EP1020699A1 - Missile - Google Patents

Abstract

To increase the availability of a missile (10), functionally important elements of the missile (10) are provided redundantly. The missile (10) has means (80) for function monitoring, error detection and localization and reconfiguration of these elements. Different versions of such means using knowledge-based and learnable structures are described. <IMAGE>

Description

The invention relates to a missile.

A missile is part of a weapon system. The missile becomes a target guided. This can e.g. through a navigation unit or through a search head take place, which detects the target and generates steering signals. The missile is unmanned. The The missile's flight time from launch to hit is relatively short. The Flight guidance system of the missile, e.g. with search head or navigation unit therefore only functions for a short time.

Manned aircraft work with a variety of sensors and safety-related ones Components. Airplanes are in use for a long time. The failure of a sensor or Safety-relevant component during use can cause the Aircraft. For this reason, it is known to have security-related elements including the software of flight controllers redundant and means for Use fault detection, fault identification and reconfiguration (FDIR). It If the failure of a sensor or a defect in a sensor is then recognized, it will determines which sensor or which element has failed or is defective and it will then the failed or defective sensor or element is turned off and it only the remaining sensors or elements are used for flight guidance.

DE-39 29 404 A1 shows an example of a method and an apparatus for Detection and identification of errors in sensors. DE 39 23 432 C2 shows a Example of monitoring the software by means of which the redundant provided sensors provided signals by redundantly provided computers are processed.

Such measures appeared for missiles that are on the one hand unmanned and on the other others only fly once for a short time, not required.

Another problem arises with missiles, namely that of "availability": Missiles may very long, possibly for decades, until they finally become Come into play. The missiles must then be ready for use. Even through long Storage without use can impair the function of the missile enter. Availability is the probability of becoming a missile to be found in a functional condition at a certain point in time. This problem that To ensure operational readiness of the missile even after a long storage period by appropriate construction of the elements of the missile, by appropriate Storage of the missiles and through regular checks with test facilities solved. If elements of the missile prove defective in such a test, the missile is repaired.

It is complex to design the elements of the missile in such a way that the decades of no storage failures and the high availability of the To reach the missile alone constructively. There is still a risk that a long stored missile is not operational. The possibility remains more regular Tests and repairs if necessary. During the test and repair period for regular tests the missile is not available for use. A decrease in Interval between tests to increase security against failures reduced hence the availability of the missile.

The invention is based on the object of increasing the availability of missiles increase.

According to the invention this object is achieved in that to increase the Missile availability of mission-critical elements of the missile redundant are provided and the missile means for function monitoring, error detection and localization and reconfiguration of these elements.

"Elements" can be sensors, signal processing means or actuators. The The term "elements" is also intended to include information that is necessary for the function of the Missile are essential.

According to the invention, means which e.g. to increase the safety of manned personnel Airplanes themselves during their relatively long-term use are known, used for another purpose, namely to increase the above Defined "availability" of missiles during their short deployment such measures would certainly not be required. High reliability and Missile availability is achieved through fault tolerance. On fault-tolerant system has the ability to perform its specified function even when Hardware or software errors continue to occur without restriction.

The German term "error" includes: errors in the physical Faults, in hardware and software, resulting in errors in the world Information world ("errors") and ultimately resulting failures or Malfunctions in the system ("failures"). A "fault" can be a defect on a sensor. The "fault" leads to a wrong signal ("error"). The "error" leads to a Missile malfunction.

Embodiments of the invention are the subject of the dependent claims.

Fig.1

zeigt schematisch einen Flugkörper und ein Flugzeug mit den verschiedenen Elementen und Schnittstellen.

Fig.2

veranschaulicht die Überwachung der Elemente des Flugkörpers durch "BIT" und "FDIR".

Fig.3

ist eine schematische Darstellung eines Gerätes zu Fehler-Erkennung, Fehler-Identifikation und Sensor-Rekonfiguration (FDIR).

Fig.4

zeigt eine Ausführung der Mittel zur Fehler-Erkennung und Fehler-Identifikation.

Fig.5

veranschaulicht die Umsetzung eines ein Symptom für einen Sensorausfall oder -fehler liefernden stochastischen Signals in Zugehörigkeiten zu linguistischen Wertebereichen.

Fig.6

veranschaulicht die Umsetzung von Signaländerungen, die ein Symptom für einen Sensorausfall oder -fehler liefern, in Zugehörigkeiten zu linguistischen Wertebereichen.

Fig.7

ist ein Blockdiagramm und veranschaulicht das mit Fuzzy-Logik aufgebaute Entscheidungsnetzwerk zur Erzeugung eines Sensor-Statusvektors.

Fig.8

veranschaulicht die Struktur der Flugkörper-Software

Fig.9

zeigt den Aufbau einer Anordnung zur Überwachung der Flugkörper-Software.

Fig.10

zeigt die Überwachungsanordnung der Software bei einer Anordnung von Fig.9.

Fig.11

veranschaulicht die automatische Erstellung des Überwachungsprogramms.

Fig.12

veranschaulicht die Stellglieder des Flugkörpers.

Fig.13

zeigt die Erzeugung eines StellgliedStatusvektors.

The invention is explained below using exemplary embodiments with reference to the accompanying drawings.

Fig. 1

shows schematically a missile and an aircraft with the various elements and interfaces.

Fig. 2

illustrates the monitoring of the missile elements by "BIT" and "FDIR".

Fig. 3

is a schematic representation of a device for error detection, error identification and sensor reconfiguration (FDIR).

Fig. 4

shows an execution of the means for error detection and error identification.

Fig. 5

illustrates the implementation of a stochastic signal providing a symptom of sensor failure or error in belonging to linguistic value ranges.

Fig. 6

illustrates the implementation of signal changes that provide a symptom of a sensor failure or error in belonging to linguistic value ranges.

Fig. 7

Figure 3 is a block diagram illustrating the fuzzy logic decision network for generating a sensor status vector.

Fig. 8

illustrates the structure of the missile software

Fig. 9

shows the structure of an arrangement for monitoring the missile software.

Fig. 10

shows the monitoring arrangement of the software with an arrangement of Fig. 9.

Fig. 11

illustrates the automatic creation of the monitoring program.

Fig. 12

illustrates the actuators of the missile.

Fig. 13

shows the generation of an actuator status vector.

In Figure 1, 10 denotes a missile. The missile 10 contains a seeker head 12 in his nose. The nose has a tip that is permeable to radar radiation (RADOME) 14 and a window 16 that is transparent to infrared radiation. Behind the radar-permeable tip 14 is a passive array sensor 18 working in the X-band and a phase array sensor 20 working in the K-band. The one working in the X-band, Passive array sensor 18 is connected to associated tracking electronics 22. The phase array sensor 20 operating in the K-band has associated tracking electronics 24 connected. Behind the window 16 that is transparent to infrared radiation there is an infrared sensor 26 working in the middle infrared range. The infrared sensor 26 is associated tracking electronics 28 downstream. The chase electronics 22, 24 and 28 receive data from strapdown finder and navigation signal processing 30. The strapdown finder and navigation signal processing 30 receives data from an inertial measurement unit and satellite navigation by a Block 32 are shown. One is the missile's own movements in the signals of the missile fixed ("strapdown") sensors considered Zum others navigational data are obtained, i.e. data about the position and possibly Missile speed. The outputs of the tracking electronics 22, 24 and 28 are connected to means 34 for sensor fusion. Through the sensor fusion Receive seeker signals based on the signals from multiple sensors. This Search head signals are applied to a flight guidance signal processor 36. The Flight guidance signal processing 36 continues to receive data from the strapdown seeker and Navigation signal processing 30. Finally, if necessary, on the flight guidance signal processing 36 signals from a data transmission unit 38. Flight control signal processing 36 is also in data exchange with one missile-side mission unit 40. Flight guidance signal processing 36 effects the flight guidance in the marching phase and in the final phase. Flight control signal processing delivers commands to an advanced autopilot 42 Autopilot 42 may also receive data from data transmission unit 38 Autopilot 42 provides control commands for the actuation of control surfaces and for the thrust at outputs 44 and 46. Furthermore, a circuit 48 is provided which is based on data from the Means 34 is applied to sensor fusion and through which a seeker-based Ignition command can be generated, which is output 50 to a warhead is launched The missile 10 is before launch via an interface 52 and a feed cable 54 is connected to the carrier aircraft carrying the missile 10, the in Figure 1 by a block 56 in the left part of the figure. The interface 52 stands with the missile-side mission unit 40, the signal processing 30, the Flight guidance signal processing 36 and the autopilot 42 in data exchange.

The carrier aircraft 56 also has sensors, which are formed by blocks 58, 60, 62, 64, 66 and 68, e.g. a radar 58, a forward-facing infrared sensor FLIR 62 or sensors for satellite or inertial navigation GPS / INS 68. The sensors are switched to a mission avionics 70 of the carrier aircraft 56. Based on A sensor signal is used to identify, identify and track a target. Mission avionics provides data to mission planning means 72, namely fire control solution and the tactical dynamics. Mission avionics 70 provides data about location, type and Movement of the target. Mission planning means 72 provide data about how this is done Target to be fought. The interface 52 in the starter device receives the Mission avionics 70 information from the missile 10 with its sensors already provides information while it is still in the launcher of the carrier aircraft hangs.

After the missile 10 has been fired, the mission avionics 70 and the Mission planning means 72 continue wirelessly with the data transmission 38 Missiles stay in two directions in data exchange.

Block 74 symbolizes other contributors, e.g. a command center or others friendly aircraft that can be used to set a target. The "target by Third "is symbolized in FIG. 1 by block 76. The target can be set via Data transmission 38 transmitted to the missile 10 or to the carrier aircraft 56 become.

The missile sensors can be divided into sensors for measuring the Own motion state of the missile and sensors for target detection and Tracking.

The own movement of the missile is measured with inertial sensors Acceleration and rotational speed recorded. Furthermore, in some cases Satellite navigation systems such as GPS ("Global Positioning System") for accurate Position determination used. This is element 32 in Fig. 1.

Finders are used for target discovery and target tracking, preferably image-resolving ones Finders whose signals are subjected to image processing. These are e.g. image processing radar finder like element 18 in Fig.1 or infrared finder like element 26 in Fig.1. The seekers can work passively or actively. With an infrared finder a distance measurement is also carried out in the final phase by means of a laser.

Fault tolerance is achieved through redundancy of sensors. When Sensor errors that are recognized and identified as a result of redundancy , the sensors are reconfigured: The signals from defective sensors are disregarded, the required information is derived from the signals other sensors and possibly combinations of such signals.

The inertial sensors are multiplied. The degradation behavior "fail-operational", i.e. functionality even after the failure of any Sensors, each with a minimum of five (instead of three) rotation rate and acceleration sensors achieved, which is arranged in a special geometry to the missile axes are. The rotation rate sensors can be optical rotation rate sensors. It is also possible, micro-mechanical sensors (EP 0 686 830 B1) for rotation rates and To use accelerations. The extra overhead for redundancy will thereby relatively low, so that it can also be used for loss objects such as missiles Increased availability and lower maintenance costs are weighed.

Satellite navigation systems can be used as multi-channel systems (multi-channel GPS) be designed so that redundant position information from the satellite navigation system is available to monitor and select the currently cheapest channels can be used.

Furthermore, movement information can also be obtained from the signals of the infrared and Radar sensors can be obtained.

The own movement of the missile, flight attitude and position is also determined by Multiplication of sensors or by using sensors that are actually one serve another purpose, recorded redundantly.

Fig.2 shows schematically the monitoring of the functionally important elements of the Missile 10. At 80 is generally the device for recognizing and identifying Errors and to reconfigure the elements of the missile 10 (FDIR). Sensors, represented by a block 82, are monitored, the information and the Data processing represented by block 84 and the actuators by a block 86. A block 88 symbolizes a built-in test procedure (BIT), through which the physical function of the individual components is checked. It will For example, checked whether a motor winding of a gyro receives power. Subsequently the FDIR checks for errors. The result is determined by inference and Status means 90 processed: "If the signal from sensor A is recognized as faulty, then discard the signal from sensor A and only process the signals from sensor B and C ". Status: failure of sensor A. The built-in test procedure can additionally result that sensor X receives no current. This also gives a status signal: "Failure of Sensor X, working with Sensor Y, which ran similar information. "The status signals are connected to the missile mission unit 40.

3 schematically shows the structure of the FDIR device 80 for error detection, Identification and reconfiguration.

In Figure 3 with 90A to 90N sensors of the missile 10 are designated, their signals or data is connected to the device 80. The connection is through double arrows shown. This means that the FDIR device 80 also on the sensors 90A ... 90N acts, e.g. turns off a sensor. The FDIR device 80 does one Monitoring the missile hardware and subsystems 10. This is through block 92 shown. This is done once through "voting" and plausibility checks: if one Triple redundant sensor is provided and a measured value is clearly different from the measured values deviates from the other two, then this deviating measured value is considered false considered. The majority counts. A plausibility check checks whether a received Measured value is physically meaningful. This type of monitoring is shown in FIG Block 94 shown. Furthermore, the built-in test procedures (BIT) are carried out by block 88 is shown. This is a way of checking the hardware and Subsystems.

Another way of checking hardware and subsystems is through block 98 shown. Here the signals by means of knowledge, model, pattern or parity-based processing checked for errors. The mistakes will be recognized and identified. This is represented in FIG. 3 by block 100 (FDI).

In addition to the hardware, the software is also monitored. That is in Fig.3 by a Block 102 shown. Decision processes take place, represented by block 104. And finally, if necessary, sensors are reconfigured by a block 106 is completed.

On the basis of the measurement values thus obtained, effectors and actuators 108 controlled. Here too, information is transmitted in two directions, what is indicated by a double arrow. Also the function of the effectors and Actuators are monitored by the FDIR device in the manner described.

A block 110 provides the communication of the FDIR device 80 e.g. with the missile mission unit 40 represents, this communication also in two directions he follows. Block 112 symbolizes the human / machine interface.

The sensors of the missile are generally designated by 90 in FIG. These sensors include redundant inertial sensors 114, a multi-channel receiver for satellite navigation (Multi-channel GPS with 6 -10 channels) 116 and infrared and radar sensors 118. The multiplication of the inertial sensors, i.e. rotation rate and acceleration sensors, so that a degradation behavior "fail-operational" can be achieved consist of the fact that a minimum of five sensors are used, each in special Geometry to the missile axes are arranged. Through the multi-channel GPS receive redundant GPS information for monitoring and selecting the currently cheapest GPS channels can be used. The infrared and Radar sensors 118 also provide motion information.

Block 120 represents the formation of location and speed data, which together the GPS data and the data of the inertial sensors are obtained. It can happen a Kalman filter or an SDRE filter (State Dependent Riccati Equation), with the help of which the GPS and inertial data are optimally integrated. As The output variable of this block is the measured (not the calculated) covariance signals of the Kalman filter or SDRE filter.

The output signals of the sensors 114, 116 and 118 are applied in a measurement vector m to an arrangement 122 of neural networks 124 and 126. The measurement vector m comprises the output signals of the sensors 114, 116, 118. The measurement vector is a function of the physical state of motion x of the missile, on which errors summarized in an error vector ε are superimposed: m = f ( x , ε ).

The error vector ε can contain step-like or ramp-shaped and stochastic errors and can also represent total failures such as zero measurement signal or constant full deflection.

The measurement vector m is connected to the first neural network 124. In the first neural network 124, the useful signal m ( x ) and the error m ( ε ) are separated by projecting the measurement vector m into the error space (parity space) orthogonal to the measurement space. This creates a feature or validation vector v . Errors map to the validation vector v . This is used to detect errors.

The feature vector v is connected to the second neural network 126. This second neural network 126 causes the fault to be located. The defective sensor or channel is thus identified by the second neural network 126. This neural network 126 thus has the function of a classifier in relation to the error space in which the feature vectors point to specific error clusters.

The networks 124 and 126 are created with prior knowledge from an analytical solution of the Problem of error detection and identification equipped and then in one Training phase either by simulation of the sensor arrangement and typical errors or trained with the real sensor arrangement 90 with simulated errors. It has shown that the networks 124 and 126 not only individual errors but also Recognize and localize simultaneous errors and errors in quick succession. Furthermore, they record and localize the disappearance of temporary ones Errors that e.g. occur as a result of strong maneuvers, so that the sensor arrangement 90 can work self-regenerating.

The output of the second network 126 is a location, identification and classification vector. This vector is fed to a decision network 128, possibly together with the feature vector v . This is represented by connections 130 and 132, respectively.

The decision network 128 is still the output of the Kalman filter or SDRE filter 120 switched on. Form in the covariances of the measurement difference measurement errors as well as sensor failures. The courses of these signals can therefore useful when deciding whether and where errors have occurred be included.

130 is a Kalman filter that is used for the initialization and calibration of the Missile inertial system (MLS-IRS) is provided. The Kalman filter processed Information from the aircraft inertial system as well as the missile inertial system. The covariance signals provided by the Kalman filter 130 are a measure of that Function and the instantaneous quality of the MLS-IRS missile inertial system. This Covariance signals are also on connection 132 to the decision network 128 activated.

Block 134 symbolizes rule-based heuristic knowledge about the sensors 114, 116, 118 and their interaction in the system. That too is on the decision network 128 activated.

The decision network 128 contains a fuzzification layer 136 on the input side. This is followed by a control layer 138 and an inference layer 140 a defuzzification layer 142 is provided. Decision network 128 delivers a sensor status vector.

The task of the decision-making network is, from the analytical sympftom signals, e.g. the identification vector and rule-based heuristic knowledge of the relevant sensors and their interaction in the system possible "faults" by type, Identify the place and time of occurrence. This is a uniform one Presentation of symptoms important. This is made possible by the fuzzy logic by both analytical and heuristic symptoms through membership functions too Fuzzy sets for decision making are represented consistently.

The signals fed to decision network 128 are stochastic variables with mean and variance. An example of the time profile of such a variable S is shown in the left part of FIG. 5 by curve 144. "Faults" change these values. In the left part of FIG. 5, the variable S normally fluctuates around line 146 with the variance σ. If a "fault" occurs, the signal curve shifts by ΔS on line 148. Usually, these symptoms are used when a predetermined threshold value S _{max is} exceeded for the binary decision for the occurrence of a "fault". This is shown in the middle part of Fig.5. If the variable S reaches or exceeds the threshold value S _max , a “fault” is signaled in binary, which is indicated by the rectangle 146: The probability μ (S) of the presence of an error then becomes “1”. This carries the risk of a high false alarm rate. This can be avoided by introducing a "fuzzy threshold", as shown in the right part of FIG. 5. Here three functions 150, 152 and 154 of S are defined. Functions 150 and 152 are triangular functions. The peak values of functions 150 and 152 are "1". The peak value of function 150 lies on the S value of line 146. The peak value of function 152 lies on the S value of line 148. Function 154 shows a ramp 156 which starts from the S value of line 148 and from S _max upward constant "1" remains. The functions intersect at a function value of 0.5. The function 150 is assigned to the linguistic quantity "normal", the function 152 to the linguistic quantity "low" (fault) and the function 154 to the linguistic quantity "increased". A certain value S of the variable balls can then be assigned to a certain percentage, for example the linguistic variable "normal" and to another percentage the linguistic variable "small".

Fig. 6 shows an example in which the increase or decrease in a symptom or Characteristic forms a criterion for the occurrence of a "fault" and by introduction linguistic value ranges (fuzzy sets) is described, each of these A "membership function" is assigned to value ranges. 6 are the Membership functions as degree µ (S) of a value S belonging to a Value range shown. µ (S) is again a maximum of one. There is one Triangular function membership function 158 of the value range "normal", the trapezoidal membership functions 160 and 162 of the positive and negative, respectively Value ranges "less" and the membership functions 164 and 166 of the positive or negative value ranges "a lot". The value ranges overlap, so that a certain value S in different, through the membership functions certain degrees can belong to different neighboring value ranges.

By "fuzzifying" the decision network 128 receives the various Inputs from the identification network 126, the Kalman filters 120 and 130 and 134 inputs comparable to heuristic knowledge, namely Degrees of membership between zero and one to linguistic value ranges.

FIG. 7 shows the decision network 128 and the one therein in another representation signal processing.

A database 170 contains the for the various input variables Decision network 128 the linguistic range of values (fuzzy sets) and the Membership functions are saved for these value ranges. Block 172 symbolizes an input interface for the fuzzification of the input variables based on Inputs 174 are connected. These are operations as they are related to Fig. 5 and 9 are described. The fuzzification is at the bottom of Figure 7 by block 176 indicated. The linguistic variables thus obtained are applied to block 178. Block 178 contains a rules database 180. The rules database contains rules of Form "If ..., then ...", after which the linguistic quantities in one Inference level 182 can be linked. This is indicated by block 184 in FIG. 7 below. The quantities thus obtained are summed up in a summing point and on a block 188 activated. Block 188 provides an output interface for the Defuzzification. This output interface also receives the in the database 170 stored linguistic value ranges and membership functions via Link 190. Defuzzification is shown in Figure 7 below by block 192 indicated. The output interface delivers at an output 194 as "hard" Output a sensor status vector, with the help of which the signals of the intact Sensors can be reconfigured for further processing in the system.

The mapping of "faults" to observable symptoms or features follows physical cause-effect relationships, often the analytical Description of these relationships is difficult. In this case, the stake learnable network structures are displayed, as indicated in Fig.4. It can but heuristic knowledge in the form of "If .., then ..." rules for linguistic-qualitative Description of the interrelationships should be included. The one on the At first glance, the structure of the decision network 128 from Fig. 4 and 7 leads to a simple hardware implementation as a fuzzy-neuronal Network.

The sensor FDIR concept described here is a parity vector based, feature-based, knowledge-based method. It comes without any more or less elaborate sensor or subsystem modeling. Furthermore she draws the Ability to detect and localize simultaneously or in quick succession occurring errors, with the possibility of self-regeneration.

The three networks necessary for the realization (Fig. 4) are in hardware as ASICS realizable, so problems with software reliability at this point can be avoided. The networks are fast thanks to the hardware implementation and - because of the parallel structures - fault-tolerant and inexpensive to produce. They are adaptable to change through learning and not through reprogramming.

The FDIR concept described uses similar or dissimilar sensor redundancy ahead. In its basic structure, it can also be used for multi-sensor technology Time recording and for non-redundant sensor configurations can be used. The latter, however, requires analytical redundancy with model-based approaches, whereby again knowledge-based representations can be used.

The processor and memory hardware is made using standard, proven BIT means supervised. Fault tolerance is due to multiplication with mechanical and electrical Basically segregation in connection with voting / monitoring techniques implementable. Because of the reliability of the hardware modules in question in the case of long storage, this measure can ensure availability to be dispensed with.

However, the fact that the memory modules (EEPROMS, FLASHPROMS) with long shelf life (> 10 years) partially or even their contents can lose completely. However, this can be done by reloading the software preparation for operations are taken into account.

Because of the known history of the number of failures over the useful life of hardware Components (so-called "bathtub curve") occur statistically after a hardware faults exponential probability distribution. So you're statistical predictable so that the availability of the system in question at this point preventive maintenance measures can be guaranteed.

The software structure for the main control, steering and control functions of the The missile is shown in simplified form in FIG. 8.

Block 196 symbolizes the mission control software 40 (Fig. 1), i.e. certainly, what the missile should do, e.g. Detect, identify and track a certain goal. Block 198 symbolizes the software of the viewfinder sensor subsystem. This is a signal processing of the seeker and possibly inertial signals through which the Seeker pursued the specific goal. Block 200 represents the software of the mid-course and Final phase flight guidance 36 (Fig.1) through which the missile according to the Finder signals to the destination. Finally, block 202 provides the software of the Autopilot 42, which directs the missile according to the flight guidance 36.

In contrast to hardware errors, software errors occur after completely different ones Regularities. They "latent in the system from the beginning and become with certain combinations of the input variables and the internal state variables of the relevant module triggered. Even with extensive verification measures and validation, they cannot be fully identified and eliminated. Elaborate techniques have been and are used to avoid software faults. One example is the so-called "N version programming". This involves dissimilar software used in N redundant software and hardware channels. Because of the extremely high Development and implementation effort is this way for Missile applications excluded.

FIG. 9 shows a circuit which is tolerable with the effort that can be borne by missiles against software errors and thus the availability of the missile improved.

The sensor data of the missile are symbolized in FIG. Block 206 symbolizes other input data. The data records are connected in parallel to at least two computer channels 208 and 210. The computer channels 208 and 210 deliver output data p _n and p _{n-1 in a} computing cycle. Each computer channel works with a nominal software N and a monitor version M of the nominal software.

geprüft". Wenn dieser Satz von Eingangsvariablen einen Zeittakt weiter auf den Rechner 210 aufgeschaltet wird, dann muß auch dieser Rechner mit Nominalsoftware und Monitorsoftware den gleichen Ausgang liefern. Das gestattet eine Kontrolle der Funktion der Rechner 208 und 210. Man hat nämlich die Gewißheit, daß die Software einwandfrei arbeitet. Abweichungen sind dann auf einen Fehler eines der Rechner zurückzuführen.The two computers work with a time offset of one computing cycle. The computer 208 processes the data generated in this time cycle n. At the same time, the computer 210 processes the data that had arisen in the previous clock cycle n-1. However, this data has already been processed by the computer 208 in the preceding time cycle, namely once by the nominal software N and on the other hand by the monitor software M. If the computer 208 came to the same result in the two channels with different software N and M , which is referred to here as p _n , is the software for this set of input variables

If this set of input variables is applied to the computer 210 one more time cycle, then this computer with nominal software and monitor software must also deliver the same output. This allows the function of the computers 208 and 210 to be checked. that the software is working properly. Deviations are then due to an error in one of the computers.

However, it is also possible to control the software. If the one with the Nominal software N and the monitor software M calculated output variables in the If the two channels of the computers 208 and 210 differ from one another, then one Software failure. However, it cannot be said with which software this error occurs occured. The monitoring of the software is now based on the consideration that the Output variables of the computers, e.g. a commanded control surface position, steadily change and not jump. From the course of an output variable in the In the next calculation cycle, the value of the output variable can go past with some Accuracy can be predicted. A clear deviation of the initial size from that predicted value in one channel while the output quantity in the other channel corresponds approximately to the predicted value, indicates a software error in this Channel.

This is shown in Fig. 10 as a flow chart.

The input data for the nth computing cycle are identified by an oval 212. With these input data, the vector p at the time nT, → p N / n is calculated with the nominal software N. This is represented by rectangle 214. In addition, the vector p at the time nT → p M / n is calculated with these input data using the monitor software M. This is represented by rectangle 216. The difference is formed from the vectors of the output variables thus calculated with the two programs N and M. Δ p n = p N n - p M n .

This is represented by rectangle 218. If the output variables in the two channels deviate, predicted output variables p ∧ N / n and p ∧ M / n are calculated from the curve p _{ni of} the output variables in the past. This is represented by rectangle 220 in FIG. 10. The differences between the predicted output variables of the computers and the actually calculated output variables are then formed in the next computing cycle. This is represented by rectangle 222. A fuzzy decision logic 224 is then used to output an N _n status of the nominal software N, an M _n status of the monitor software M and an, Fail "status is output as a software status vector. An output vector p ∧ _{n is} formed from the calculated vectors p N / n, p M / n, the predicted vectors and the software status vector. This is represented by a rectangle 228. This output vector p ∧ _n is the vector which, taking software monitoring into account, is applied to an output 230 and used further.

The monitor or monitoring software M should be simple algorithmic and logical Use elements (standard modules) in generally validable structures arranged to represent a variety of (software) problem solutions. It simple algorithmic and logical elements are provided. These elements become a specific solution to the problem in structures adapted to the problem be combined. These requirements are ideally met by neural ones Networks and fuzzy neural networks. These networks define a given one Standard structure with uniform, simple processor units.

The free parameters of the structure are set in a training phase. Here input and output vectors of the input and output spaces of the each associated nominal software module used. There is a possibility the structure and / or parameters using genetic / evolutionary algorithms optimize the specified criteria. This is an automatic generation of Monitor software possible. For automatically testing the generated software other than the training vectors from the entrance and exit rooms are used.

This is shown in Fig.11.

Block 232 symbolizes a neural network that can be used in the manner described above. Block 234 symbolizes a fuzzy-neural network that can be used accordingly. Finally, block 236 symbolizes a genetic algorithm. The neural network 232 and the fuzzy neural network 234 provide a standard representation. This results from training with input and output data ( data-driven "), which are represented by a memory 238, a setting of structural parameters. This type of structuring also has a potential for a genetic / evolutionary optimization of the structure and / or parameters. This is represented in FIG. 11 by a block 240. The monitor software is generated automatically, as shown by block 242 in Fig. 11. The input and output vectors of the input and output spaces, which are different from the training vectors and are also stored in memory 238, are used to test the monitor software thus obtained .

This procedure is very general for the automatic generation of software modules applicable.

The monitor software is based on a neural or fuzzy-neuronal Network structure created. The monitor software M can preferably be used as a hardware module, for example in the form of an ASIC. That has different Advantages: The reliability of the module can vary according to the laws of failure Hardware to be assessed. It does not become software for monitoring software used. The parallel information processing in the hardware provides - in certain Limits - an inherent fault tolerance of the module.

In a further embodiment of the invention, the nominal software can also be used with regard to of the input and output identical hardware modules are replaced. This Hardware modules can be used where the inherent fault tolerance to achieve the required reliability and thus availability is not sufficient, multiplied become. This would eliminate the need for monitor modules. The software is up Hardware modules of high reliability mapped, the adaptation to different tasks are done through learning.

A missile can have a plurality of actuators. That is in Fig. 12 shown. The missile 10 may have a transverse thruster 244, which on the Missile 10, as shown, exerts a transverse thrust. That does one Lateral acceleration of the missile 10. Additional actuators can control surfaces or Rudder 246. A rudder deflection, as shown, causes an angle of attack that also leads to lateral acceleration. Finally, the thrust vector of the Engine by adjusting the engine nozzle or by in the engine jet protruding deflection surfaces (Jet Vanes) can be changed as shown. A missile can have all three types of actuators. But it is then when one fails Actuator not able to move the missile through the remaining To influence actuators in the desired manner.

The missile's positioning system is therefore one Simplex configuration ". There is no possibility of a reconfiguration, as is possible in the manner described above, for example if redundant sensors fail. Therefore, in a further embodiment of the invention, measures for intelligent "detection and identification of errors. This is to increase the probability of detecting and localizing errors (faults) in the pre-flight phase and, if possible, until immediately before departure.

Such an arrangement is shown in Fig. 13.

As shown in Fig. 13, there must be a difference between external and internal faults "can be distinguished. External faults "are, for example, damage due to collision or errors in the power supply. Internal faults "are, for example, faults in the gearbox, bearings, insufficient lubrication or component faults. An initial monitoring can be carried out on the actuator 250 by measuring certain signals, for example the input current or the deflection, and comparing these signals with fuzzy predetermined tolerance thresholds in the manner of Fig.5 is a general statement about the function of the actuator is made.

An improvement in error detection and, above all, the possibility of localization can be realized with the help of knowledge-based elements. 13, neuronal or fuzzy-neuronal, non-linear dynamic state and parameter models are assumed. In Fig. 13, 252 denotes a neural network that represents such a model. 254 denotes a fuzzy-neural network, which also represents such a model. The models from networks 252 and 254 are connected to a knowledge-based, non-linear estimator 256, which receives data from actuator 250 for comparison. If necessary, further inputs from the flight guidance and control system of the missile 10 are also connected to the estimator 256, as indicated by input 258. The estimator 256 provides real-time estimates of the state variables x and the parameter p of the actuator. If errors occur, these estimates contain the error components Δ x and Δp . If the relevant nominal values are known, a statement about the status of the actuators can be made continuously by a fuzzy decision and inference unit 160.

As shown in FIG. 2, an inference and status unit 90 is provided, which the results of sensor, information, data processing and Actuator monitoring and the results of the built-in test (BIT) become. The unit 90 also generates from it through inference and inference processes Fuzzy logic Information regarding the operational status of the missile and its essential functional parts and thus their availability.

Claims (23)

Missile, characterized in that to increase the availability of the missile (10) functionally important elements of the missile (10) are provided redundantly and the missile (10) has means (80) for error detection and localization and reconfiguration of these elements. Missile according to claim 1, characterized in that the means for error detection and localization and reconfiguration contain knowledge-based means (98). Missile according to claim 1 or 2, characterized in that the means for error detection and localization and reconfiguration contain model-based means (98). Missile according to claim 1 or 2, characterized in that the means for error detection and localization and reconfiguration contain pattern-based means (98). Missile according to claim 1 or 2, characterized in that the means for error detection and localization and reconfiguration contain parity-based means (98). Missile according to one of claims 1 to 5, characterized in that the means for error detection and localization and reconfiguration contain means (94) for monitoring redundant hardware by majority observation. Missile according to one of Claims 1 to 6, characterized in that the means for error detection and localization and reconfiguration contain means (88) for monitoring redundant hardware by means of direct functional testing. Missile according to one of Claims 1 to 7, characterized in that the means for error detection and localization and reconfiguration contain means (94) for monitoring the hardware by checking the plausibility. Missile according to one of Claims 1 to 8, characterized in that the means for error detection and localization and reconfiguration contain means (102) for monitoring the operational software. Missile according to one of claims 1 to 9, characterized in that (a) sensors (114; 116) for measuring the own movement state of the missile (10) itself and sensors (118) for target acquisition and tracking are provided in such a way that information about the own movement state of the missile (10) is obtained redundantly, (b) the means for function monitoring contain means (106) for reconfiguration such that when information from one sensor becomes unusable, this information is obtained from the information from the other sensors. Missile according to claim 10, characterized in that inertial sensors (114) are provided several times. Missile according to claim 10 or 11, characterized in that the missile contains a multi-channel satellite navigation receiver (116). Missile according to one of Claims 10 to 12, characterized in that means (36) are provided for generating movement information from the data from target-detecting infrared and radar sensors. Missile according to one of claims 1 to 13, characterized in that a neuro-fuzzy network (128) is provided for monitoring the sensor errors. Missile according to one of claims 1 to 14, characterized in that (a) a measurement vector ( m ) formed by the redundant sensor signals is connected to a neural projection and detection network (124), by means of which a projection of the measurement vector ( m ) into the error space (parity space) orthogonal to the measurement space separates the useful signal and errors are carried out and thus a feature vector ( v ) is generated on which errors map, (b) the feature vector ( v ) is applied as an input variable to a neural identification network (126), by means of which the error that has occurred is localized. Missile according to claims 14 and 15, characterized in that (a) the feature vector ( v ) is connected to a decision network (128), (b) the decision network (128) is a neuro-fuzzy network with a fuzzification layer (136), a control layer (138), an inference layer (140) and a defuzzification layer (142) and (c) the decision network (128) provides a sensor status vector. Missile according to claim 16, characterized in that the feature vector ( m ) is also connected to the decision network (128). Missile according to one of claims 1 to 17, characterized in that for monitoring the software (a) data to be calculated are calculated once with one with a main program (N) and once with a monitoring program (M), (b) data predicted by extrapolation are calculated from the data already calculated. (c) determine the differences between the predicted data and the data actually provided by the programs, and (d) these differences are connected to a fuzzy decision logic (224) which supplies a software status vector. Missile according to claim 1, characterized in that (a) input data are processed in parallel by two computer channels, each using a main program and a monitoring program, (b) the two computer channels work with a time offset of at least one computing cycle and (c) Means for comparing the calculated output values obtained in the two computer channels are provided, wherein if the output values obtained with the main and monitoring program in the preceding computer channel match and there is a deviation in the output values obtained with the same input values in the two computer channels, a hardware defect in one of the Computer channels is accepted. Missile according to claim 18 or 19, characterized in that the monitoring program (M) is designed as a fuzzy decision logic, the structure and / or parameters of which is generated by genetic or evolutionary algorithms. Missile according to claim 20, characterized in that the fuzzy decision logic is manufactured as a hardware module. Missile according to one of claims 1 to 21, characterized in that error-detecting means (86) are provided for the actuators. Missile according to one of claims 1 to 22, characterized by means (90) to generate a missile status signal.

Images