test section of this known method, so when testing the mounted on the aircraft missile in the state an error, so a corresponding error signal at the maintenance interface of the missile to an external visualization means, such as a monitor or a computer output.

From the DE 10 2006 041 140 B4 A method for verifying the operability of unmanned, armed missiles is known, in which a ground-based missile is checked by means of a test device. The missile is not attached to a carrier aircraft. The test device simulates a mission and any errors that occur during the test are output to the test device via an interface of the missile.

The EP 0 286 988 A2 relates to a method with a device for testing missile systems. In this test method, the missile software is tested in laboratory mode on a test device, wherein interface data for subsequent verification of the missile software are stored in real time in the test device.

PRESENTATION OF THE INVENTION

Object of the present invention is therefore to provide a generic method for detecting errors, which is ensured even without conversion of the missile that after the occurrence of a fatal error that has led to a mission abort, the corresponding error data for a root cause analysis by the on Ground-waiting service team are available.

Another object is to provide an unmanned missile which makes it possible to apply a method solving the above problem.

The object directed to the method is achieved by the features specified in claim 1.

• – wobei der Flugkörper einen zentralen Bordcomputer, auf dem eine in einem Programmspeicher gespeicherte Steuerungssoftware für den Betrieb des Flugkörpers ablaufbar ist, und einen flüchtigen Arbeitsspeicher und einen nichtflüchtigen, reprogrammierbaren Datenspeicher aufweist,
• – wobei der Flugkörper eine erste Energiezufuhr für elektrische Energie aufweist, die vom Trägerflugzeug gespeist wird;
• – wobei der Flugkörper eine zweite, autonome Energiezufuhr für elektrische Energie aufweist, die von einem im Flugkörper vorgesehenen Energiespeicher mit elektrischer Energie beaufschlagbar ist, und
• – wobei der Energiespeicher im Flugkörper den Flugkörper über die zweite Energiezufuhr mit elektrischer Energie versorgt, wenn der Flugkörper von einem Waffensteuerungscomputer im Trägerflugzeug ein entsprechendes Aktivierungssignal erhält;
• werden die folgenden Schritte durchgeführt:
• a) Durchführen einer ausgelösten und periodischen Systemüberprüfung des Flugkörpers im Tragflug während der Flugkörper über die erste Energiezufuhr vom Trägerflugzeug mit Energie versorgt wird;
• b) Erfassen von während dieser Systemüberprüfung im Flugkörper auftretenden Fehlerdaten und Speichern dieser Fehlerdaten im flüchtigen Arbeitsspeicher;
• c) Erzeugen eines Missionsabbruchsignals beim Auftreten eines fatalen Fehlers;
• d) Kopieren der im Arbeitsspeicher gespeicherten Fehlerdaten in zumindest ein freies Speichersegment des nichtflüchtigen Datenspeichers (beispielsweise Flash-Speicher), sobald ein zu einem Missionsabbruch führender fataler Fehler erfasst und im Arbeitsspeicher abgespeichert worden ist;
• e) verzögertes Übertragen des Missionsabbruchsignals an den Waffensteuerungscomputer des Trägerflugzeugs nach Abschluss des Kopiervorgangs in Schritt d) und
• f) danach Abschalten der ersten Energiezufuhr.

In this method according to the invention for error detection of an unmanned missile coupled in a carrying flight on a carrier aircraft,

• - wherein the missile has a central on-board computer, on which a stored in a program memory control software for the operation of the missile is expired, and a volatile memory and a non-volatile, reprogrammable data memory,
• - wherein the missile has a first power supply for electrical energy, which is fed by the carrier aircraft;
• - Wherein the missile has a second, autonomous energy supply for electrical energy, which is acted upon by an energy storage device provided in the missile with electrical energy, and
• - The energy storage in the missile supplies the missile via the second power supply with electrical energy when the missile receives a corresponding activation signal from a weapon control computer in the carrier aircraft;
• The following steps are performed:
• a) performing a triggered and periodic system inspection of the missile in the wing flight while the missile is powered by the first power supply from the carrier aircraft with energy;
• b) detecting error data occurring in said missile during said system check and storing said error data in said volatile random access memory;
• c) generating a mission abort signal upon the occurrence of a fatal error;
• d) copying the error data stored in the main memory into at least one free memory segment of the non-volatile data memory (for example flash memory) as soon as a fatal error resulting in a mission abort has been detected and stored in the main memory;
• e) delayed transmission of the mission termination signal to the weapon control computer of the carrier aircraft after completion of the copying process in step d) and
• f) then switching off the first power supply.

ADVANTAGES

The idea on which the present invention is based is therefore to use one or more free sectors of the nonvolatile, reprogrammable data memory provided in the onboard computer of the missile for storing the error information. For this purpose, when a fatal error occurs, which must result in a mission abort, the mission abort signal is not transmitted immediately from the onboard computer of the missile to the weapon control computer of the carrier aircraft, but this mission abort signal is transmitted only with such a slight delay to the weapon control computer of the carrier aircraft, the sufficient is to allow during this delay, the transmission of the error data stored in the volatile memory in the nonvolatile data memory. If the mission is then terminated by the weapon control computer of the carrier aircraft after receiving the mission abort signal and the electrical energy supply from the carrier aircraft to the missile is switched off, the error data contained in the volatile main memory of the missile computer is deleted, but not its copy in the non-volatile reprogrammable data memory. The service crew on the ground can therefore read the fault data from the non-volatile memory after landing the carrier aircraft and make appropriate service or repair work on the missile.

A particularly advantageous use of the method according to the invention is carried out in a check flight, wherein the transmission of the activation signal for the energy storage of the missile is prevented by the weapon control computer of the carrier aircraft to the missile. In such verification flights, a special Umbilical cable is usually used, in which the control signal for the energy storage (for example, the ignition signal 'Release Consent' for a thermal battery) transmitting line is interrupted and in which, for safety reasons, also that line is interrupted, which transmits the energy for the activation of the energy storage. By using the method according to the invention in such checking flights, an improved knowledge gain during the checking flight can be achieved in a systematic manner.

It is particularly advantageous if, in addition to the fatal error triggering the mission termination, also module-specific data of the assembly causing the mission termination as well as error-relevant data of other modules are stored in the non-volatile data memory. This makes it possible to carry out a precise analysis of the causes of the fatal error and thus makes it easier for service personnel to identify the actual defect that led to the fatal error.

In addition, it is advantageous if non-fatal errors (preferably from other or all subassemblies of the missile) that occurred before the mission abort are stored in the nonvolatile data memory. In this way, the history of the fatal flaw is mapped and thus obtained an even more complete picture of the fault situation of the missile. The service personnel on the ground can thus draw conclusions about the overall condition of the missile, which is a prerequisite for the efficient identification of the triggering cause of the mission and its side effects. In addition, other sources of error can be detected and eliminated, which could otherwise lead to fatal errors and thus to mission cancellation in a later flight.

This knowledge gain is further enhanced by the fact that in addition to the error data also general data of the missile describing the state of the missile at the time of mission abort (eg position, altitude above ground, speed, Euler angle, UTC time, internal time, internal mode etc .), are stored in the non-volatile data memory.

• – allgemeine Daten, die den Zustand des Flugkörpers zum Zeitpunkt des Missionsabbruchs beschreiben,
• – die Kennung der den Missionsabbruch bewirkenden Baugruppe,
• – baugruppenspezifische Daten der den Missionsabbruch bewirkenden Baugruppe sowie fehlerrelevante Daten anderer Baugruppen des Flugkörpers,
• – alle vor dem Missionsabbruch aufgetretenen nicht-fatalen Fehler aller Baugruppen des Flugkörpers.

Thus, if appropriate, the following data groups are stored in the non-volatile data memory of the missile and display the error situation causing the mission abortion as a fault image:

• - general data describing the state of the missile at the time of the mission crash,
• The identifier of the assembly causing the mission termination,
• - module-specific data of the mission-aborting module as well as error-relevant data of other subassemblies of the missile,
• - all non-fatal flaws of all sub assemblies of the missile that occurred before the mission crash.

If the method according to the invention is used for operational exercises or operations, where an operational umbilical cable is used, and if a missile is detected as defective during flight, targeted examination and repair measures can subsequently be initiated on the ground on the basis of the fault pattern read to make the missile ready for use as soon as possible.

All of these measures significantly increase the availability of the missiles operated using the method according to the invention and noticeably reduce the effort required to troubleshoot a fatal error that has occurred.

The task directed to the missile is achieved by the unmanned missile having the features of patent claim 6.

This unmanned missile according to the invention comprises a central on-board computer on which a stored in a memory control software for the operation of the missile is expired and a volatile memory and a non-volatile, reprogrammable data memory (usually flash memory) has. The missile has a first energy supply for electrical energy, which is fed by a carrier aircraft, to which the missile is coupled in Tragflugzustand. The missile also has a second energy supply for electrical energy, which is fed by an autonomous energy storage provided in the missile. This energy store is designed such that it supplies the missile with electrical energy via the second energy supply when the missile receives a corresponding activation signal from a weapon control computer in the carrier aircraft.

The running on the onboard computer of the missile control software is designed so that before the uncoupling of the missile from the carrier aircraft, for example, in a triggered or cyclic system check, occurring in the missile technical error data recorded and stored as a fault image in memory and that this stored error image in the event of a mission crash, stored in a free segment of the nonvolatile data memory before the electrical energy conducted by the carrier aircraft over the first power supply to the missile is switched off. This also applies to an erroneous mission termination during the departure sequence.

Preferably, the fault storage in the nonvolatile data memory takes place only when the mission abort has been triggered by an internal missile-occurring error.

Further preferably, no error storage in the non-volatile memory data more, if the separation of the missile has been recognized by the carrier aircraft.

It is also advantageous if the error storage in the non-volatile memory only takes place when the missile is in communication with the carrier aircraft in communication.

If the control software has sensed the separation of the missile from the carrier aircraft (free-flight phase), advantageously no error image storage takes place in the nonvolatile data memory. During the free flight of the missile usually the cyclic function monitoring of the modules is turned off and thus blocks the possibility of mission abort.

The control software is also designed so that it stores error images in the non-volatile memory only if it has clearly recognized that it communicates with the carrier aircraft, so not with a test device or a mission plan charger. If a tester interacts with the missile, identifying a fatal flaw in the missile, the associated flaw is transmitted directly to the tester so that caching in the missile is no longer necessary.

An additional feature of the control software is that several fault images can be stored one behind the other in the non-volatile data memory of the missile, for example as a linked list.

It is also advantageous if the reading out of error data from the non-volatile data memory can only be carried out if the missile is in communication connection with a test device. The reading of stored in the non-volatile memory data error images therefore allows the control software only if they are with the test device, as for example in the unpublished DE 10 2008 054 264 A1 is shown communicates, preferably after a fault-free run-up in the mode standby (for missiles with sporadic errors) or in the mission termination mode (for missiles with permanent errors).

A further feature of the control software is that the deletion of error data in the nonvolatile data memory can only be carried out if the missile is in communication with a test device and has proven to be faultless immediately before it. The deletion of the error images in the non-volatile data memory is therefore only possible if the software has clearly recognized that it communicates with the test device. The deletion can only at the end of a successfully passed test, for example, a D-level test, as in the unpublished DE 10 2009 040 303 A1 is described, done.

Another advantageous feature of the control software is that it consists of two independent parts: an operational part and a test part, the operational part being designed to interact with the carrier aircraft and to execute the fault storage in the nonvolatile data memory, and the test part is formed is to interact with a test device and to perform the reading of the error data from the non-volatile memory and the deletion of the non-volatile data memory. In doing so, the operational part that interacts with the carrier aircraft executes the writing of the fault images into the nonvolatile data memory. The test part that communicates with the tester is responsible for reading and erasing the error images from the nonvolatile data memory.

Preferably, the operational part and the test part of the control software can alternatively be stored in the program memory of the on-board computer.

In an alternative preferred embodiment, the operational part and the test part of the control software can be stored simultaneously in the program memory of the on-board computer and independently of each other.

The operational part and the test part of the control software can thus alternatively be stored in the on-board computer or independently of each other in the on-board computer and be retrievable.

In a preferred embodiment of the missile according to the invention, the fault storage in the non-volatile data memory only occurs when the mission abort has been triggered by an error occurring inside the missile. This variant has the advantage that, for example, in the case of a mission termination triggered manually, for example, by the crew of the carrier aircraft, there is no time delay since the transmission of the data from the volatile main memory into the nonvolatile data memory is not necessary in this case.

This missile according to the invention is particularly suitable for carrying out the method according to the invention.

Preferred embodiments of the invention with additional design details and other advantages are described and explained in more detail below with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

It shows:

1 a schematic representation of an aircraft coupled to an unmanned missile according to the invention;

2 a block diagram of the relevant components of a coupled to an aircraft unmanned missile according to the invention and

3 a schematic representation of the shares of the control software.

PRESENTATION OF PREFERRED EMBODIMENTS

The missile 1 is on a carrier aircraft shown schematically 2 coupled. The carrier plane 2 has a bomb pylon on its hull bottom or on the underside of a wing 20 on that in 1 partially shown cut. The bomb pylon 20 is partially open on its underside and in this area inside the bomb pylon 20 with two releasable holding devices 22 . 22 ' provided with two corresponding counterhold devices 13 . 13 ' consisting of an upper support element 11 of the missile 1 protrude, engage and the missile 1 on the carrier plane 2 decoupled fix. In the area of the open bottom of the bomb pylon 20 is an aircraft-side electrical connector 26 provided with a mating connector 17 at the top of the missile 1 mechanically and electrically connected to the transmission of energy and data exchange.

The missile 1 is still with an avionics 3 provided, which is also shown only schematically and located in the interior of the fuselage 10 located. The avionics 3 of the missile is with an onboard computer 30 provided, via the mating connector 17 at the top of the missile 1 and the carrier-aircraft-side electrical connector 26 by means of an umbilical cable 27 with an on-board computer 28 the carrier aircraft 2 is connected for data exchange. The on-board computer 28 contains a weapon control computer 29 , About the umbilical cable 27 becomes the missile 1 from the carrier plane 2 in the wing flight also supplied with electrical energy.

The missile 1 has an autonomous electrical power supply that comes from an irreversibly activated battery 5 is formed. Usually, this is irreversibly activated battery 5 a thermal battery coming from a weapon control computer 29 of the carrier plane 2 applied electric pulse can be activated and then emits a predetermined amount of electrical energy for a predetermined period of time.

In 2 is a schematic functional diagram of a carrier aircraft 2 coupled missile 1 shown, its avionics 3 an on-board computer 30 that is at the top of the missile 1 provided mating connector 17 for the umbilical cable 27 connected is. The on-board computer 30 has a processor 31 , a volatile memory 32 , a nonvolatile, reprogrammable data store 33 and a program memory 34 on. The computer 30 is via a first data line 35 with the mating connector 17 at the top of the missile 1 and thus with the umbilical cable 27 and about this with the on-board computer 28 of the carrier plane 2 connected to data between the onboard computer 28 of the carrier plane 2 and the on-board computer 30 of the missile 1 to be able to exchange. The on-board computer 28 of the carrier plane 2 is via a data line 24 with the connector 26 and with the umbilical cable 27 connected.

Furthermore, the umbilical cable 27 over the connector 26 with a power supply line 25 of the carrier plane 2 connected by a source of electrical energy (not shown).

The so in the umbilical cable 27 fed electrical energy is in the mating connector 17 of the missile 1 to a supply line 40 an energy supply structure 4 delivered in the missile. In this way, a first energy supply 42 for the energy supply structure shown only schematically in the figures 4 of the missile 1 educated.

The autonomous electrical power supply of the missile 1 by means of the irreversibly activatable battery 5 forms a second, autonomous electrical energy supply 44 for the missile 1 , This is the battery 5 via a power supply line 46 also with the energy supply structure 4 of the missile 1 connected. The irreversibly activated battery 5 is via a data transmission line 50 with the mating connector 17 of the missile 1 and thus with the over the umbilical cable 27 and the data line 24 with the on-board computer 28 of the carrier plane 2 provided weapons control computer 29 directly connected or indirectly via an intermediary control unit. The weapon control computer 29 can via this connection one or more activation signals to the irreversibly activated battery 5 Send or to the intermediate controller to put them into operation. In the test setup shown in the figures, a special umbilical cable provided for a system test in a training flight may be used 27 ' be provided, in which this connection between the data line 50 and the weapon control computer 29 is interrupted. This ensures that the irreversibly activated battery 5 during a training or inspection flight can not be accidentally activated. It will be described below how the method according to the invention for error detection during a system test of the unmanned missile coupled in the wing flight to the carrier aircraft 1 is carried out.

During the flight and thereby carried out review of the individual subsystems of the missile 1 becomes the missile 1 through the first energy supply 42 from the carrier plane 2 energized. The system check is done by one on the processor 31 of the on-board computer 30 running software running with the weapon control computer 29 of the carrier plane 2 interacts. Occur during the triggered or periodic system check in the missile 1 Errors, these errors are in the on-board computer 30 of the missile 1 captured and initially in memory 32 stored together with information about in which assembly of the missile the error has occurred stored. Furthermore, in the working memory operating state data of the missile 1 and its individual components.

• – die allgemeine Daten, die den Zustand des Flugkörpers zum Zeitpunkt des Missionsabbuches kennzeichnen und
• – die Kennung der den Missionsabbruch bewirkenden Baugruppe und
• – die baugruppenspezifische Daten der den Missionsabbruch bewirkenden Baugruppe sowie fehlerrelevante Daten anderer Baugruppen des Flugkörpers und
• – alle vor dem Missionsabbruch aufgetretenen nicht-fatale Fehler aller Baugruppen des Flugkörpers,

als Fehlerbild in den nichtflüchtigen Datenspeicher 33 kopiert. Ist dieser Kopiervorgang abgeschlossen, so wird das Missionsabbruchsignal vom Bordcomputer 30 des Flugkörpers 1 an den Waffensteuerungscomputer 29 des Trägerflugzeugs 2 übertragen und der Waffensteuerungscomputer 29 schaltet die erste, vom Trägerflugzeug 2 gespeiste Energiezufuhr 42 ab. Da im Testmodus der Anordnung aus Trägerflugzeug 2 und Flugkörper 1 das spezielle Umbilical-Kabel 27' verbaut ist, kann kein Aktivierungssignal zur irreversibel aktivierbaren Batterie 5 des Flugkörpers gesandt werden, so dass auch diese Energieversorgung abgeschaltet bleibt und der Flugkörper einen Betriebszustand einnimmt, in dem er nicht mehr von elektrischer Energie versorgt ist.If a fatal error occurs during the triggered or cyclic system check, which must result in a mission crash, the on-board computer will 30 of the missile 1 the internal mission termination state was taken. Thus, the existing in the volatile memory error data, ie

• The general data identifying the condition of the missile at the time of the mission check - out and
• The identifier of the assembly causing the abortion and
• - The module-specific data of the mission termination causing assembly and error-related data of other assemblies of the missile and
• - all non-fatal flaws of all assemblies of the missile that occurred before the mission crash,

as a fault image in the non-volatile data memory 33 copied. When this copying process is completed, the mission abort signal from the on-board computer 30 of the missile 1 to the weapon control computer 29 of the carrier plane 2 Transfer and the weapon control computer 29 turns off the first, from the carrier plane 2 powered energy supply 42 from. Since in test mode the arrangement of carrier aircraft 2 and missiles 1 the special umbilical cable 27 ' is installed, no activation signal to the irreversibly activated battery 5 be sent to the missile so that this power supply remains switched off and the missile assumes an operating state in which it is no longer supplied by electrical energy.

By having the mission abort signal not immediately upon detection of the mission abort to the weapon control computer 29 of the carrier plane 2 is transmitted, but only when the transfer of data from the main memory 32 in the nonvolatile data storage 33 is completed, it ensures that the for the failure analysis on the ground after the landing of the carrier aircraft 2 required error information is no longer in the deleted by the loss of electrical power supply memory 32 but in the non-volatile memory 33 ,

Will a mission in the operational configuration of the unit from carrier aircraft 2 and missiles 1 performed in which the fully assembled umbilical cable 27 is provided, and takes place during the departure sequence, for example, the mission termination with activated battery 5 of the missile 1 (Hangfire situation), the saving of the error image in the non-volatile memory 33 even then run because of self-supply when the carrier plane 2 for other reasons, the power supply stops even before the on-board computer 30 of the missile 1 sent the mission abort signal.

After the ground staff the non-volatile data storage 33 With the aid of the test device, it can store this memory or at least the area of this data memory 33 in which the failure data and the operating condition data of the missile 1 have been saved, delete specifically. Conveniently, this is only possible when the missile 1 after repair by a soil test, for example, a so-called D-level test, again proves to be faultless.

The from the non-volatile data storage 33 Data read-out can be compared by ground personnel, for example, with fault images stored in a fault database in order to identify the cause of the fatal fault quickly and accurately.

The exporting control software of the on-board computer 30 can be pronounced in different ways, as integrated software or, as exemplified in 3 shown as consisting of independent parts, namely an operational part and a test part, existing software. In the case of integrated software, software performs the writing, reading and erasing of the nonvolatile, reprogrammable data memory. In the other case, the operational part that interacts with the carrier aircraft executes the writing of the failure images into the nonvolatile data memory. The test part that communicates with the tester is responsible for reading and erasing the error images from the nonvolatile data memory. The operational part and the test part can alternatively be stored in the program memory 34 of the on-board computer 30 loadable or independent of each other in the program memory 34 the on-board computer stored and be available.

LIST OF REFERENCE NUMBERS

1

missile

2

carrier aircraft

3

Avionics

4

Energy supply structure

5

battery

10

hull

11

supporting member

13

Backup device

13 '

Backup device

17

Against connector

20

bomb pylon

22

holder

22 '

holder

24

data line

25

Power line

26

Connectors

27

Umbilical cable

27 '

Umbilical cable

28

board computer

29

Weapons control computer

30

board computer

31

processor

32

volatile memory

33

non-volatile, reprogrammable memory

34

program memory

35

data line

40

supply line

42

first energy intake

44

second energy supply

46

Power line

50

Data transmission line

Claims (14)

Method for error detection of a flying surface on a carrier aircraft ( 2 ) coupled, unmanned missile ( 1 ), The missile ( 1 ) a central on-board computer ( 30 ), on which one in a program memory ( 34 ) stored control software for the operation of the missile ( 1 ) is executable, and a volatile memory ( 32 ) and a non-volatile, reprogrammable data store ( 33 ), wherein the missile ( 1 ) a first energy supply ( 42 ) for electrical energy emitted by the carrier aircraft ( 2 ) is fed; - whereby the missile ( 1 ) a second, autonomous energy supply ( 44 ) for electrical energy emitted by a missile ( 1 ) provided energy store ( 5 ) can be acted upon with electrical energy, and - wherein the energy storage ( 5 ) in the missile ( 1 ) the missile ( 1 ) via the second energy supply ( 44 ) supplied with electrical energy when the missile ( 1 ) from a weapon control computer ( 29 ) in the carrier aircraft ( 2 ) receives a corresponding activation signal; characterized by the steps of: a) performing a triggered and periodic missile system inspection ( 1 ) in the wing flight during the missile ( 1 ) about the first energy supply ( 42 ) from the carrier aircraft ( 2 ) is supplied with energy; b) detecting error data occurring in the missile during this system check in the missile and storing this error data in the volatile random access memory ( 32 ); c) generating a mission abort signal upon the occurrence of a fatal error; d) copying the in-memory ( 32 ) stored error data in at least one free memory segment of the non-volatile data memory ( 33 ), for example, a flash memory, as soon as a fatal error leading to a mission termination has been detected and stored in the main memory; e) delayed transmission of the mission abort signal to the weapon control computer ( 29 ) of the carrier aircraft ( 2 ) after completion of the copying process in step d) and f) then switching off the first energy supply ( 42 ). A method according to claim 1, characterized in that the mission abort signal only to the weapon control computer ( 29 ) of the carrier aircraft ( 2 ) is transmitted when the transmission the data from the RAM ( 32 ) into the nonvolatile data memory ( 33 ) is completed. A method according to claim 1 or 2, characterized in that the method is carried out in a verification flight, wherein the transmission of the activation signal for the energy storage ( 5 ) of the missile ( 1 ) from the weapon control computer ( 29 ) of the carrier aircraft ( 2 ) to the missile ( 1 ) is prevented. Method according to claim 1, 2 or 3, characterized in that, in addition to the catastrophic fatal error, module-specific errors of that subassembly of the missile ( 1 ) in the non-volatile data memory ( 32 ) in which the fatal error has occurred. Method according to one of the preceding claims, characterized in that non-fatal errors, preferably from all assemblies of the missile ( 1 ), which occurred before the mission crash, in non-volatile memory ( 33 ) are stored. Method according to one of the preceding claims, characterized in that in addition to the error data also general data of the missile, which describe the state of the missile at the time of the mission abort, in the non-volatile data memory ( 33 ) are stored. Unmanned missile with a central on-board computer ( 30 ), on which one in a memory ( 34 ) stored control software for the operation of the missile ( 1 ) is executable and the one volatile memory ( 32 ) and a non-volatile, reprogrammable data store ( 33 ), wherein the missile ( 1 ) a first energy supply ( 42 ) for electrical energy emitted by a carrier aircraft ( 2 ) to which the missile ( 1 ) is coupled in Tragflugzustand; - whereby the missile ( 1 ) a second, autonomous energy supply ( 44 ) for electrical energy emitted by a missile ( 1 ) provided energy store ( 5 ), and - wherein the energy store ( 5 ) in the missile ( 1 ) is configured so that it the missile ( 1 ) via the second energy supply ( 44 ) supplied with electrical energy when the missile ( 1 ) from a weapon control computer ( 29 ) in the carrier aircraft ( 2 ) receives a corresponding activation signal; characterized in that - on the on-board computer ( 30 ) running control software is designed in such a way that • before the uncoupling of the missile ( 1 ) from the carrier aircraft ( 2 ), for example in the case of a triggered or cyclical system check, in the missile ( 1 ) occurring technical error data and recorded as a fault image in the volatile memory ( 32 ) stores, in the case of a generated mission abort signal, this stored error image into a free memory segment of the non-volatile data memory ( 33 ) and that the mission abort signal is sent to the weapon control computer ( 29 ) of the carrier aircraft ( 2 ) after completion of the copying process and that of the carrier aircraft ( 2 ) about the first energy supply ( 42 ) to the missile ( 1 ) conducted electrical energy is then turned off. Unmanned missile according to claim 7, characterized in that the fault storage in the non-volatile data memory ( 33 ) takes place only when the mission abort has been triggered by an internal missile-occurring error. Unmanned missile according to claim 7 or 8, characterized in that no error storage in the non-volatile data memory ( 33 ) occurs more when the separation of the missile from the carrier aircraft has been detected. Unmanned missile according to claim 7, 8 or 9, characterized in that the error storage in the non-volatile data memory ( 33 ) takes place only when the missile is in communication with the carrier aircraft. Unmanned missile according to one of claims 7 to 10, characterized in that the reading of error data from the non-volatile data memory ( 33 ) is only feasible if the missile is in communication with a test device. Unmanned missile according to one of claims 7 to 11, characterized in that the deletion of error data in the non-volatile data memory ( 33 ) is only feasible if the missile is in communication with a test device and has proven immediately before it to be faultless. Unmanned aerial vehicle according to one of claims 7 to 12, characterized in that the control software consists of two independent parts, the operational part and the test part, wherein the operational part is designed to interact with the carrier aircraft and the fault storage in the non-volatile data memory ( 33 ), and wherein the test part is designed to interact with a test device and to read the error data from the nonvolatile data memory ( 33 ) as well as the deletion of the non-volatile data memory ( 33 ). Unmanned missile according to claim 13, characterized in that the operational part and the test part of the control software alternatively in the program memory ( 34 ) of the on-board computer or that the operational part and the test part of the control software are simultaneously stored in the program memory ( 34 ) of the on-board computer storable and can be called independently.

Images