EP3098559A1 - Method for launching a missile from a launching device - Google Patents

Abstract

The invention relates to a method for starting a missile (4) from a starting device (2), in which a data connection (36) between a control unit (10) of the starting device (2) and a command post remote from the starting device (2) ( 26) is constructed and a start of the missile (4) from the command post (26) via the data link (36) is controlled. In order to reliably avoid an unwanted start of the missile (4), it is proposed that a fuse unit (22) receives arming information (46) via the data connection (36) and a signal connection (12) between the control unit (10) and a starting device (6 ) of the missile (4) unlocked.

Description

The invention relates to a method for starting a missile from a launcher, wherein a data connection between a control unit of the launcher and a remote from the launcher command is established and a start of the missile is controlled by the command stand on the data connection.

Ground-based air defense systems that are controlled from a remote command post are known to defend against aerial attacks. The air defense systems include a launcher having a number of missiles, such as missiles, launched from the launcher into the air. The command post, in turn, controls one or a plurality of such launchers distributed over a greater distance in the landscape.

In ground-based air defense systems, a high safety standard must be maintained in order to avoid an unwanted launch of a missile. For this purpose, the boot devices are connected via a data connection with the command state, so that an unwanted manipulation of the data flow between the command post and boot device is avoided. The launch of the missile can only be controlled from the command post. In addition, a start can take place only after the release by an operator of the starting device, for example, after this has flipped a switch and a safety time has elapsed, in which the operator can move away from the launcher.

It is an object of the present invention to provide a method for launching a missile from a launch device that can be easily and safely performed.

This object is achieved by a method of the type mentioned, in which receives a fuse unit via the data connection Entsicherungsinformation and unlocks a signal connection between the control unit and a starting device of the missile.

The invention is based on the consideration that the laying of a data line between the command post and the starting device is associated with great expense, in particular with a long distance between the two units. Starting the missile could therefore be simplified if existing data links are used, for example existing data lines and / or wireless data links. However, there is a risk of unwanted data feed into the existing data connections, so that the possibility of manipulation and thus an unwanted launch of a missile is given.

To counteract this danger, it makes sense to add an additional backup of the boot process. By the fuse unit according to the invention, the signal connection between the control unit and the starting device can be locked. Only in the presence of Entsicherungsinformation the signal connection can be unlocked and thus the launching of the missile are possible.

In addition, the arming information can remain very simple, so that their transmission can be made simpler and safer than the transmission of larger starting information amounts that are transmitted for a start of a missile from the command post to the starting device. A manipulation of the transmission of the arming information can also be counteracted in this way, since the correctness of the arming information is easier verifiable. If there is a suspicion of manipulation of the arming information, the signal connection between the control unit and the starting device can be blocked and thus an unwanted start of the missile can be prevented.

The starting device and the command post expediently form a ground-based air defense system. The starting device is expediently a mobile starting device, for example, mounted on a vehicle, which may have a canister positioned on a truck or a ship and containing a plurality of missiles. The missile may be a missile with a rocket engine. However, the invention is also applicable to starting devices for Ballistic missiles, such as for steering ammunition and / or artillery projectiles.

To start the missile start information can be sent from the command post to the control unit, in particular flight information, such as information on the flight route and / or destination information contains, the start information is sent via the data connection from the command post to the control unit of the starting device, this information - if necessary edited - passes on to the missile. The start information may further include start trigger information for triggering a launch of the missile. The launch of the missile may be controlled by the control unit of the launcher, which initiates the launch of the missile in response to the presence of the start trigger information.

The data connection expediently extends from the command post to the starting device, at least it extends over 90% of this route. It can be a wired connection, in particular from the command post to the starting device, for example a connection via one or more optical fiber lines. Also possible is a wireless data connection or a combination of wired and wireless connection. Expediently, the data connection comprises or is an Internet connection, so that the start information and in particular also the release information is sent via an Internet connection. An Internet connection can be understood as a connection in a public or non-public network, for example in an intranet, which takes place according to an IP protocol, for example according to TCP / IP. A data transmission over the data connection, in particular over the entire data connection, can in this case take place via an IP protocol, the data connection in particular being a frame-based transmission path. The data transmission of the destination information and the arming information is expediently carried out over the same transmission path of the data connection. It runs at the boot device expediently via the same Media Access Controller (MAC) and especially router. In particular, on the command stand side, the data connection runs via a same MAC or router and, for example, via the same Ethernet switch. Inclusion of an Internet connection is considered to have been effected by maintaining the same transmission path of start information and arming information via the data connection when both the start information and the arming information are sent via the Internet.

In an advantageous embodiment of the invention, the securing unit maintains the unlocking for a predetermined period of time. The time period may begin upon receipt of the arming information or after a successful check of the arming information for plausibility. Conveniently, the security unit locks the signal connection between the control unit and the starting device after the expiration of the period again. The receiving of the uncorrupted release information can therefore only trigger an unlock for the predetermined period of time. The period of time may be predetermined from the outset, for example by an information stored in the security unit. It is also possible that the predetermined period of time is dependent on the arming information and, to that extent, is specified externally, for example by an authorization unit. The time period is expediently in a range between 1.1 times and 2.9 times a transmission interval of the arming information to the security unit, in particular between 1.1 times and 1.9 times the transmission interval.

Advantageously, the arming information is sent repeatedly over the data connection to the security unit. Here, the repetition interval is expediently smaller than a predetermined period of time after which the fuse unit blocks the signal connection between the control unit and the starting device again. The signal connection between the control unit and the starting device can be repeated in this way and / or continuously maintained, so that an interim control of the launch of the missile by the command post is possible. Advantageously, the arming information is sent regularly to the fuse unit, for example, with a repetition rate of more than 1 Hz, in particular more than 10 Hz.

A corruption of the arming information can be counteracted when it is sent in IP / UDP format to the backup unit. Instead of the UDP protocol, another private protocol is also possible. The transmission of the arming information and this itself can be kept simple, so that the verification of the arming information on plausibility is possible in a simple manner.

The security unit may comprise a commercially available PC as at least a primary data processing element. Conveniently, however, the fuse unit is Field Programmable Gate Array (FPGA) circuitry built up. By configuring an unwanted intervention can be counteracted. Also an authorization unit sending the arming information is expediently constructed from FPGA circuits. Such an authorization unit may include an encoder for transmitting the arming information. The security unit expediently comprises a corresponding decoder for decrypting the release information.

Furthermore, it is advantageous if the arming information is sent via a retry-free protocol via the data connection. The transmission of a data packet containing release information to the security unit is thereby expediently carried out only once, so that the data packet can be lost in the event of disruptions in the connection. If a data packet is lost, this can be detected by, for example, the lack of expected information, so that possible corruption of the data connection can be detected.

The arming information can be contained in a data packet, which can be configured in particular as a so-called Wake On LAN data packet. In general, the data packet can be provided with a so-called magic. It can either be addressed directly to the protection unit (unitcast) or exclusively to a subgroup of several units of the network (multicast) or sent as a broadcast. In a broadcast, for example, it contains the hexadecimal value FF 6 times in succession, thereby addressing all the subscribers of the network. The MAC address for multicast can be determined by the hexadecimal byte sequence 01 00 5e followed by three bytes whose lowest 23 bits consist of the IP address of the receiver group. This can be used to address selected network subscribers who have registered as subscribers to a particular completed group. The MAC address at Unitcast is characterized by the 6 bytes (48 bit) worldwide unique MAC address of the receiver. This allows a single selected subscriber from the network to be addressed.

The magic is suitably a part of the arming information determined in its length, for example a 32-bit long area. It may contain the order of the areas of the release information, its protocol structure and / or a time condition of a regular transmission of the release information, for example the repetition rate. Next, the Magic contain a count of a counter. Appropriately, the data packet, at least the release information, encrypted, so that unauthorized access is difficult.

A further advantageous embodiment of the invention provides that the arming information contains a data record, in particular a data packet, which contains a security state. The backup state, that is, information about whether the backup unit should block or unlock the signal connection between the control unit and the start device, can only be one bit long. Furthermore, the arming information expediently contains a counter, which is expediently changed each time the arming information is sent. For example, the counter increments by one or another predetermined number each time the arming information is retransmitted. In addition, the Entsicherungsinformation advantageously contains a check information that allows a consistency check, or plausibility check the release information. The check information may be, for example, a Cyclic Redundancy Code (CRC).

Furthermore, it is advantageous if the arming information is repeatedly sent via the data connection to the security unit. The arming information is expediently changed at each transmission at least in a counter relative to the previously transmitted unlocking information. The successively sent Entsicherungsinformationen differ so far from each other at least in a data packet area, such as the counter, which is changed at each repetition. Advantageously, the security unit checks on the basis of the counter a complete receipt of the sequence of repetitions. In the absence of a repetition, such as the lack of arming information in a series of arming information sent in tandem, the security unit blocks the signal connection between the control unit and the missile's starting device. On the other hand, if there is a complete sequence of received repetitions of the transmission of the arming information, then the security unit appropriately keeps the signal connection unlocked.

The arming information can be sent from a command unit of the command post. However, increased safety is useful if the control of the launch of the missile is done by a device of the command post and the release information from another device, in particular outside the command state is generated. In this case, it is also advantageous if the arming information is generated independently of processes of the command unit, in particular if the device for generating the arming information is operated by another operator, as the device for controlling the start of the missile. The device that generates the arming information is referred to below as an authorization unit. It is conveniently connected to the internet and sends the arming information over the same data link as the missile launch control device.

The protection against unwanted launch of the missile from the launcher can be further increased if a launch of the missile takes place only after at least three times the release. A release may be the unlocking of the signal connection between the control unit and the starting device of the missile by the security unit. A second release may be an unlocking of the signal connection between the control unit and the starting device of the missile by a switch signal of an operator of the starting device. The switch, either a mechanical switch or an electronic switch, can be brought by the operator in the armed position, the release is expediently after a predetermined period of time after bringing the switch into the arming circuit to give the operator time for removal from the launcher , The third release can be done by the control unit of the starting device, for example, triggered by the start command from the command state via the data connection. The start command from the command post to the control unit or from the control unit to the starting device can be understood here as a backup. The order of the three arming is arbitrary. Conveniently, the three arming devices are triggered by three different persons, an operator of an authorization unit who sends the arming information to the security unit, an operator of the command post and an operator of the starting device.

In order to facilitate control of the starting device from the command post, it is advantageous if the security unit sends a status report to the command post, expediently via the same data connection, for example the Internet connection, via which the arming information is sent. The status report expediently contains the arming status, that is, whether the Signal connection is locked or unlocked. Expediently, the status report additionally contains the information as to whether the received arming information is plausible or whether it has been received without gaps for a predetermined period of time. The status report can be sent to the command state using the TCP / IP protocol. Expediently, the command state contains a status display on which an operator is shown the status of the security unit.

It is also advantageous if the command post sends a status request, for example in the form of an echo, to the security unit. This is answered in particular directly by the control unit and / or the security unit. For this purpose, a status report, as described above, be sent to the command post.

Furthermore, it is advantageous if the security unit returns a modified release information to an authorization unit. This is expediently carried out via the same protocol with which the arming information was sent by the authorization unit to the security unit. The modified arming information may contain a modified magic, for example an inverted magic, and in particular contains the status of the security unit, a counter and / or a plausibility information, such as a CRC. The authorization unit may check the modified arming information and make the generation of further arming information, in particular the setting of the security state, depending on the test result.

The invention is also directed to a starting device for launching a missile having a missile container, a control unit for controlling the launch of the missile and establishing a data connection between the control unit and a command post, for example a MAC or router for establishing an Internet connection between the control unit and the command post. In order to achieve a simple and safe control of the missile, it is proposed that the starting device according to the invention contains a blocking device in the signal connection between the control unit and a starting device of the missile and contains a connectable with the data connection fuse unit which is connected by signal technology with the locking device.

The description of advantageous embodiments of the invention given so far contains numerous features that are summarized in several dependent claims in several groups. However, these features may conveniently be considered individually and grouped together into meaningful further combinations, in particular when reclaiming claims, so that a single feature of a dependent claim can be combined with a single, several or all features of another dependent claim. In addition, these features can be combined individually and in any suitable combination both with the method according to the invention and with the device according to the invention according to the independent claims. Thus, process features can also be formulated formally as properties of the corresponding device unit and functional device features also as corresponding process features.

The above-described characteristics, features, and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of the embodiments, which will be described in detail in conjunction with the drawings. The embodiments serve to illustrate the invention and do not limit the invention to the combination of features specified therein, not even with respect to functional features. In addition, suitable features of each embodiment may also be explicitly considered isolated, removed from one embodiment, incorporated into another embodiment to complement it, and / or combined with any of the claims.

It shows FIG. 1 as a single figure a starting device 2 for a plurality of missiles 4 in a schematic representation, which is designed as a truck and thus mobile. The launcher 2 comprises on its loading surface a starting device 6 with one or more canisters 8, in each of which one or more missiles 4 are held in the form of guided missiles, each with a rocket motor. In addition or as an alternative to the canister 8, the missile 4 may be held on a launch rail. Furthermore, the starting device 2 comprises a control unit 10 for controlling the launches of the individual missiles 4 from the starting device 6. The control unit 10 is connected to the starting device 6 via a signal connection 12 in the form of a data line. However, the signal connection 12 is through a blocking device 14 with two AND gates 16 interrupted, so that a signal transmission from the control unit 10 to start device 6 is interrupted when the signal connection 12 is interrupted.

The control unit 10 is also connected to the starting device 6 via a further signal connection 18. In the signal connection 18, a switch 20 is arranged, with which the signal connection 18 can be interrupted or connected. The signal connection 18 is connected to one of the AND gates 16. With the other AND gate 16, a fuse unit 22 is connected via a further signal connection 24. For exchanging data, the fuse unit 22 is also directly connected to the control unit 10.

At a distance of several kilometers to the starting device 2 is a command post 26 with a command unit 28 and an input means 30. In the command post 26 may further be an authorization unit 32 with a further input means 34 is present. However, it is also possible that the authorization unit 32 is located with its input means 34 away from the command post 26, for example in another building or another city. This is indicated by the dashed line at the command post 26, which indicates that the authorization unit may be part of the command post 26, but need not be.

From the command post 26, a number of starting devices 2 are controlled, of which in FIG. 1 only two launcher 2 are shown. Other launcher 2 are represented by three points in the lower part of FIG. 1 indicated. For controlling the starting devices 2, the command post 26 is connected via a data connection 36 with all starting devices 2. The data connection 36 is in FIG. 1 For the sake of clarity, it is shown interrupted, but it is consistent. The data connection 36 is implemented between a transmitter 38 and a receiver 40 as at least one wireless Internet connection, which is implemented as a non-public network (intranet) and is operated in an Internet protocol. Alternatively, it is possible to carry out the entire data connection 36 between transmitter 38 and receiver 40 as data line, whereby transmitter 38 and receiver 40 can be dispensed with in this case and both units in the illustrated circuits can be understood as Media Access Controller (MAC) and Ethernet Switch ,

At the in FIG. 1 In the embodiment shown, the authorization unit 32 and the command unit 28 are housed in a single building and are connected via Ethernet in connected to a Local Area Network (LAN). Via an Ethernet switch 42 and a media access controller (MAC), not shown, the authorization unit 32 and the command unit 28 are connected to the Internet data connection 36 and thus to all start devices 2.

On the input side, the starting device 2 also includes a media access controller 44, via which the security unit 22 and the control unit 10 are connected to the data connection 36 and thus have a connection to the command post 26.

To start a missile 4 from the launcher 2 this is parked at a predetermined position in the landscape. An operator O1 of the starting device 2 establishes a data exchange with the command post 26 by operating the control unit 10 via the data connection 36.

Another operator 02 in the command post 26 prepares the start of the missile 4 by entering and / or selecting start information 45 in the command unit 28, each missile 4 own start information 45 is assigned. The start information 45 is sent via the data connection 36 to the control unit 10, as in FIG. 1 is indicated by a dashed arrow. The transmission takes place here as a unitcast and in the TCP / IP protocol, the start information 45 is thus sent to one and only to this control unit 10 of the plurality of boot devices 2 available.

Although a start of the missile 4 is controlled by the command post 26 or the command unit 28, it must be authorized by the authorization unit 32 or an operator 03, respectively. In order to prevent an unwanted start of the missile 4, the authorization unit 32 sends arming information 46 to the security unit 22. The arming information 46 can be sent as a multicast, that is to only a part of the starter devices 2 present in the non-public network, or as a broadcast, that is to all the starting devices 2 present in the non-public network. The releasing information 46 can be sent in the UDP / IP protocol. Alternatively, a private protocol can be used. The protocol used is defined in the header of the arming information 46. In the case of a private protocol, the 16bit value of the Ethernet Version 2 Frame Type field according to IEEE 802.3 is such a value that is free by the IANA (Internet Assigned Numbers Authority), ie not with a log is occupied. The value of the Type field may be officially registered, but without a related protocol. The protocol may be pre-established between the communicating entities, in this case, the authorization entity 32 and the backup entities 22, or may be established in advance.

The authorization unit 32 sends the arming information 46, which is encrypted as well as the start information 45, regularly and at equal intervals, so that the arming information is sent, for example, 10 times per second via the data connection 36 to several or all of the security units 22 in the network. In the following, only one fuse unit 22 is considered, since all fuse units 22 of the boot devices 2 work the same in the network.

At each transmission, the arming information 46 is changed so that each arming information is individual for a predetermined period of time. The arming information 46 is a data packet with at least four, in particular exactly four sections.

The first section is a so-called magic 48, in which the data structure or protocol structure of the entire data packet 46 is reproduced. In addition, the temporal condition for the regular transmission of the arming information 46, in this case the selected repetition rate, can be found in the Magic 48. Furthermore, the magic 48 contains the counting of a counter 50, which is included as the third segment of the data packet in the release information 46. The arming information 46 also contains the arming state 52. This is specified by the authorization unit 32 and the operator 03 via the input means 34. Lastly, the arming information 46 includes a check code 54, in this example a so-called Cyclic Redundancy Code (CRC).

The arming information 46 arrives regularly at the fuse unit 22, which compares the time of arrival with the specified in the Magic 48 time interval. In addition, it checks counter 50 based on the counter information specified in the Magic 48. This means in the illustrated embodiment that the counter with each Entsicherungsinformation 46 counts up by one. In this way, the security unit 22 provides each arming packet 46 received determines whether any packet 46 sent in the meantime has been received or whether packets 46 have been lost.

The arming information 46 is sent repetitively from the authorization unit 32 to the arming unit 22. For this purpose, a UDP protocol is used, which is a retry-free protocol. Also possible is another user data protocol without retry, or another private protocol, where the magic without a header can directly mark the beginning of the corresponding frame. The arming information 46 is sent as a broadcast from the authorization unit 32 via its UDP port 56 in the data connection 36. The arming information 46 thus reaches all start devices 2, the release units 22 receive the information on their UDP port 56.

The command unit 28, however, controls the start of the missile 4 via a standard TCP / IP protocol via a TCP port 58 of the command unit 28. Data from the command unit 28 are received via a corresponding TCP port 58 of the control unit 10.

Without the corresponding input of the operator 03 in the input means 34, the authorization unit 32 sends the armed state 52 "disabled" or "disabled". The release unit 22 receives this Entsicherungszustand 52 and holds by a corresponding signal on the signal connection 24, the AND gate 16 and thus the signal connection 12 between the control unit 10 and the starting device 6 interrupted. Even if the control unit 10 would control a start of a missile 4, then the start of the missile 4 would be omitted by the interrupted signal connection 12. Even with a malfunction of the data link 36, the signal connection 12 - regardless of the armed state 52 - interrupted. Because the fuse unit 22 detects the fault by, for example, missing data packets of the arming information 46 and automatically switches the AND gate 16 to interrupt.

To start the missile 4, the operator 03 releases the release by a corresponding input in the input device 34. The authorization unit 32 changes the arming state 52 of the next-transmitted data packet or of the next-following released arming information 46 to "unprotected" or "enabled". The data packet is received by the security unit 22 and - with interference-free previous receipt of the data packets or arming information 46 - the fuse unit 22 releases the AND gate 16, so that the signal connection 12, the AND gate 16 can pass uninterrupted. A start of the missile 4 can now be controlled by the command unit 28 and the operator 02.

For this purpose, the operator O1 receives a corresponding signal, so that it switches the switch 20 and thus suspends the interruption of the signal connection 18 through the switch 20. That second AND gate 16 is unlocked and the signal connection 12 is continuously enabled by the control unit 10 to the starting device 6 for data transmission. The command unit 28 now controls the start via the data link 36, the control unit 10 receives the start signal and controls the starting device 6 accordingly, which fires the relevant missile 4 from the canister 8. Alternatively, the operator O1 can already secure the starting device 6 prior to the authorization by the operator 03 and in particular also before the control by the operator 02. The starting device 6 is now prepared for control by the command unit 28 when released by the authorization unit 32.

If the start of the missile 4 has already been released by the authorization unit 32 and the signal connection 12 between the control unit 10 and the starting device 6 is continuous, it may happen that the data connection 36 is disturbed, in the worst case by an unauthorized intervention of another party. In this case, data packets of the arming information 46 are lost, so that the security unit 22 detects the absence of arming information 46 on the basis of the counter 50. This happens very quickly because the fuse unit 22 knows the transmission frequency of the arming information 46. If more than a predetermined number of data packets 46, in particular only one, are missing, the security unit 22 blocks the signal connection 12. If, for example, after the last correct reception of the release information 46, the next following release information 46 does not exist after 1.8 times the transmission interval Thus, the fuse unit 22 blocks the signal connection 12. The absence of even a single data packet 46 is thus detected and the launch of the missile 4 is prevented by the interruption of the signal connection 12.

It must now be a release of the fuse unit 22, which can be made only by the operator 03 and / or by the operator 02 of the command unit 28. For this purpose, the security unit 22 sends its own state to the Command unit 28. This can be done via the control unit 10 and thus via a regular TCP protocol. The transmission of the state of the security unit 22 to the command unit 28 also takes place regularly. The state contains the indication of the most recently received arming state 52. In addition, the transmitted state of the security unit 22 contains information as to whether the data traffic between the authorization unit 32 and the security unit 22 proceeded without interference. Disturbances caused by, for example, irregularities in the meter or irregularities in the plausibility (CRC) lead to a fault condition.

The corresponding state is displayed on a display unit 58 of the input of the input means 30, for example in the form of a traffic light, as in FIG FIG. 1 is indicated. One color means trouble-free data transmission and unsecured arming state 52. Another color means, for example, a trouble-free data traffic and a secure arming state 52. A third color indicates a disturbance in the data transmission and can occur together with the other two colors. A fault is now detected by the operator 02, and the operator 02 can decide whether he wants to put back the fuse unit 22 in a trouble-free state or start the missile 4 should be prevented. A corresponding command can be given to the fuse unit 22 via the command unit 28 and the control unit 10. This places itself in a no-fault state and checks whether the next-received arming information 46 is correct and plausible both in the counter 50. If so, it will remain in its regular state. If the irregularity continues, it switches back into an error state or refuses to carry out the debugging command from the command unit 28 and sends the corresponding signal back to the command unit 28.

It is also possible that a status request from the command post 26 or the command unit 28 is actively sent to the backup unit 22 or the control unit 10. This can take the form of a so-called echo, so that an interruption of the data connection 36, which is longer than a known time period, is already recognized by the echo. Otherwise, the transmission of the state of the fuse unit 22 may be as described above.

In addition, the security unit 22 sends information to the authorization unit 32. This information is sent in the same way as the release information 46, namely in UDP protocol or a corresponding Protocol and the data connection 36. This information includes a modified Entsicherungsinformation in a data packet that is constructed analogous to the data packet of the arming information 46. The modified arming information also includes a magic which is, however, inverted from the last received magic 48. Further, the arming state 52 is sent and a counter 50. In addition to the check information also sent, the own state is also sent, so that the modified arming information in a data packet has corresponding to five and not just four sections.

The authorization unit 32, analogous to the security unit 22, checks the received modified arming information for plausibility as well as for the count. If an undisturbed data transmission is detected, analogous to the execution of the security unit 22, a corresponding signal can be displayed on a display unit 60 of the input device 34. The operator 03 is now informed both about the state of the security unit 22 and about the state of the data connection 36. If there is a malfunction of the security unit 22, he can fix it via his input means 34, analogously to the described Entsichern by the operator 02. This is preferably done by sending a corresponding signal from the authorization unit 32 to the command unit 28, as described above , which causes reversion of the fuse unit 22 to the regular state via the control unit 10. The fuse unit 22 responds as described above.

LIST OF REFERENCE NUMBERS

2

Boot device

4

missile

6

starting device

8th

canister

10

control unit

12

signal connection

14

locking device

16

AND gate

18

signal connection

20

switch

22

backup unit

24

signal connection

26

command post

28

Commanders

30

input means

32

authorization unit

34

input means

36

Data Connection

38

transmitter

40

receiver

42

Ethernet switch

44

MAC

45

start information

46

Entsicherungsinformation

48

Magic

50

counter

52

Entsicherungszustand

54

Verification code

56

UDP port

58

TCP port

60

display unit

O1

operator

02

operator

03

operator

Claims (13)

Method for starting a missile (4) from a starting device (2), in which a data connection (36) is established between a control unit (10) of the starting device (2) and a command post (26) arranged remotely from the starting device (2) and Start of the missile (4) is controlled by the command post (26) via the data link (36),
characterized,
in that a securing unit (22) receives arming information (46) via the data connection (36) and unlocks a signal connection (12) between the control unit (10) and a starting device (6) of the missile (4). Method according to claim 1,
characterized,
in that the securing unit (22) maintains the unlocking for a predetermined period of time and, after the expiration of the period of time, blocks the signal connection (12) between the control unit (10) and the starting device (6) again. Method according to claim 1 or 2,
characterized,
in that the repeating interval is smaller than a predetermined period of time after which the security unit (22) switches the signal connection and the starting device (6) locks again. Method according to one of the preceding claims,
characterized,
that arming information (46) in IP / UDP format is sent to the security unit (22). Method according to one of the preceding claims,
characterized,
in that the unlocking information (46) is sent in the ethernet-frame private protocol via the data connection (36). Method according to one of the preceding claims,
characterized,
in that the release information (46) comprises a data record which contains a security state (52), a counter (50) and a check information (54). Method according to one of the preceding claims,
characterized,
that the arming information (46) is repeatedly sent via the data connection (36) to the security unit (22) and contains a counter (50) which is changed at each repetition, and the security unit (22) by means of the counter (50) a complete receipt the sequence of repetitions checked and in the absence of repetition, the signal connection (12) between the control unit (10) and the starting device (6) of the missile (4) blocks. Method according to one of the preceding claims,
characterized,
in that the control of the launch of the missile (4) is performed by a command unit (28) of the command post (26) and the arming information (46) is generated by an authorization unit (32) outside the command post (26) independently of processes of the command unit (28) , Method according to one of the preceding claims,
characterized,
that a start of the missile (4) is carried out exclusively according to an at least threefold safety catch, a release of the signal connection (18) between the control unit (10) and the start means (6) of the missile (4) by a switch signal of an operator (O1) of the boot device (6), an unlocking of the signal connection (12) between the control unit (10) and the starting device (6) of the missile (4) by the securing unit (22) and a release by the control unit (10) of the starting device (2). Method according to one of the preceding claims,
characterized,
in that the securing unit (22) sends a status report to the command post (26) via the control unit (10) of the starting device (6). Method according to one of the preceding claims,
characterized,
in that the command post (26) sends a status request to the security unit (22), which is answered directly by the control unit (10) and / or the security unit (22). Method according to one of the preceding claims,
characterized,
in that the securing unit (22) sends modified unlocking information back to an authorization unit (32) via the same protocol as the unlocking information (46). Starting device (2) for starting a missile (4) with a missile container (8), a control unit (10) for controlling the start and for establishing a data connection between the control unit (10) and a command post (26),
marked
by a blocking device (14) in the signal connection (12) between the control unit (10) and a starting device (6) of the missile (4) and a fuse link (22) which can be connected to the data connection (36) and which is connected to the blocking device (14 ) connected is.

Images