EP1020699B1 - Missile - Google Patents

Description

• (a) Elemente des Flugkörpers redundant vorgesehen sind und
• (b) der Flugkörper Mittel zur Fehlerdetektion aufweist
  Ein Flugkörper ist ein Teil eines Waffensystems. Der Flugkörper wird zu einem Ziel geführt. Das kann z.B. durch eine Navigationseinheit oder durch einen Suchkopf erfolgen, der das Ziel erfaßt und Lenksignale erzeugt. Der Flugkörper ist unbemannt. Die Flugzeit des Flugkörpers vom Abschuß bis zum Treffer ist relativ kurz. Das Flugführungssystem des Flugkörpers, z.B. mit Suchkopf oder Navigationseinheit, ist daher nur kurze Zeit tatsächlich in Funktion.
  Bemannte Flugzeuge arbeiten mit einer Vielzahl von Sensoren und sicherheitsrelevanten Bauteilen. Flugzeuge sind über längere Zeit im Einsatz. Der Ausfall eines Sensors oder sicherheitsrelevanten Bauteils während des Einsatzes kann zu einem Absturz des Flugzeugs führen. Aus diesem Grunde ist es bekannt, sicherheitsrelevante Elemente einschließlich der Software von Flugreglern redundant vorzusehen und Mittel zur Fehlererkennung, Fehleridentifikation und Rekonfiguration (FDIR) zu verwenden. Es wird dann der Ausfall eines Sensors oder ein Defekt an einem Sensor erkannt, es wird ermittelt welcher Sensor oder welches Element ausgefallen oder defekt ist, und es wird dann der ausgefallene oder defekte Sensor oder das defekte Element abgeschaltet und es werden nur die übrigen Sensoren oder Elemente für die Flugführung benutzt.
  Die DE-39 29 404 A1 zeigt ein Beispiel eines Verfahrens und einer Vorrichtung zum Erkennen und Identifizierung von Fehlern an Sensoren. Die DE 39 23 432 C2 zeigt ein Beispiel für die Überwachung der Software, mittels welcher die von redundant vorgesehenen Sensoren gelieferten Signale durch redundant vorgesehene Rechner verarbeitet werden.
  Solche Maßnahmen erschienen für Flugkörper, die zum einen unbemannt sind und zum anderen nur nur einmal für kurze Zeit fliegen, nicht erforderlich.
  Bei Flugkörpern tritt jedoch ein anderes Problem auf, nämlich das der "Verfügbarkeit": Flugkörper werden u.U. sehr lange, ggf. jahrzehntelang, gelagert, bis sie schließlich zum Einsatz kommen. Die Flugkörper müssen dann einsatzbereit sein. Auch durch lange Lagerung ohne Einsatz kann eine Beeinträchtigung der Funktion des Flugkörpers eintreten. Die Verfügbarkeit ist die Wahrscheinlichkeit, den Flugkörper zu einem bestimmten Zeitpunkt in funktionsfähigem Zustand anzutreffen. Dieses Problem, die Einsatzbereitschaft des Flugkörpers auch nach langer Lagerzeit zu gewährleisten, wird durch entsprechende Konstruktion der Elemente des Flugkörpers, durch entsprechende Lagerung der Flugkörper und durch regelmäßige Überprüfungen mit Testeinrichtungen gelöst. Wenn Elemente des Flugkörpers sich bei einem solchen Test als defekt erweisen, wird der Flugkörper repariert.
  Es ist aufwendig, die Elemente des Flugkörpers so auszubilden, daß sich über die u.U. jahrzehntelange Lagerzeit hinweg keine Ausfälle ergeben und die hohe Verfügbarkeit des Flugkörpers allein konstruktiv zu erreichen. Es bleibt immer noch das Risiko, daß ein lange gelagerter Flugkörper nicht einsatzfähig ist. Es bleibt die Möglichkeit regelmäßiger Tests und ggf. Reparaturen. Während der Test- und Reparaturzeit bei regelmäßigen Tests steht der Flugkörper nicht für den Einsatz zur Verfügung. Eine Verringerung der Abstände zwischen den Tests, um die Sicherheit gegen Ausfälle zu erhöhen, reduziert daher die Verfügbarkeit des Flugkörpers auch.
  Es sind verschiedene Anwendungen von redundanten Systemen mit Fehlererkennung und Rekonfiguration der Bauteile bekannt. Die DE 34 32 165 A1 bezieht sich hinsichtlich der dem Fachmann vermittelten Lehre auf Raumfahrt. Die US 5,719,764 A spricht von "Zivilluftfahrt und Raumfahrt-Anwendungen".Die US 4,413,327 A betrifft "ein Verfahren und Gerät zum Eliminieren der Effekte von ionisierender Strahlung auf ein Rechnersystem". Es werden zwei Rechner vorgesehen, die in schneller Folge alternierend adressiert und aktualisiert werden. Die US 5,742,609 A betrifft einen Kanister mit Flugkörpern, der an verschiedene Arten von Flugkörpern angepaßt werden kann. Dieses Dokument sagt nichts über Bauteile in den einzelnen Flugkörpern. Die US 4,260,942 A betrifft "Lageregelsysteme für Satelliten" Die EP 0 476 160 A1 betrifft Flugregler oder Regler für Kernkraftwerke mit redundanten Sensor-Modulen und Rechnern. Auch die EP 0 418 370 A2 spricht als Anwendungsgebiete von Flugzeugen oder Kernkraftwerken. Die EP 0 263 777 A2 betrifft ein integriertes, redundantes Referenzsystem für die Flugregelung. Keine dieser Druckschriften offenbart eine Redundanz von Bauteilen bei Flugkörpern.
  Durch die EP 0747 656 A2 ist ein Verfahren und eine Vorrichtung zum Testen von Flugkörpern bekannt. Diese Vorrichtung enthält ein Prüfgerät, das Signale zum Auslösen eingebauter Tests auf den Flugkörper gibt. Zunächst wird über eine "Nabelschnur" die Funktionsfähigkeit des Flugkörpers so wie er vorliegt geprüft. Ergeben sich bei diesem ersten Test Funktionsfehler, wird eine Abdeckung geoffnet, und es werden dann Verbindungen zwischen dem Prüfgerät und einzelnen Baugruppen des Flugkörpers hergestellt. Diese Baugruppen werden einzeln geprüft. Auftretende Probleme werden dann durch Reparatur gelöst oder es werden redundante Systeme oder eine alternative Signalverarbeitung verwendet.
  Auch dieses Verfahren, von welchem der Oberbegriff des Patentanspruchs ausgeht, beruht auf einer regelmäßigen Prüfung und Wartung des Flugkörpers, wie das oben geschildert wurde.
  Der Erfindung liegt die Aufgabe zu Grunde, die Verfügbarkeit von Flugkörpern zu erhöhen.
  Erfindungsgemäß wird diese Aufgabe dadurch gelöst, daß
• (c) zur Erhöhung der Verfügbarkeit des Flugkörpers funktionswichtige Elemente des Flugkörpers redundant vorgesehen sind und der Flugkörper interne Mittel zur Fehlerdetektion und -lokalisierung und zur Rekonfiguration der besagten Elemente aufweist, derart, daß bei einem Fehler eines der Elemente die Lenkung des Flugkörpers automatisch durch die rekonfigurierten Elemente erfolgt.

The invention relates to a missile, which forms part of a weapon system and is guided in a compared to the operating times of aircraft or spacecraft short flight time by means of signals from sensors and / or receivers to a destination, in which

• (a) elements of the missile are provided redundantly and
• (B) the missile has means for error detection
  A missile is part of a weapon system. The missile is guided to a destination. This can be done for example by a navigation unit or by a seeker, which detects the target and generates steering signals. The missile is unmanned. The flight time of the missile from launch to hit is relatively short. The flight guidance system of the missile, eg with seeker head or navigation unit, is therefore actually only in operation for a short time.
  Manned aircraft work with a variety of sensors and safety-related components. Aircraft are in use for a long time. The failure of a sensor or safety-related component during use can lead to a crash of the aircraft. For this reason, it is known to redundantly provide security-relevant elements including the software of flight controllers and to use means for error detection, fault identification and reconfiguration (FDIR). It is then the failure of a sensor or a defect detected on a sensor, it is determined which sensor or which element has failed or is defective, and it is then the failed or defective sensor or the defective element is switched off and only the remaining sensors or elements for flight guidance are used.
  DE-39 29 404 A1 shows an example of a method and a device for detecting and identifying errors in sensors. DE 39 23 432 C2 shows an example of the monitoring of the software, by means of which the signals supplied by redundant sensors are processed by redundant computer provided.
  Such measures did not seem necessary for missiles that are unmanned and fly only once for a short time.
  For missiles, however, another problem occurs, namely that of "availability": Missiles may be stored for a very long time, possibly decades, until they are finally deployed. The missiles must then be ready for use. Even by long storage without use may impair the function of the missile occur. Availability is the probability of finding the missile in working order at some point in time. This problem of ensuring the operational readiness of the missile even after a long storage period, is solved by appropriate design of the missile elements, by appropriate storage of the missile and by regular checks with test facilities. If elements of the missile prove to be defective in such a test, the missile is repaired.
  It is complicated to design the elements of the missile so that there are no failures over the possibly decades of storage time and to achieve the high availability of the missile alone constructively. There is still the risk that a long-stored missile will not be operational. There remains the possibility of regular tests and possibly repairs. During the test and repair period during regular tests, the missile is not available for use. Reducing the intervals between tests to increase safety against failures therefore reduces the availability of the missile as well.
  Various applications of redundant systems with fault detection and component reconfiguration are known. DE 34 32 165 A1 relates to astronautics with regard to the teaching imparted to the person skilled in the art. US 5,719,764 A speaks of "civil aviation and aerospace applications." US 4,413,327 A relates to "a method and apparatus for eliminating the effects of ionizing radiation on a computer system". Two computers are provided, which are alternately addressed and updated in rapid succession. The US 5,742,609 A relates to a canister with missiles, which can be adapted to different types of missiles. This document does not say anything about components in the individual missiles. US 4,260,942 A relates to "attitude control systems for satellites" EP 0 476 160 A1 relates to flight controllers or regulators for nuclear power plants with redundant sensor modules and computers. Also EP 0 418 370 A2 speaks as applications of aircraft or nuclear power plants. EP 0 263 777 A2 relates to an integrated, redundant reference system for flight control. None of these documents discloses a redundancy of components in missiles.
  EP 0747 656 A2 discloses a method and a device for testing missiles. This device includes a tester that provides signals to initiate built-in tests on the missile. First, the functionality of the missile is tested as it is via an "umbilical cord". If a malfunction occurs in this first test, a cover is opened and connections are made between the tester and individual subassemblies of the missile. These assemblies are tested individually. Occurring problems are then solved by repair or redundant systems or alternative signal processing are used.
  Also, this method, from which the preamble of the claim emanates based on a regular inspection and maintenance of the missile, as described above.
  The invention is based on the object to increase the availability of missiles.
  According to the invention, this object is achieved in that
• (c) to increase the availability of the missile functionally important elements of the missile are redundantly provided and the missile has internal means for error detection and localization and reconfiguration of said elements, such that in case of failure of one of the elements, the steering of the missile automatically by the reconfigured elements takes place.

"Elements" may be sensors, signal processing means or actuators. The term "elements" should also include information that is essential to the function of the missile.

According to the invention, agents which are e.g. to increase the safety of manned aircraft during their relatively long-term use per se, used for a different purpose, namely to increase the above-defined "availability" of missiles that certainly do not require such measures during their brief deployment would. A high reliability and availability of the missile is achieved by fault tolerance. A fault-tolerant system has the ability to fully perform its specified function even in the event of hardware or software failure.

The German term "error" subsumes: faults in the hardware and software, resulting errors in the information world ("errors") and, finally, resulting failures or malfunctions in the system (" failures "). A "fault" can be a defect in a sensor.

The fault leads to a false signal ("error"). The "error" leads to a malfunction of the missile.

Embodiments of the invention are the subject of the dependent claims.

Fig. 1

zeigt schematisch einen Flugkörper und ein Flugzeug mit den verschiedenen Elementen und Schnittstellen.

Fig.2

veranschaulicht die Überwachung der Elemente des Flugkörpers durch "BIT" und "FDIR".

Fig.3

ist eine schematische Darstellung eines Gerätes zu Fehler-Erkennung, Fehler-Identifikation und Sensor-Rekonfiguration (FDIR).

Fig.4

zeigt eine Ausführung der Mittel zur Fehler-Erkennung und Fehler-Identifikation.

Fig.5

veranschaulicht die Umsetzung eines ein Symptom für einen Sensorausfall oder -fehler liefernden stochastischen Signals in Zugehörigkeiten zu linguistischen Werfebereichen.

Fig.6

veranschaulicht die Umsetzung von Signaländerungen, die ein Symptom für einen Sensorausfall oder -fehler liefern, in Zugehörigkeiten zu linguistischen Wertebereichen.

Fig.7

ist ein Blockdiagramm und veranschaulicht das mit Fuzzy-Logik aufgebaute Entscheidungsnetzwerk zur Erzeugung eines Sensor-Statusvektors.

Fig.8

veranschaulicht die Struktur der Flugkörper-Software

Fig.9

zeigt den Aufbau einer Anordnung zur Überwachung der Flugkörper-Software.

Fig.10

zeigt die Überwachungsanordnung der Software bei einer Anordnung von Fig.9.

Fig.11

veranschaulicht die automatische Erstellung des Überwachungsprogramms.

Fig.12

veranschaulicht die Stellglieder des Flugkörpers;

Fig.13

veranschaulicht die Erstellung des Überwachungsprogramms uriter Verwendung genetischer Algorithmen.

The invention is explained below with reference to exemplary embodiments with reference to the accompanying drawings.

Fig. 1

schematically shows a missile and an aircraft with the various elements and interfaces.

Fig.2

illustrates the surveillance of missile elements by "BIT" and "FDIR".

Figure 3

is a schematic representation of a device for fault detection, fault identification and sensor reconfiguration (FDIR).

Figure 4

shows an embodiment of the means for error detection and error identification.

Figure 5

Figure 4 illustrates the implementation of a stochastic signal that provides a symptom of a sensor failure or error in linguistic throwing regions.

Figure 6

illustrates the implementation of signal changes that provide a symptom of sensor failure or error in linguistic domains.

Figure 7

Figure 10 is a block diagram illustrating the fuzzy logic decision network for generating a sensor status vector.

Figure 8

illustrates the structure of the missile software

Figure 9

shows the construction of a device for monitoring the missile software.

Figure 10

shows the monitoring arrangement of the software in an arrangement of Fig.9.

Figure 11

illustrates the automatic creation of the monitoring program.

Figure 12

illustrates the actuators of the missile;

Figure 13

illustrates the creation of the monitoring program using genetic algorithms.

In Fig.1, 10 denotes a missile. The missile 10 includes a seeker head 12 in its nose. The nose has a Radar Radiation Permeable Tip (RADOME) 14 and an Infrared Radiation Permeable Window 16. Behind the radiotransparent tip 14 are an X-band passive array sensor 18 and a K-band phased array sensor 20. The X-band passive array sensor 18 is connected to associated tracking circuitry 22. The K-band phased array sensor 20 is connected to associated tracking electronics 24. Behind the window 16, which is permeable to infrared radiation, sits an infrared sensor 26 operating in the mid-infrared range. The infrared sensor 26 is followed by an associated tracking electronics unit 28. The tracking electronics 22, 24, and 28 receive data from a strapdown finder and navigation signal processor 30. The strapdown seeker and navigation signal processor 30 receives data from an inertial measurement unit and satellite navigation, represented by a block 32. On the one hand, the proper movements of the missile are taken into account in the signals of the "strapdown" sensors. On the other hand, navigation data are obtained, ie data on the position and possibly speed of the missile. The outputs of the tracking electronics 22, 24 and 28 are connected to means 34 for sensor fusion. Become through the sensor fusion Get seeker signals based on the signals from multiple sensors. These seeker signals are applied to a flight control signal processor 36. The flight guidance signal processor 36 also receives data from the strapdown finder and navigation signal processor 30. Finally, signals from a data transmission unit 38 may be applied to the flight guidance signal processor 36. Furthermore, the flight guidance signal processing 36 is in data exchange with a missile-side mission unit 40. The flight guidance signal processing 36 effects flight guidance in the marching phase and in the final phase. The flight guidance signal processing provides commands to an advanced autopilot 42. The autopilot 42 may continue to receive data from the communication unit 38. The autopilot 42 provides commanding commands for the actuation of control surfaces and for the thrust at outputs 44 and 46, respectively a circuit 48 is provided, which is acted upon by data of the means 34 for sensor fusion and by which a seeker-based ignition command is generated, which is connected via an output 50 to a warhead of the missile 10 is before firing via an interface 52 and a feed cable 54 with connected to the missile 10 carrying carrier aircraft, which is shown in Figure 1 by a block 56 in the left part of the figure. The interface 52 communicates with the missile side mission unit 40, the signal processing 30, the flight guidance signal processing 36 and the autopilot 42 in data exchange.

The carrier aircraft 56 also has sensors represented by blocks 58, 60, 62, 64, 66 and 68, eg a radar 58, a forward infrared sensor FLIR 62 or sensors for satellite or inertial navigation GPS / INS 68. The sensors are switched to a mission avionics 70 of the carrier aircraft 56. Based on the sensor signals, a target is identified, identified and tracked. The missionary avionics provides data to mission planning means 72, namely means for the fire control solution and the tactical dynamics. The mission avionics 70 provides data about the location, type and movement of the target. The mission planning resources 72 provide data on how to tackle this goal. Via the interface 52 in the launcher, the mission avionics 70 receives information from the missile 10, which already provides information with its sensors while it still hangs in the launcher of the carrier aircraft.

After firing the missile 10, if necessary, the mission avionics 70 and the mission planning means 72 may continue to communicate wirelessly with the missile in two directions via data transmission 38.

Block 74 symbolizes other contributors, e.g. a command center or other friendly aircraft through which a target can be made. The "target by a third party" is symbolized by the block 76 in FIG. The target can be transmitted via data transmission 38 to the missile 10 or to the carrier aircraft 56.

The sensors of the missile can be subdivided into sensors for measuring the self-propelled state of the missile and sensors for target detection and target tracking.

The self-motion of the missile is detected with inertial sensors for measuring acceleration and rotational speed. Furthermore, satellite navigation systems such as GPS ("Global Positioning System") are used in some cases for accurate positioning. This is the element 32 in Fig.1.

Searchers, preferably image-resolving viewfinders whose signals are subjected to image processing, serve for target detection and target tracking. These are e.g. image-processing radar seekers such as element 18 in FIG. 1 or infrared seekers such as element 26 in FIG. The viewfinders can work passively or actively. In the case of an infrared finder, a distance measurement in the final phase can also take place by means of a laser.

Fault tolerance is achieved by redundancy of sensors. If errors occur in the sensors, which can be detected and identified as a result of redundancy, the sensors are reconfigured: the signals from defective sensors are ignored and the required information is obtained from the signals of other sensors and possibly combinations of such signals.

The inertial sensors are multiplied. In this case, the degradation behavior "fail-operational", ie a functionality even after failure of any Sensors, each with a minimum of five (instead of three otherwise) rotational rate and acceleration sensors, which are arranged in a special geometry to the missile axes. The rotation rate sensors can be optical rotation rate sensors. It is also possible to use micro-mechanical sensors (EP 0 686 830 B1) for rotation rates and accelerations. The additional effort for the redundancy is thereby relatively low, so that it is outweighed even with loss objects such as missiles by increasing the availability and lower maintenance.

Satellite navigation systems may be multi-channel (multi-channel) GPS systems so that redundant position information is also available from the satellite navigation system that can be used to monitor and select the currently most favorable channels.

Furthermore, motion information can also be obtained from the signals of the infrared and radar sensors.

The proper motion of the missile, attitude and position is thus redundant detected by Vermehrfathung of sensors or by resorting to sensors that actually serve another purpose.

2 schematically shows the monitoring of the functionally important elements of the missile 10. 80 generally designates the device for detecting and identifying faults and for reconfiguring the elements of the missile 10 (FDIR). Monitored are sensors, represented by a block 82, the information and data processing represented by a block 84 and the actuators, represented by a block 86. A block 88 symbolizes a built-in test procedure (BIT), by which the physical function of the individual components is checked. It is checked, for example, whether a motor winding of a gyro receives power. Subsequently, the test is for errors by the FDIR. The result is processed by inference and status means 90: "If the signal from sensor A is detected as faulty, discard the signal from sensor A and process only the signals from sensors B and C". Status: failure of sensor A. The built-in test procedure can additionally show that sensor X is not receiving power. This also gives a status signal: "Failure of Sensor X, working with sensor Y, which provides similar information. "The status signals are applied to the missile mission unit 40.

3 schematically shows the structure of the FDIR device 80 for error detection, identification and reconfiguration.

In FIG. 3, 90A to 90N sensors of the missile 10 are designated, whose signals or data are applied to the device 80. The connection is represented by double arrows. This means that the FDIR device 80 also acts on the sensors 90A ... 90N, e.g. turns off a sensor. The FDIR device 80 effects monitoring of the hardware and subsystems of the missile 10. This is represented by block 92. This is done once by "voting" and plausibility checks: If a sensor is designed to be triple-redundant and one measured value deviates significantly from the measured values of the other two, then this deviating measured value is considered to be incorrect. It counts the majority. A plausibility check checks whether a received measured value is physically meaningful. This type of monitoring is shown in FIG. 3 by a block 94. Furthermore, the built-in test procedures (BIT), which are represented by a block 88. This is a way of checking the hardware and subsystems.

Another type of hardware and subsystem verification is represented by a block 98. Here, the signals are checked for the occurrence of errors by means of knowledge, model, pattern or parity-based processing. The errors are detected and identified. This is shown in Fig. 3 by block 100 (FDI).

Apart from the hardware, the software is also monitored. This is represented in FIG. 3 by a block 102. There are decision processes, represented by block 104. Finally, if necessary, a reconfiguration of sensors, which is gekerkgestellt by a block 106.

On the basis of the measured values thus obtained, effectors and actuators 108 are actuated. Again, the transfer of information takes place in two directions, which indicated by a double arrow. The function of the effectors and actuators is monitored in the manner described by the FDIR device.

Block 110 represents the communication of FDIR device 80 e.g. with the missile mission unit 40, this communication also being in two directions. Block 112 symbolizes the human / machine interface.

In FIG. 4, 90 generally designate the sensors of the missile. These sensors include redundant inertial sensors 114, a multi-channel receiver for satellite navigation (multichannel GPS with 6 -10 channels) 116, and infrared and radar sensors 118. The multiplication of inertial sensors, ie yaw rate and acceleration sensors, such that a degradation behavior "fail "Operational" can be that in each case a minimum of five sensors are used, which are arranged in special geometry to the missile axes. The multi-channel GPS provides redundant GPS information that can be used to monitor and select the currently most affordable GPS channels. The infrared and radar sensors 118 also provide motion information.

Block 120 represents the formation of location and velocity data, which are collectively obtained from the GPS data and the data from the inertial sensors. It can be a Kalman filter or a State Dependent Riccati Equation (SDRE) filter that optimally integrates GPS and inertial data. The output of this block is the measured (not the calculated) covariance signals of the Kalman filter or SDRE filter.

The output signals of the sensors 114, 116 and 118 are applied in a measurement vector m to an array 122 of neural networks 124 and 126. The measuring vector m comprises the output signals of the sensors 114, 116, 118. The measuring vector is a function of the physical movement state x of the missile, to which errors summarized in an error vector ε are superimposed: $$\underset{~}{\mathrm{m}}=\mathrm{f}\left(\underset{~}{\mathrm{x}}.\underset{~}{\mathrm{\epsilon }}\right),$$

The error vector ε may include jump or ramp-shaped as well as stochastic errors and continue to map total failures such as zero measurement signal or constant full scale deflection.

The measuring vector m is applied to the first neural network 124. In the first neural network 124, a separation of the useful signal m (x) and the error m ( ε ) is performed by projecting the measuring vector m into the error space (parity space) orthogonal to the measuring space. This generates a feature or validation vector v . The validation vector v is subject to errors. This is an error detection.

The feature vector v is applied to the second neural network 126. This second neural network 126 effects the location of the error. The second neural network 126 thus identifies the defective sensor or channel. Thus, this neural network 126 has the function of a classifier related to the error space in which the feature vectors point to certain error clusters.

The networks 124 and 126 are provided with prior knowledge of an analytical solution to the problem of error detection and identification and then trained in a training phase either by simulation of the sensor array and typical errors or with the real sensor array 90 with simulated errors. It has been found that the networks 124 and 126 can detect and locate not only single errors but also simultaneous errors and short consecutive errors. Moreover, they detect and locate the disappearance of transient errors, e.g. As a result of strong maneuvers occur, so that the sensor assembly 90 can work self-regenerating.

Output of the second network 126 is a location, identification and classification vector. If necessary, this vector is supplied to a decision network 128 together with the feature vector v . This is illustrated by connections 130 and 132, respectively.

Decision network 128 is further provided with the output of Kalman filter or SDRE filter 120. In the covariances of the measuring difference form both measurement errors and sensor failures. The progressions of these signals can therefore be usefully included in the decision as to whether and where errors have occurred.

Denoted 130 is a Kalman filter intended for initialization and calibration of the Missile Inertial System (MLS-IRS). The Kalman filter processes information from the aircraft inertial system as well as the missile inertial system. The covariance signals provided by the Kalman filter 130 are a measure of the function and momentary quality of the MLS-IRS missile inertial system. These covariance signals are also applied to the decision network 128 via connection 132.

Block 134 symbolizes rule-based heuristic knowledge about the sensors 114, 116, 118 and their interaction in the system. This is also switched to the decision network 128.

The decision network 128 includes a fuzzification layer 136 on the input side. This is followed by a control layer 138 and an inference layer 140. On the output side, a defuzzification layer 142 is provided. Decision network 128 provides a sensor status vector.

The task of the decision network is to extract from the analytic sympetome signals, e.g. identify the identification vector and rule-based heuristic knowledge of the sensors concerned and their interaction in the system with possible "faults" according to the type, location and time of occurrence. For this a uniform presentation of the symptoms is important. This is made possible by the fuzzy logic by uniformly representing both analytical and heuristic symptoms through membership functions to fuzzy sets for decision making.

The signals supplied to decision network 128 are stochastic variables with mean and variance. An example of the time course of such a variable S is shown by curve 144 in the left part of FIG. By "faults" these values change. In the left part of FIG. 5, the variable S usually fluctuates around the Line 146 with the variance σ. When a "fault" occurs, the waveform shifts by ΔS on line 148. These symptoms are usually used when a predetermined threshold value S _{max is} exceeded for the binary decision for the occurrence of a "fault". This is shown in the middle part of Fig.5. If the variable S reaches or exceeds the threshold value S _max , a "fault" is signaled in binary, which is indicated by the rectangle 146: The probability μ (S) of the presence of an error then becomes "1". This carries with it the danger of a high false alarm rate. This can be avoided by introducing a "fuzzy threshold", as shown in the right part of FIG. Here three functions 150, 152 and 154 of S are defined. Functions 150 and 152 are triangle functions. The peak values of functions 150 and 152 are "1". The peak of the function 150 is at the S value of the line 146. The peak of the function 152 is at the S value of the line 148. The function 154 shows a ramp 156 which starts from the S value of the line 148 and from S _max up constant "1" remains. The functions intersect at a function value of 0.5. The function 150 is associated with the linguistic variable "normal", the function 152 with the linguistic variable "low" (fault) and the function 154 with the linguistic variable "increased". A particular value S of the variable leaves may then be assigned to a certain percentage, eg the linguistic variable "normal" and to a different percentage of the linguistic variable "low".

6 shows an example in which the increase or decrease of a symptom or feature forms a criterion for the occurrence of a "faults" and is described by introducing linguistic value ranges (fuzzy sets), wherein each of these value ranges is assigned a "membership function" is. FIG. 6 shows the membership functions as degree μ (S) of the membership of a value S to a range of values. μ (S) is again one maximum. There is the membership function 158 of the value range "normal" formed by a triangular function, the trapezoidal membership functions 160 and 162 of the positive and negative value ranges "less" and the membership functions 164 and 166 of the positive and negative value ranges "a lot". The ranges of values overlap, so that a particular value S may belong to different adjacent value ranges in different degrees determined by the membership functions.

The "fuzzification" gives the decision network 128 at the various inputs from the identification network 126, the Kalman filters 120 and 130 and the heuristic knowledge 134 comparable inputs, namely degrees of membership between zero and one to linguistic value ranges.

7 shows in another illustration the decision network 128 and the signal processing then taking place.

In a database 170, the linguistic value range (fuzzy sets) and the membership functions for these value ranges are stored for the various input variables of the decision network 128. Block 172 symbolizes an input interface for the fuzzification of the input variables that are applied to inputs 174. These are operations as described in connection with FIGS. 5 and 9. The fuzzification is indicated at the bottom of Fig. 7 by block 176. The linguistic quantities thus obtained are displayed in block 178. Block 178 contains a rule database 180. The rule database contains rules of the form. "If ..., then ...", according to which the linguistic quantities are linked in a inference stage 182. This is indicated at the bottom in FIG. 7 by block 184. The quantities thus obtained are summed in a summing point and switched to a block 188. Block 188 represents an output interface for defuzzification. This output interface also receives the linguistic value ranges and membership functions stored in database 170 via connection 190. The defuzzification is indicated at the bottom of FIG. The output interface supplies a sensor status vector at an output 194 as a "hard" output, with the aid of which the signals of the respectively intact sensors can be reconfigured for further processing in the system.

The appearance of "faults" on observable symptoms or features follows physical cause-and-effect relationships, often making the analytical description of these relationships difficult. In this case, the use of adaptive network structures is indicated, as they are indicated in Figure 4. However, heuristic knowledge in the form of "if .., then ..." rules for the linguistic-qualitative description of the connections can be very substantially included. The on the The first look complicated structure of the decision network 128 of Figure 4 and 7 leads to a simple hardware implementation as a fuzzy-neural network.

The FDIR sensor concept described here is a parity-vector-based, feature-based, knowledge-based method. It does not require any more or less complex sensor or subsystem modeling. It also recognizes the ability to detect and locate simultaneous or rapid errors, with the potential for self-regeneration.

The three networks necessary for the realization (FIG. 4) can be implemented in hardware as ASICS, so that problems with software reliability can be avoided at this point. Due to the hardware realization, the networks can be produced quickly and, because of the parallel structures, fault-tolerant as well as cost-effectively. They are adaptable to change through learning, not reprogramming.

The described FDIR concept requires similar or dissimilar sensor redundancy. In its basic structure, it can also be used for multi-sensor systems for time recording and for non-redundant sensor configurations. However, the latter requires analytical redundancy with model-based approaches, which in turn can be based on knowledge-based representations.

The processor and memory hardware is monitored using standard, proven BIT resources. Fault tolerance can basically be implemented by multiplication with mechanical and electrical segregation in conjunction with voting / monitoring techniques. Due to the reliability of the relevant hardware components even during long storage, this measure can be dispensed with to ensure availability.

Note, however, the fact that the memory modules (EEPROMS, FLASHPROMS) with long shelf life (> 10 years) may lose some or all of their contents. However, this may possibly be taken into account by reloading the software during deployment preparation.

Due to the well-known trend of the number of failures over the usage time for hardware components (so-called "bathtub curve"), hardware faults statistically appear according to an exponential probability distribution. They are statistically predictable so that the availability of the system in question can be guaranteed by preventive maintenance.

The software structure for the main control steering and control functions of the missile is shown in simplified form in Figure 8.

Block 196 symbolizes the mission control software 40 (Fig.1), i. determines what the missile should do, e.g. Detect, identify and track a specific destination. Block 198 symbolizes the software of the sensor subsystem viewfinder. This is a signal processing of the viewfinder and possibly inertial signals through which the viewfinder follows the specific destination. Block 200 represents the software of the midcourse and end-phase flight guidance 36 (Fig. 1) through which the missile is guided to the destination in accordance with the seeker signals. Finally, block 202 represents the software of the autopilot 42, which steers the missile in accordance with the flight guidance 36.

In contrast to hardware errors, software errors occur according to completely different laws. They "latent" in the system from the start and are triggered by certain combinations of input and internal state variables of that module, and they can not be fully identified and eliminated even with extensive verification and validation procedures One example is the so-called "N version programming", which uses dissimilar software in N redundant software and hardware channels, which eliminates the need for an extremely high level of development and implementation effort for missile applications.

FIG. 9 shows a circuit which, with the outlay for missiles, achieves a tolerance for software errors and thus improves the availability of the missile.

9, the sensor data of the missile are symbolized by block 204. Block 206 symbolizes other input data. The data records are connected in parallel to at least two computer channels 208 and 210. The computer channels 208 and 210 deliver the output data p _n and p _n-1 respectively in the right cycle. Each computer channel operates with a nominal software N and a monitor version M of the nominal software.

The two computers work with a time offset of one right clock. The computer 208 processes in the time clock n the data accumulating in this time cycle. The computer 210 processes at the same time the data that had been incurred in the previous time clock n-1. However, these data have already been processed by the computer 208 in the preceding time clock and once by the nominal software N and secondly by the monitor software M. If the computer 208 has come to the same result in the two channels with different software N and M. which is referred to here as p _n ; then the software is "validated" for this set of input variables. If this set of input variables is switched one clock further on the computer 210, then this calculator with nominal software and monitor software must deliver the same output. This allows control of the function of computers 208 and 210. One has the certainty that the software is working properly. Deviations are then due to an error of one of the computers.

It is also possible to control the software. If the output variables calculated with the nominal software N and the monitor software M deviate in the two channels of the computers 208 and 210, then there is a software error. However, it can not be said which software encountered this error. The monitoring of the software is based on the consideration that the output variables of the computer, for example, a commanded control surface position, constantly changing and make no jumps. From the history of an output in the past, the value of the output in the next clock can be predicted with some accuracy. A significant deviation of the output from the predicted value in one channel while the output in the other channel close to the predicted value, indicates a software error in this channel.

This is shown in Fig.10 as a flow chart.

berechnet. Das ist durch das Rechteck 214 dargestellt. Außerdem wird mit diesen Eingangsdaten mit der Monitorsoftware M der Vektor p zum Zeitpunkt nT $\to {\underline{\mathit{p}}}_{\mathit{n}}^{\mathit{M}}$

→ berechnet. Das ist durch das Rechteck 216 dargestellt. Aus den so mit den beiden Programmen N und M berechneten Vektoren der Ausgangsgrößen wird die Differenz gebildet $$\Delta {\underset{‾}{p}}_n={\underset{‾}{p}}_n^N-{\underset{‾}{p}}_n^M.$$

An oval 212 indicates the input data for the nth clock cycle. With these input data, with the nominal software N, the vector p at time nT, $\to {\underset{\mathit{}}{\mathit{p}}}_{\mathit{n}}^{\mathit{N}}$

calculated. This is represented by the rectangle 214. In addition, with these input data with the monitor software M, the vector p at time nT $\to {\underset{\mathit{}}{\mathit{p}}}_{\mathit{n}}^{\mathit{M}}$

→ calculated. This is represented by the rectangle 216. From the vectors of the output variables thus calculated with the two programs N and M, the difference is formed $$\Delta {\underset{~}{p}}_n={\underset{~}{p}}_n^N-{\underset{~}{p}}_n^M,$$

und ${\widehat{\underset{‾}{p}}}_n^M$

berechnet. Das ist durch Rechteck 220 in Fig.10 dargestellt. Es werden dann im nächsten Rechentakt die Differenzen zwischen den prädizierten Ausgangsgrößen der Rechner und den tatsächlich berechneten Ausgangsgrößen gebildet. Das ist durch Rechteck 222 dargestellt. Durch eine Fuzzy-Entscheidungslogik 224 wird dann an einem Ausgang 226 ein N_n-Status der Nominalsoftware N, ein M_n-Status der Monitorsoftware M und ein "Fail"-Status als Software-Statusvektor ausgegeben. Aus den berechneten Vektoren ${\underset{‾}{p}}_n^N,{\underset{‾}{p}}_n^M,$

den prädizierten Vektoren und dem Software-Statusvektor wird ein Ausgangsvektor p̂ _n gebildet. Das ist durch ein Rechteck 228 dargestellt. Dieser Ausgangsvektor p̂ _n ist der Vektor, der unter Berücksichtigung der Software-Überwachung auf einen Ausgang 230 aufgeschaltet und weiter benutzt wird. Die Monitor- oder Überwachungssoftware M sollte einfache algorithmische und logische Elemente (Standardmodule) verwenden, die in generell validierbaren Strukturen angeordnet eine Vielzahl von (softwaremäßigen) Problemlösungen abbilden können. Es sind also einfache algorithmische und logische Elemente vorgesehen. Diese Elemente werden zu einer bestimmten Problemlösung in dem Problem angepaßten Strukturen kombiniert werden. Diese Voraussetzungen erfüllen in geradezu idealer Weise neuronale Netze und fuzzy-neuronale Netze. Diese Netze definieren eine vorgegebene Standardstruktur mit einheitlichen, einfachen Prozessoreinheiten.This is represented by rectangle 218. In case of a deviation of the output variables in the two channels, the history p _n-1 predicts the output variables in the past. outputs ${\widehat{\underset{~}{p}}}_n^N$

and ${\widehat{\underset{~}{p}}}_n^M$

calculated. This is represented by rectangle 220 in FIG. The differences between the predicted output variables of the computers and the actually calculated output variables are then formed in the next calculation clock. This is represented by rectangle 222. By means of a fuzzy decision logic 224, an N _n status of the nominal software N, an M _n status of the monitor software M and a "fail" status as a software status vector are then output at an output 226. From the calculated vectors ${\underset{~}{p}}_n^N.{\underset{~}{p}}_n^M.$

the predicted vectors and the software status vector, an output vector p _{n is} formed. This is represented by a rectangle 228. This output vector p _n is the vector which is switched to an output 230 in consideration of the software monitoring and is used further. The monitor or monitoring software M should use simple algorithmic and logical elements (standard modules), which can be arranged in generally validatable structures arranged a variety of (software) problem solutions. Thus, simple algorithmic and logical elements are provided. These elements will be combined to a specific problem solving in the problem adapted structures. These conditions ideally fulfill neural networks and fuzzy neural networks. These networks define a given standard structure with uniform, simple processor units.

The free parameters of the structure are set in a training phase. In this case, input and output vectors of the input or output spaces of the respectively associated nominal software module are used as training data. It is possible by means of genetic evolutionary algorithms to optimize the structure and / or parameters according to predetermined criteria. This allows automatic generation of the monitor software. For the likewise automatic test of the generated software, other than the training vectors from the input and output spaces are used.

This is shown in FIG. 11.

Block 232 symbolizes a neural network usable in the manner described above. Block 234 symbolizes a correspondingly usable fuzzy-neural network. Finally, block 236 symbolizes a genetic algorithm. The neural network 232 and the fuzzy neural network 234 provide a standard representation. This results in training of structure parameters by training with input and output data ("data driven") represented by a memory 238. This type of structuring also has potential for genetic / evolutionary optimization of the structure and / or parameters. This is illustrated in FIG. 11 by a block 240. This results in an automatic generation of the monitor software. This is represented by block 242 in FIG. For testing the monitor software thus obtained, input and output vectors of the input and output spaces, which are different from the training vectors and also stored in memory 238, are used.

This method is quite generally applicable to the automatic generation of software modules.

The monitor software is generated on the basis of a neural or fuzzy-neural network structure. In this case, the monitor software M can be implemented as a hardware module, for example in the form of an ASIC. This has several advantages: The reliability of the module can be assessed according to the laws of hardware failure. It does not use software to monitor software. The parallel information processing in the hardware provides - within certain limits - an inherent fault tolerance of the module.

In a further embodiment of the invention, the nominal home goods can also be replaced by hardware modules that are identical in terms of the input and output. These hardware modules can be multiply where the inherent fault tolerance to achieve the required reliability and thus availability is insufficient. This would be omitted monitor modules. The software is modeled on hardware modules of high reliability, whereby the adaptation to different tasks is done by learning.

A missile may comprise a plurality of actuators. This is shown in FIG. 12. The missile 10 may include a transverse thruster 244 that exerts transverse thrust on the missile 10 as shown. This causes a lateral acceleration of the missile 10. Other actuators may be control surfaces or rudder 246. A rudder deflection, as shown, causes an angle of attack, which also leads to a lateral acceleration. Finally, the thrust vector of the engine may be varied by adjusting the engine nozzle or by jet vanes projecting into the engine jet, as shown. A missile may have all three types of actuators. But it is then not possible in case of failure of an actuator to influence the movements of the missile by the remaining actuators in the desired manner.

The positioning system of the missile is therefore a "simplex configuration". There is no possibility for a reconfiguration, as in the manner described above, for example at

Failure of redundant existing sensors is possible. Therefore, in a further embodiment of the invention, in addition to the usual monitoring, measures are provided for the intelligent detection and identification of faults, thereby increasing the likelihood of recognizing and locating faults in the pre-flight phase and preferably as far as immediately before departure.

Such an arrangement is shown in FIG.

As shown in Fig. 13, a distinction must be made between external and internal faults. External faults are e.g. Damage due to collision or fault in the power supply. Internal faults are e.g. Failure of gearbox, bearings, insufficient lubrication or component failure. The first monitoring may be performed on the actuator 250 by measuring by measuring certain signals, e.g. of the input current or the deflection, and comparison of these signals with fuzzy predetermined tolerance thresholds in the manner of Figure 5 is made a general statement about the function of the actuator.

An improvement of the error detection and above all the possibility of a localization can be realized with the help of knowledge-based elements. In this case, as shown in FIG. 13, neuronal or fuzzy-neuronal nonlinear dynamic state and parameter models are assumed. In Fig. 13, 252 denotes a neural network representing such a model. 254 denotes a fuzzy neural network, which also represents such a model. The models from the networks 252 and 254 are connected to a knowledge-based nonlinear estimator 256 which receives data from the actuator 250 for comparison. The estimator 256 may also include further inputs from the flight guidance and control system of the missile 10 switched as indicated by input 258. The estimator 256 provides in real time estimates of the state variables x and the parameter p of the actuator. If errors occur, these estimated values contain the error components Δx and Δp . With knowledge of the relevant nominal values, a statement about the status of the actuators can be continuously made by means of a fuzzy decision and inference unit 160.

As shown in Fig. 2, an inference and status unit 90 is provided to which the results of sensor, information, data processing and actuator monitoring as well as the results of the built-in test (BIT) are fed. The unit 90 generates therefrom by inference and inference processes with fuzzy logic information regarding the functional status of the missile and its essential functional parts and thus about its availability.

Claims (23)

1. Missile, which forms a part of a weapon system and is guided to a target with the aid of signals from sensors and/or receivers in a short flight time in comparison to the operating times of aircraft or space vehicles, in which

   (a) elements of the missile are provided in redundant form, and

   (b) the missile has means for false detection,
   characterized in that

   (c) in order to increase the availability of the missile (10), functionally important elements of the missile (10) are provided in a redundant form, and the missile (10) has internal means (80) for fault detection and localization and for reconfiguration of the said elements, such that, in the event of a fault in one of the elements, the guidance of the missile is automatically carried out by the reconfigured elements.
2. Missile according to Claim 1, characterized in that the means for fault detection and localization and reconfiguration contain knowledge-based means (98).
3. Missile according to Claim 1 or 2, characterized in that the means for fault detection and localization and reconfiguration contain model-based means (98).
4. Missile according to Claim 1 or 2, characterized in that the means for fault detection and localization and reconfiguration contain type-based means (98).
5. Missile according to Claim 1 or 2, characterized in that the means for fault detection and localization and reconfiguration contain parity-based means (98).
6. Missile according to one of Claims 1 to 5, characterized in that the means for fault detection and localisation and reconfiguration contain means (94) for monitoring redundant hardware by means of a majority decision.
7. Missile according to one of Claims 1 to 6, characterized in that the means for fault detection and localization and reconfiguration contain means (88) for monitoring redundant hardware by direct functional testing.
8. Missile according to one of Claims 1 to 7, characterized in that the means for fault detection and localization and reconfiguration contain means (94) for monitoring of the hardware by plausibility analysis.
9. Missile according to one of Claims 1 to 8, characterized in that the means for fault detection and localization and reconfiguration contain means (102) for monitoring the operational software.
10. Missile according to one of Claims 1 to 9, characterized in that

    (a) sensors (114; 116) are provided for measurement of the missile's (10) own movement state and sensors (118) are provided for target detection and tracking, such that information about the missile's (10) own movement state is obtained in a redundant form,

    (b) the means for functional monitoring contain means (106) for reconfiguration such that, if information from one sensor becomes unusable, this information is obtained from the information from the other sensors.
11. Missile according to Claim 10, characterized in that a plurality of inertial sensors (114) are provided.
12. Missile according to Claim 10 or 11, characterized in that the missile contains a multichannel satellite navigation receiver (116).
13. Missile according to one of Claims 10 to 12, characterized in that means (36) are provided for production of movement information from the data from the target-detection infrared and radar sensors.
14. Missile according to one of Claims 1 to 13, characterized in that a neuro fuzzy network (128) is provided for monitoring the sensor errors.
15. Missile according to one of Claims 1 to 14, characterized in that

    (a) a measurement vector (m), which is formed from the redundant sensor signals, is passed to a neural projection and detection network (124), by means of which the useful signal and errors and separated by projection of the measurement vector (m) into the error area (parity area) which is orthogonal with respect to the measurement area, and a feature vector (v) is thus produced onto which errors are mapped,

    (b) the feature vector (v) is applied as an input variable to a neural identification network (126) by means of which the fault which has occurred is localized.
16. Missile according to Claims 14 and 15, characterized in that

    (a) the feature vector (v) is applied to a decision network (128),

    (b) the decision network (128) is a neuro fuzzy network with a fuzzification layer (136), a control layer (138), an inference layer (140) and a defuzzification layer (142), and

    (c) the decision network (128) produces a sensor status vector.
17. Missile according to Claim 16, characterized in that the feature vector (m) is also applied to the decision network (128).
18. Missile according to one of Claims 1 to 17, characterized in that, in order to monitor the software,

    (a) data to be calculated is calculated once by means of a main program (N) and once by means of a monitoring program (M),

    (b) predicted data is calculated by extrapolation from the already calculated data,

    (c) the differences between the predicted data and the data actually supplied by the programs are determined, and

    (d) these differences are passed to fuzzy decision logic (224), which produces a software status vector.
19. Missile according to Claim 1, characterized in that

    (a) input data is processed in parallel by two computer channels, and in each case by means of a main program and a monitoring program,

    (b) the two computer channels operate with a time offset of at least one computation clock cycle, and

    (c) means are provided for comparison of the calculated output values obtained in the two computer channels, in which case there is assumed to be a defect in the hardware in one of the computer channels in the event of a match between the output values obtained with the main and monitoring programs in the leading computer channel, and there is a discrepancy in the output values obtained with the same input values in the two computer channels.
20. Missile according to Claim 18 or 19, characterized in that the monitoring program (M) is in the form of fuzzy decision logic, whose structure and/or parameters are/is produced by genetic or evolutionary algorithms.
21. Missile according to Claim 20, characterized in that the fuzzy decision logic is produced as a hardware module.
22. Missile according to one of Claims 1 to 21, characterized in that fault-detecting means (86) are provided for the actuating elements.
23. Missile according to one of Claims 1 to 22, characterized by means (90) for production of a missile status signal.

Images