EP1342982B1 - Safety electropyrotechnical device for ammunition and method of control - Google Patents

Description

The present invention relates to a method of controlling an electro-pyrotechnic security device for ammunition, intended to be coupled to a firing system, and to an initiator for such an electro-pyrotechnic safety device.

In the context of the present invention, the term "electro-pyrotechnic safety device" is understood to mean a device formed of a device such as a primer, a detonator, an igniter or the like, and a payload which can be of very high natures. various, such as a pyrotechnic composition of ignition, ejection and / or propulsion, a set of decoy cartridges or a dynamite cartridge used for example in the field of civil engineering. At the moment of their use, these electro-pyrotechnic safety devices are coupled to a firing system which can also be of very different designs.

In the case of decoy in particular, such an electro-pyrotechnic safety device can be part of a multiple cartridge ammunition fixed on the structure of an aircraft, each of these cartridges being provided with a device. The cartridges are successively pulled under the control of a firing system which supplies the ammunition with the selection signals of the cartridges, the control signals necessary for their firing, and the electrical energy necessary for their initiation and the operation of their equipment. electric.

To ensure the safety of personnel and property, it is necessary to ensure that the ignition of an electro-pyrotechnic device can take place only if certain predetermined conditions according to strict criteria are met. This applies naturally to both military applications and civil engineering applications.

The document EP 0 798 535 describes a system for transmitting information between a weapon (ie a firing system) and a munition by means of which the security conditions are implemented in the weapon by means of a weapon. safety switches which are inserted into an electrical circuit of the weapon supplying the munition and on which bidirectional transmission control and verification signals exchanged between the weapon electronics and that of the ammunition. In this case, the main security function determining the possibility or not to turn on the device is implemented in the firing system.

This has the disadvantage that a munition that is not coupled to the firing system can be fired by applying the necessary energy without having to go through the security function. Thus, a hostile entity to which the ammunition is to be abandoned, or in the case of civilian use, of non-competent or ill-intentioned persons, may fire the ammunition by sending the necessary lighting current into the device.

DE 100 04 582 discloses a process of the type defined in the preamble of claim 1.

In this case, the firing system delivers a message representing a function for authorizing the circulation of an energy pulse for lighting the device, a message that is transmitted to the pyrotechnic safety device in which it is analyzed for extracting a control signal from the authorization function. The circulation authorization is then delivered in the pyrotechnic safety device in response to this control signal. Therefore, by this method, the operation of the device can be possible only when an authorization for this purpose is given in the electro-pyrotechnic safety device itself. Securing the function is thus ensured closer to the place where this function will be performed.

The object of the invention is to propose a method for controlling an electro-pyrotechnic device whose safety conditions are improved even more than those provided in the prior art.

The subject of the invention is therefore a process having the characteristics defined in the characterizing part of claim 1.

Thanks to these characteristics, it therefore requires the cumulative appearance of two control signals for the authorization to trigger the device can be issued. Inadvertent or fraudulent ignition becomes impossible when the ammunition is separated from the firing system. This results in a better overall security of the entire fire-ammunition system.

Other advantageous features of the process of the invention are defined in the subclaims 2 to 11.

The invention also relates to an electro-pyrotechnic safety device coupled to a firing system as defined in claim 12, advantageous features of this device being specified in claims 13 and 14.

• la figure 1 est un schéma simplifié d'un dispositif électro-pyrotechnique de sécurité selon l'invention;
• la figure 2 montre un exemple d'une forme possible de message pouvant être échangé entre un système de tir et un dispositif électro-pyrotechnique de sécurité selon l'invention connecté à ce système de tir;
• la figure 3 montre un exemple d'une forme possible des mots composant le message de la figure 2;
• la figure 4 montre un message selon la figure 2 dans lequel est incorporé une impulsion de mise à feu du dispositif électro-pyrotechnique de sécurité.

Other features and advantages of the present invention will become apparent from the following description, given solely by way of example and with reference to the appended drawings, in which:

• Figure 1 is a simplified diagram of an electro-pyrotechnic safety device according to the invention;
• FIG. 2 shows an example of a possible form of message that can be exchanged between a firing system and an electro-pyrotechnic safety device according to the invention connected to this firing system;
• Fig. 3 shows an example of a possible form of the words composing the message of Fig. 2;
• FIG. 4 shows a message according to FIG. 2 in which a firing pulse of the electro-pyrotechnic safety device is incorporated.

In FIG. 1, block 1 denotes a firing system designed to form messages M (FIGS. 2 and 4) and to address these messages to an electro-pyrotechnic safety device 2 according to the invention (hereinafter referred to as abbreviation DEP). This DEP is incorporated into a munition that has not been shown in detail. The DEP comprises a pyrotechnic device 3 intended to cause the operation of the ammunition. The DEP 2 is also able to send messages back to the firing system 1.

In the example shown, the firing system 1 is connected to the DEP 2 via a two-wire link 4 on which the messages comprising the energy pulse necessary for the operation of the device 3 and the device can pass. information that is essential to him to be ordered. This two-wire link 4 is connected to the DEP 2 by only two terminals 5 and 6, no other connection to the outside being provided for the DEP 2.

It should be noted that according to alternative embodiments, the communication between the firing system 1 and the DEP 2 can be established by other means. For example, the ignition energy and the control information may be transmitted inductively, optically or the like, appropriate coupling elements being provided for this purpose between the firing system 1 and the DEP 2.

The communication channel (in this case the two-wire link 4 and the terminals 5 and 6) is connected to a transmission / reception block 7 which constitutes an interface capable of routing the incoming and outgoing messages respectively to the functional blocks. DEP 2 and, where appropriate, to the firing system 1.

Incoming messages appear on a line 8 which is connected to a power supply 9 and to a microcontroller 10.

The power supply 9 is designed to generate the supply voltage U on a terminal 11. The latter is connected to power supply terminals 12 of all the other blocks of the DEP 2.

The microcontroller 10 is also connected to the transmission / reception block 7 via a line 13 on which the messages to leave the DEP 2 pass.

The pyrotechnic device 3 is connected between the terminals 5 and 6 respectively by means of controlled switches 14 and 15 forming with the device 3 a series circuit. Therefore, the initiator 3 can only be turned on if both switches 14 and 15 are closed. Each of the switches 14, 15 can be closed by an actuating circuit 16, respectively 17, which in turn receives control signals from the microcontroller 10. The switches 14 and 15 are preferably made in the form of controlled semiconductors as transistors or the like. At least two switches and at least two control signals can be provided.

The microcontroller 10 also controls a so-called "sterilization" circuit 18 as well as a "destruction" circuit 19. The sterilization circuit 18 is connected to the actuating circuits 16 and 17 which it can render inoperative in order to prevent the operation of the switches 14 and 15.

The destruction circuit is connected not only to the actuating circuits 16 and 17, but also to the transmission / reception block 7. When the microcontroller 10 sends a control signal to it, this destruction circuit 19 makes it possible to destroy the blocks to which it is connected and thus prevent any communication from the outside with the DEP electronics via terminals 5 and 6.

As is known in itself in particular by the aforementioned European patent, the power supply circuit 9 comprises an energy storage capacitor 9a which, when it is charged, makes it possible to supply the circuits of the DEP 2 temporarily, that is, that is, at least for the time it takes to fire the munition to which the DEP is incorporated.

For this purpose, the firing system 1 is arranged to generate M messages (Figure 2) comprising coded information in a sequence of words m ₁ , m ₂ , m ₃ ..... themselves formed of a sequence of bits. In the example described here, the topology of a message M is preferably of the UART type known to specialists comprising eight bits framed by a start bit and an end bit; the flow of information can be chosen at 9600 baud, for example. In the case described and as represented in FIG. 3, each word m ₁ , m ₂ , m ₃ ... of the message M is therefore composed of the _beginning B bits. B ₀ to B ₇ and B _end .

At least the first word m ₁ of each message M sent to the DEP 2 is intended to charge the capacitor 9a of the supply circuit 9. Preferably, the content of this word is that of the example of FIG. because it makes it possible to transfer a maximum of energy to the supply circuit 9 (code "55" in hexadecimal on the basis of a byte).

Table 1 below enumerates, by way of example, the functional content that the words that can compose a message M, such as that represented in FIG. 2, can have. It should be noted that these words can be followed in one order. desired by the designer to perform a predetermined sequence of events in the DEP 2, it being understood that depending on the capacitance of the capacitor 9a of the supply circuit 9, it is appropriate to insert either between two consecutive functional words defining a feature (hereinafter referred to as "function words"), or between several of these words, a so-called "feed" word whose logical composition is then that represented in FIG.

The second column of Table 1 indicates the direction of flow of information that is directed from the firing system 1 to the DEP 2 for all words, with the exception of the word 8 which implies a reverse flow of information. Table 1 No. words Meaning functionality 1 1 → 2 Feed the DEP circuits 2 1 → 2 Close the switch 14 3 1 → 2 Close the switch 15 4 1 → 2 Fire device 3 5 1 → 2 Open the switch 14 6 1 → 2 Open switches 14 and 15 7 1 → 2 Request DEP status 8 2 → 1 Return the status to the firing system 9 1 → 2 Sterilize the DEP 10 1 -> 2 Destroy the electronics of the DEP 11 1 → 2 Initialization of the DEP

As already mentioned above, the supply word No. 1 codes for the supply of the circuits of DEP 2. This code (FIG. 3) is preferably "55" in hexadecimal to allow the transmission of a maximum of energy by this word. For example, if the intensity of the current I sent by the firing system 1 to the DEP 2 is 0.1 A, it is possible to transmit 50 μJ per word N ° 1. In this case, if the electronic circuits of the DEP 2 consume a total current of 10 μA, its autonomy can be at most 5 seconds with a capacitor 9a of suitable capacity. However, it is possible to allow a shorter period of autonomy for example only 0.5 seconds, which will reduce the size of the capacitor 9a. It should be noted in this regard that it is possible to envisage connecting to the capacitor 9a a load resistor 9b which absorbs the energy accumulated in the capacitor if, during a predetermined period (for a second for example), no information is available. has passed from the firing system 1 to the DEP 2. This energy absorption function guarantees an increased operating safety of the DEP, the electronics being systematically put in complete standby by absence of power supply if the firing system 1 does not do not activate it.

The function words No. 2 to No. 6 do not require any particular comments, except that when they are sent by the firing system 1, their logical content is sent to the microcontroller 10 which analyzes it and prepares it. the appropriate command, then sends a control signal to the corresponding member or circuit of the DEP 2. For example, if the word No. 2 is sent, the microcontroller 10 activates the actuating circuit 16 which closes the switch 14 The same process is executed for all the other words, it being understood that each of these words is preceded by the word No. 1 making it possible to charge the capacitor 9a.

It will be noticed in connection with the activation of the device 3 that it requires the cumulative closure of the switches 14 and 15, this action having the effect of allowing circulation of a current in this device. We see that this authorization depends on elements that are located in the DEP, ie elements that are located as close as possible to the device. This feature has the particular advantage of allowing, when the ammunition is separated from the firing system 1, to make impossible the ignition of the device 3, inadvertent or fraudulent ignition being made impossible without knowledge of the code that must receive the microcontroller 10. As explained below, the security in this regard can be further enhanced if the messages for the microcontroller 10 are encrypted to make it possible to perform the functions they contain.

The word No. 9 contains the DEP 2 sterilization command via the sterilization circuit 18. This functionality subsequently prevents the closing of the switches 14 and 15, so that the device 3 can no longer be turned on. However, DEP 2 can still answer words 7 and 10 as long as they are sent by the firing system 1.

The word No. 10 has the effect of activating the destruction circuit 19. By this command, not only the switches 14 and 15 can no longer be closed, but also the transmission / reception circuit 7 being destroyed, no communication can no longer take place with the outside. This feature may be useful, if the ammunition with the DEP according to the invention is to be forcibly abandoned for example, a hostile or unauthorized entity then being unable to fire the ammunition.

Table 2 above shows by way of example a possible coding of the status request function word No. 7, each code corresponding to a particular status request issued by the firing system 1 to the DEP 2. The request calls a response from the DEP in the form of the word No. 8 whose content is representative of a specific state of the DEP.

It should be noted that the word n ° 8 is coded in a particular way, since emanating from the DEP 2, it should be that sending it to the firing system 1 imposes in the DEP 2 only a very low energy consumption. This word No. 8 is preferably coded on a bit only that can take the value "1" or "0".

The code of the function word No. 7 is preferably formed of a four-bit identification part designating the status request followed by a part also of a four-bit length designating the nature of the requested status of the DEP. Table 2 lists the meaning of this part of the requested status. Table 2 Code (hexadecimal) Meaning 0 Not used 1 Functional control by transmission of a "1" 2 Functional control by transmission of a "0" 3 State of the switch 14 4 State of switches 14 and 15 5 State of sterilization control 18 6 State of the supply circuit 9 7 Voltage U> at a predetermined voltage? (4 Volts for example) 8 Artifice 3 OK? 9 Already shot AT Not used B Identification of DEP 2; Bit 1 VS Identification of DEP 2; Bit 2 D Identification of DEP 2; Bit 3 E Identification of DEP 2; Bit 4 F Identification of DEP2; Bit 5

For example, assuming that the firing system 1 must successively check the state of the switches 14 and 15 and that of the device 3, the message sent by the firing system 1 to the DEP 2 will be as follows: No. 1 (Table 1), Word No. 7 (Table 1) with Code No. 4 (Table 2), Message No. 8 (the bit "1, if the switches are closed and the bit" 0 "if the switches are open), word # 1, word # 7, but with code # 8, word # 1, word # 8 (with the bit at "1" or at "0" at state of the device 3), and finally the code word n ° 1.

According to a feature particularly favoring the operating security of the DEP according to the invention, at least some function words can be accompanied by at least one encrypted word in which the control code of the corresponding functionality is contained.

Like Function Word No. 7, each other function word of Table 1 is composed of a byte whose four most significant bits identify the corresponding functionality. According to the invention, the four low weight bits of these words can define the length of an encryption message that can be sent in the message M following the function word of Table 1 defining the considered functionality.

An encrypted message can be prepared in the firing system 1 and sent in groups of eight successive bits, each time the interposition of the supply word No. 1 to charge the capacitor 9a. The encryption can be performed in a known manner using a public or private key encryption algorithm. In this case, the microcontroller 10 can execute a corresponding decryption program loaded into its memory using an inverse algorithm using the same public or private key as appropriate. The four low-order bits of each function word will thus be able to define the length of the encrypted message, that is to say its number of bits or, more precisely and preferably, of nibbles (group of four bits).

It should be noted that when the four low-order bits of the function word represent the hexadecimal value "0", the entire command code is contained in the single byte of that word and there is then no encryption. For example, if the function is to close the switch 14 and this function is considered insensitive in terms of security, the sequence of words sent by the firing system 1 to the DEP 2 will be the following: word no. 1, word # 2 (with the four low order bits at "0", word # 1 .....

The following sequence of words illustrates by way of example the command with encryption of the closing function of the switch 15, being assumed that the four least significant bits of the function word have the value "8" (hexadecimal) meaning that the encryption is carried out on eight nibble or 32 bits: word n ° 1, word n ° 3 with the code "8" (in hexadecimal), word n ° 1, word n ° 3 including the first nibble encrypted in lower weight , word # 1, word # 3 with the second encrypted quartet, word # 1, word # 3 with the third encrypted quartet, word # 1, word # 3 with the fourth quartet encrypted, word # 1 , .....

It should be noted that the level of security of the transmission of messages between the firing system 1 and e DEP 2 will be higher the greater the number of encrypted bits. Of course, the processing time will also increase with an increasing number of encrypted bits.

Thus, it may be advantageous to encrypt on a large number of bits only the sensitive commands such as the simultaneous closing functions of the switches 14 and 15 and to choose for the other functions of the fewer encrypted bits. One of the important advantages of the invention lies in the large choice of degrees of confidentiality available to the designer for designing secure messages.

Function word ° 11 of Table 1 is only used to initialize the ammunition during manufacture. It can in particular be used to determine the number of bits to be encrypted for each function word used.

FIG. 4 illustrates a firing sequence involving, by way of example, a sequence of four function words, of a period for sending the ignition energy for the device 3 (time T) during which the I current rises to a comparatively high level compared to the intensity used for the transmission of messages M, and finally several additional words sent after the shooting to interrogate the DEP 2 when to its status.

Claims (14)

1. Method of controlling at least an electro-pyrotechnic safety device (2) coupled to a firing system (1), said device being able to communicate with the firing system (1) to send it a current (I) intended to convey information (M) for controlling at least one function of said device and an energy pulse for the initiation of an exploder (3) of said device, which method consists in authorising the passage of said energy pulse into said exploder (3) only if an authorisation for circulation of said pulse is delivered by said firing system (1),
   said method consisting in:

   a) generating said control information in said firing system (1) in the form of a message (M) including a logic word (m₁, m₂, m₃, ...) representative of said circulation authorisation function,

   b) transmitting said logic word to the electro-pyrotechnic safety device (2),

   c) analyzing said logic word in the latter device to extract therefrom a control signal of said circulation authorisation function, and

   d) delivering the authorisation of circulation in said electro-pyrotechnic safety device (2) in response to said control signal,

   said method being characterised in that said circulation authorisation function is duplicated in said electro-pyrotechnic safety device (2), and
   in that it consists in executing the operations a), b) and c) for each of said functions, and
   in delivering the authorisation for circulation of the current pulse (I) in said exploder (3) only in response to the cumulative appearance of the two control signals produced in this way.
2. Method according to claim 1 of controlling an electro-pyrotechnic safety device (2) comprising analysis and control electronic means (10, 16 to 19) and accumulation type electrical power supply means (9) to which the current (I) is selectively sent to supply power to said analysis and control electronic means (10, 16 to 19),
   said method being further characterised in that, at least before the execution of said operations a), b) and c), it consists in
   generating in said firing system (1) a power supply logic word, and
   accumulating the energy represented by the successive bits of said power supply logic word in said accumulation type power supply means (9) to enable the operation of said analysis and control means (10, 16 to 19).
3. Control method according to claim 2, characterised in that the power supply logic word represents a maximum of possible transitions, such as the code "55" in hexadecimal, on the basis of one byte.
4. Control method according to any one of claims 1 to 3, characterised in that it consists in
   generating in said firing system (1) at least another logic word representative of another function to be executed in the electro-pyrotechnic safety device (2),
   transmitting said other logic word to said electro-pyrotechnic safety device (2),
   analyzing said logic word in said electro-pyrotechnic safety device (2) to generate a control signal of said other function, and
   executing said other function in response to said control signal that corresponds to it.
5. Control method according to claim 4, characterised in that said other function is capable of sterilising said current circulation authorisation function.
6. Control method according to either claim 4 or claim 5, characterised in that said other function is capable of controlling the destruction of at least a portion of said electro-pyrotechnic safety device (2).
7. Control method according to any one of claims 1 to 6, characterised in that it further consists in
   generating in said firing system (1) a function logic word representative of a request for the status of said electro-pyrotechnic safety device (2),
   transmitting said function word to said electro-pyrotechnic safety device,
   generating in said electro-pyrotechnic safety device (2) a response to said status request according to a particular state of said electro-pyrotechnic safety device, and
   sending said response to said firing system (1).
8. Control method according to claim 7, characterised in that said response to a status request is coded on a single bit.
9. Control method according to any one of claims 1 to 8, characterised in that it consists in
   encrypting at least a portion of said message (M) in said firing system (1), and
   decrypting said message portion in said electro-pyrotechnic safety device (2) before executing said function defined in said message.
10. Control method according to claim 9, characterised in that at least some function logic words of said message (M) comprise a first group of bits coding for a predetermined function of said electro-pyrotechnic safety device (2) and a second group of bits defining the number of bits on which said message is encrypted, and
    in that said encryption bits are coded in logic words following the corresponding function word.
11. Control method according to any one of claims 2 to 10, characterised in that each function logic word in said message is preceded and followed by power supply logic words.
12. Electro-pyrotechnic safety device for munitions coupled to a firing system, comprising:

    an exploder (3) for initiating said munition,

    send/receive means (7) for receiving from said firing system (1) a current (I) intended to convey information (M) for controlling at least one function of the electro-pyrotechnic safety device and an energy pulse for initiating an exploder (3) of said electro-pyrotechnic safety device,

    analysis and control means (10, 16 to 19) for analyzing the messages received and extracting the control signals from them,

    this electro-pyrotechnic safety device being characterised in that said exploder (3) is connected into a current circulation circuit into which are inserted at least two switches (14, 15) that can be closed only in response to the cumulative production of at least two predetermined control signals authorising circulation of said energy pulse in said exploder.
13. Electro-pyrotechnic safety device according to claim 12, characterised in that it also comprises means (18) for sterilising said switch (14, 15) in response to the production of another of said control signals.
14. Electro-pyrotechnic safety device according to either of claims 12 and 13, characterised in that it also comprises means (19) for destroying at least a portion of said electro-pyrotechnic safety device (2) in response to the production of another of said control signals.

Images