JPH0769201B2 - Method and apparatus for detecting and identifying failure of airframe motion sensor - Google Patents

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and an apparatus for detecting a failure of a sensor for detecting an angular velocity, an attitude, and a direction of a moving body such as an aircraft, and identifying the failed sensor. In particular, the present invention belongs to a technical field called an analytical redundancy management technology that secures Fail Operativity without increasing redundancy of a multi-system sensor by using software, and replaces with hardware output. The present invention relates to the equivalent increase in redundancy by using information from other sensors as software.

[Prior art]

As one of analytical redundancy management methods, a method using a mechanical relational expression between sensor outputs and a statistical calculation (hereinafter referred to as inter-sensor relational expression / SPRT (Sequential Probability Ratio Test) method) is proposed. Has been done.

Fig. 2 shows the principle of fault identification of a dual sensor by the SPRT method. In this method, failure information (residual error) is extracted by a mechanical relational expression between sensor outputs, the influence of noise is removed by a likelihood ratio test, and the probability of failure is calculated.

FIG. 3 shows the procedure for identifying the failure of the dual system sensor by the SPRT method. The outputs of the two systems (SYS1 and SYS2) are compared directly for each dual sensor, and if the difference becomes abnormal, at least one of the two sensors of the same type (sensor C) has a failure. It is judged that there is, and the failure identification calculation is performed by the method shown in FIG. At this time, the failure likelihood ratio of the sensor having a failure becomes a negative value with time, and the sensor having no failure becomes a positive value. Therefore, a negative threshold value is set and it is determined that the sensor having a failure value has a failure.

When this method is applied to a single system, the sensor outputs cannot be compared with each other, so it is necessary to perform the fault identification calculation for each sensor at all times while initializing the SPRT calculation at regular intervals (MSPRT method). . However, when the sensors that perform the failure identification calculation are a plurality of sensors including a rate sensor that detects an angular velocity and an attitude sensor that detects an angle, which are used for a moving body such as an aircraft, as shown in FIG. Even if there is a failure in the rate sensor (Q sensor), it cannot be distinguished from the failure in the attitude sensor (Θ sensor) related to it, so even if the failure identification calculation is always performed, the failure cannot be identified. .

Therefore, an object of the present invention is to provide a method and an apparatus capable of detecting a fault sensor and specifying the fault sensor in a single system sensor which does not have a comparison target unlike a multi-system sensor.

[Means for Solving the Problems]

Therefore, according to the first feature of the present invention, as shown in FIG. 1, rate sensors P, Q, R (roll rate, pitch rate, yaw rate) and attitude sensors Θ, Φ,
In a device that detects a failure of a plurality of sensors used in a mobile object such as an aircraft including Ψ (pitch attitude angle, roll attitude angle, azimuth angle) and specifies the failed sensor, failure identification calculation is performed for each sensor to cause failure. The failure identification calculation means 1 for obtaining the likelihood ratio, the first judgment means 2 for judging whether or not the failure likelihood ratio is below the threshold value for each sensor, and the sensor under inspection is either a rate sensor or an attitude sensor. Second determining means 3 for determining whether there is any, a means 4 for selecting a rate sensor associated with the attitude sensor when the sensor under inspection is an attitude sensor, the first determining means, the second determining means and selection And a means 5 for controlling the failure identification calculation means in response to the output of the means, the control means for controlling the rate if the sensor whose failure likelihood ratio is below a threshold is a rate sensor. The failure identification calculation is performed again for the sensor, and if the sensor whose failure likelihood ratio falls below the threshold is the attitude sensor, the failure identification calculation is performed for the rate sensor associated with the attitude sensor. A featured fault sensor identification device is provided.

Further, according to the second aspect of the present invention, in a method of detecting a failure of a plurality of sensors including a rate sensor and an attitude sensor used in a mobile body such as an aircraft and identifying the failed sensor, a failure occurs in each sensor. A specific calculation is performed to find the failure likelihood ratio, and it is determined whether or not the failure likelihood ratio falls below the threshold value for each sensor.
If the sensor under test is an attitude sensor, the rate sensor associated with the attitude sensor is selected, and the sensor whose failure likelihood ratio is below the threshold value is the rate sensor. The rate if
A failure sensor characterized in that the failure identification calculation is performed again for the sensor, and if the sensor whose failure likelihood ratio falls below the threshold value is the attitude sensor, the failure identification calculation is performed for the rate sensor associated with the attitude sensor. A specific method is provided.

FIG. 4 shows a comparison between the conventional method and the method of the present invention. As shown in the figure, the conventional method has a problem in that it is impossible to distinguish the failure of the rate sensor from the failure of the attitude sensor. Therefore, in the single system sensor, whether the rate sensor has failed or the attitude sensor has failed. I just need a way to tell if it is To this end, the present invention utilizes the following properties of the fault identification calculation.

The first property is that, for rate sensors, a fault can be detected no matter when the fault identification calculation is started after the fault has occurred. The second property is that, with regard to the attitude sensor, no failure is detected even if the failure identification calculation is started after the failure has occurred, and only the failure that occurred during execution of the failure identification calculation can be found.

By utilizing this property, in the failure identification method for the single system rate sensor and the attitude sensor of the present invention, if the failure likelihood ratio of the rate sensor falls below the threshold value and the failure of the rate sensor is suspected, from that point in time When the failure identification calculation is started for the rate sensor and the failure likelihood ratio again falls below the threshold value for the rate sensor, the failing sensor is identified as the rate sensor, and the rate sensor fails. If the likelihood ratio does not reach the threshold value, it is determined that the rate sensor has no failure, and if the attitude sensor failure likelihood ratio falls below the threshold value and the attitude sensor failure is suspected, it remains from that point. When the failure likelihood calculation is started for the rate sensor strongly related to the attitude sensor in the difference calculation and the failure likelihood ratio falls below the threshold for the related rate sensor, the attitude sensor Fault is determined not, when a failure likelihood ratio of the associated rate sensor does not reach the threshold value,
The faulty sensor is identified as the attitude sensor.

〔Example〕

Examples of the present invention will be described below, but prior to that, for convenience of understanding of the present invention, the basic idea of the present invention will be described first, and then the examples of the present invention will be described.

In the following, we show the calculation method of the relational expression between the sensorns / SPRT method, the failure detection method of the rate sensor and attitude sensor of the single system, and the result of the simulation.

(1) Relational expression between sensors / SPRT method Relational expression between sensors / SPRT (Sequential Probability Ratio)
Test) method is based on FDI (Fault Detection and Isolation, Fault Detecti
on and Isolation).

Many methods of FDI have been devised, but a method of estimating the sensor signal and generating a residual between the estimated value and the sensor signal,
It can be classified by the method of comparing the residual and the threshold value for detecting a failure. The residual generation methods are roughly classified into those using an observer and Kalman filter and those other than them, and the comparison methods can be roughly classified into a simple comparison method and a statistical method.

The inter-sensor relational expression / SPRT method is a method that uses the relational expression of the airframe state quantity in aircraft dynamics for the calculation of residuals and the statistical method for the processing of residuals. Basic inter-sensor relational expression / SPRT
The method is applied to a dual system sensor, and when a failure occurs in any of the dual system sensors, it is determined by direct comparison of sensor signals which type of sensor has a failure and then Is used to identify which of the two sensors is defective.

The FDI system by the relational expression between sensors / SPRT method is designed on the premise of bias failure, but in reality, lamp failure can be detected. Further, it is one of the features that the robustness is high as compared with the method using the Kalman filter and the observer, and the calculation is relatively simple.

Inter-sensor relation / SPRT method is based on the use of relations between airframe states such as P = −sin Θ. For example, if the relationship of P = -sin Θ is used, the roll rate P can be calculated from Θ, Φ, Ψ (pitch angle, roll angle, yaw angle) from the attitude gyro, and the calculated P
By comparing the P signal from the gyro with the signal from the gyro, it is possible to know the presence or absence of a failure. Actually, since the sensor signal always contains noise, there is a risk of misdiagnosis due to the calculation due to noise. Avoiding this, FDI
The SPRT method is a method in which sensor signals are handled by a statistical method in order to improve the accuracy of the. Below is the relational expression between sensors
A fault detection method of rate sensor and attitude sensor by / SPRT method is shown.

Residual Generation Method As mentioned above, the relational expression of the airframe state quantity is used in the inter-sensor relational expression / SPRT method. Generally, the difference between the signal of the sensor that is the target of failure detection (P in the above example) and the signal calculated from another sensor (the same −sin Θ) is called the residual error. The following six relations are used for FDI of rate signal and attitude signal.

Since the formula includes tan Θ and sec Θ, it cannot be used in the whole range of 0 to 360 ° with respect to Θ, so it is transformed into the following formula and used.

= P + sin Θ = (− P) sin Θ + (QsinΦ + RcosΦ) cos Θ The fault detection calculation is performed every sample time T. The relational expression between sensors / the calculation formula of the residual γ used in the SPRT method is the following equation obtained by discretizing the above six relational expressions.

The symbols in the formula have the following meanings.

K: Time (Kth of discrete value) J: System number of dual sensor (j = 1 or 2) The variable without j uses the average value of 2 systems ~: Average value of the values at time i and i-1 T: Sample time Residual test (SPRT method) After calculating the residual γ based on the above equation, the following statistical processing (likelihood ratio test) is performed to judge the failure based on γ. To do.

_First , make _two hypotheses H ₁ and H ₂ .

H ₁ : There is a failure H ₂ : There is no failure At this time, the log-likelihood ratio Z _k (K is time) is determined as follows.

P (γ _k | H _1), when the hypothesis that H ₁ is correct, the probability that the remaining difference of γ _k appears (likelihood, if H ₁ is correct, γ plausibility _{that k} appears) is meant. Similarly, P (γ
_k | H ₂ ) is the likelihood that γ _k appears when H ₂ is correct.
At some time K, the residual γ _k is calculated and P (γ _k | H ₁ ) is P
If it is larger than (γ _k | H ₂ ), then the hypothesis H ₁ has a higher probability of being correct (higher probability of failure), and Z _k becomes a negative value at this time. Conversely, the higher the probability of being normal, the more positive Z _k becomes, and the higher the probability of being normal, the larger the value of Z _k .

From this, it can be understood that the failure can be determined by determining the likelihood ratio with a certain threshold. In the SPRT method, the sequence log-likelihood ratio u _n is used instead of Z _k itself.

The above is the concept of the likelihood ratio test in the SPRT method, and the calculation formula is as follows. As described above, the sensor signal always contains noise, and values such as in simple calculation are expected to jump greatly due to noise.

In the calculation of SPRT method, the following hypothesis is made in consideration of the influence of noise.

H ₁ : At time t _k , there is a failure represented by Gaussian noise with mean m _k and variance σ ² . (There is a sensor noise and a failure.) H ₂ : At time t _k , there is a failure represented by Gaussian noise with mean 0 and variance σ ² . (There is only sensor noise and no failure.) Under this hypothesis, P (γ _k | H ₁ ) and so on are as follows.

The formulas used in such actual calculations are simple.

m _k is determined from the BFM (Bias Failure Magnitude) that indicates how much failure is expected (how much failure should be detected), and the rate sensor: m _k = BFM * (t _k −t ₀ ) Attitude sensor: m _k = BFM. As shown in the above equation, Z _k becomes negative with the occurrence of failure,
The sum of u _n begins to fall. A negative value a is taken as the threshold for failure detection, and if u _n <a (a <0), then failure is determined. The reason that a <0 is set here is that there is a case where u _n <0 near t = 0 due to the influence of noise, and an erroneous determination may be made when a = 0.

(2) MSPRT method The following points are problems in calculating SPRT.

* In SPRT, as long as no failure occurs, the value of u _n will grow infinitely. This indicates that the calculation is inconvenient and the sensitivity to failure becomes low with the passage of time.

To solve this problem, there is an improved SPRT method called MSPRT (Modified SPRT) method. This is an improvement of the SPRT method as follows.

# Limit the calculation time.

If ELT (Elapsed Time Limit) is designed and SPRT calculation elapsed time exceeds ELT, if there is no failure, SPRT calculation is returned to the initial state and restarted.

(3) Application of SPRT to single-system sensor When considering a dual-system 1fail operative / 2fail safe sensor system, failure detection and isolation of double-system sensor Normal / fault determination after single stack (1fail safe capability ).

Is the basic function of inter-sensor relational expression / SPRT and can be realized by direct comparison between sensors and inter-sensor relational expression / SPRT calculation.
In this section, we describe the results of studying the method of executing using the relational expression between sensors / SPRT.

(A) Relational expression between sensors / SPRT calculation procedure in single system The relational expression between sensors / SPRT method is basically based on the fault isolation of the double system. it can.

The fault detection calculation of the MSPRT method is always executed. In the SPRT method, one calculation of U _n is required for one hypothesis, and therefore U _n (U _n ⁺ for failures of + m _k and −m _k for each sensor
And U _n ^-) is calculated. (Calculate sensor type x 2 U _n )
Since failure information cannot be obtained by direct comparison in the single system,
Calculation is always executed.

 The judgment is made as shown in FIG.

AB means the following situations.

A: Go to procedures for finding and identifying failures B: Normal, continue MSPRT.

C: Normal or extended MSPRT revealed no failure.

D: Suspected of failure. Extend MSPRT.

b <U _n (state to proceed to C) or U _n <a (state to proceed to A)
Extended until.

In this procedure, the threshold b is set only when the threshold a is set, when U _n is the threshold a, or when a failure occurs immediately before ELT.
This is because the failure may be overlooked without reaching the following.

(B) Failure sensor identification In the failure detection calculation of the SPRT (MSPRT is the same) method, the U _n of the attitude sensor also decreases when the rate sensor fails, and similarly the U _{n of the} rate sensor decreases when the attitude sensor fails. One failure causes two (or more) U _{n to} be threshold a
May fall below. Therefore, when U _{n of} a certain sensor x becomes low and reaches A in the determination procedure, it is necessary to determine whether it is due to a failure of the sensor x itself or another sensor. .

This judgment is whether the failure is in the rate sensor,
It is enough to tell if it is happening with the attitude sensor. For example, since the P sensor failure detection is based on the equation P = −sin Θ, when the P _n U _n reaches a threshold, the P sensor itself fails, and the Φ and Ψ sensors fail. (Strictly speaking, there is a possibility that Θ is out of order, but it is considered to have a smaller effect than the failure in Φ and Ψ.) Therefore, either the rate sensor or the attitude sensor fails. If it is possible to determine whether the P sensor is working, it can be determined whether the P sensor is really defective.

(C) Discrimination of Failure of Rate Sensor and Attitude Sensor As a method of distinguishing whether a failure has occurred in the rate sensor or the attitude sensor, the property of the formula (1) is used. The values of sin and cos are considered to be small even when the deviation of Θ and Φ is several degrees, and attention is paid to P, Q, R, Θ, Φ, and Ψ. The corresponding terms differ for rate and attitude. The posture signal is the difference (θ _i −
Because it is theta _i-1, etc.) process, even after starting the SPRT after bias failure, its effect gamma, it can not be reflected in the U _n. In other words, the failure of the attitude sensor cannot be found even if SPRT is started after the failure. On the other hand, since the term regarding the rate sensor is in the form of using its own signal such as PT, the failure can be found no matter when SPRT is activated. This state is shown in FIG. 6 (Q sensor failure) and FIG. 7 (Θ sensor failure).

Calculation conditions Airframe motion: Small aircraft perfect linear model Sensor failure: Bias Q… 1 ° / sec, Θ… 1 ° Occurs before SPRT start In the example of FIG. There is no difference. U _n ^÷ (Θ) shows a decreasing tendency from around t = 10 sec, but this is because the motion of the aircraft is calculated by a completely linearized model, so the relationship between variables does not completely match the equation of motion. It has happened and does not detect a failure. On the other hand, in the example of FIG. 6, the reaction of U _n is very fast, and the failure is detected in 0.7 seconds.

An example of a procedure for identifying a failure using this property will be described.

a'is a threshold value of SPRT for identifying a failure, and is set to a little more than 0 (+ side) than a to ensure the discrimination. The correspondence between the sensor that detected the failure in MSPRT and the newly specified failure-specific SPRT is as follows.

The time from the start of a specific SPRT to the final judgment depends on the sensor.

(4) Simulation for detection of failure of single system sensor A simulation for detecting a failure of the single system sensor was performed using the method described above.

Calculation conditions Airframe movement: Small aircraft perfect linear model Sensor failure: Bias Q… 1 ° / sec, Θ… 1 ° As in the previous figures, the left half plane shows the body movement, γ, fault signal, and the right half _plane has U _n showed that. Furthermore, in the upper three rows of the right half surface, the specific SPRT of the sensor that was finally declared to be faulty is shown. Specific SPRT for any sensor for programming simplification, P, Q, and calculates the three Un of R. The above correspondence table is referred to when making a final failure determination.

In FIG. 8 and subsequent figures, event marks related to failure detection are added to the figures. The meaning of each mark is as follows.

☆: U _n <a in MSPRT, and started specific SPRT.

□: U _n <b in MSPRT, extending MSPRT.

◇: A failure was identified.

◯: Extended MSPRT recovers b <U _n , resets MSPRT,
I restarted.

Δ: As a result of the specific SPRT, it was found that this sensor had no failure, and the MSPRT was reset and restarted.

First, FIG. 8 shows the case where there is no failure.

MSPRT is set every 4 seconds (100 samples), U _n ^÷ ,
U _n ^- has a serrated shape. In this example, residual error occurs due to model error in airframe motion calculation, and U _n ^÷ , U _n such as Φ in the latter half
^- are separated.

FIG. 9 shows the Θ sensor with a 1 ° bias fault (occurrence time t = 1.0 sec). In this example, U
_n ^- (Q) is afflicted with a in the fall time t = 1.56sec (☆ mark). After that, a specific SPRT is executed for Q,
As a result, at t = 2.56 seconds, it was found that there was no failure in Q, MSPRT of Q was reset and restarted (mark Δ) (MSPRT held during specific SPRT).

On the other hand, the star of Q is slightly delayed, and U _n ^÷ (Θ) of Θ is applied to a, and the specific SPRT of Θ is started (◇ mark, t = 2.
36 seconds). The results of the specific SPRT of Θ are shown in the third row of FIG. During the final determination of the specific ^{_{SPRT U n - (P),}} U
It is revealed that _n ⁻ (Q) and U _n ⁻ (R) are all positive and there is no failure in the rate sensor, and a failure is declared in the Θ sensor (t = 3.36 seconds, ◇ mark).

FIG. 10 shows the case where the Q sensor fails at t = 2.0 seconds. After t = 2.0, the increase in U _n ^÷ (Q) is slow, but a
It does not reach the target, and it takes b at t = 4.0 seconds. Therefore, MSPRT continued without resetting (marked with □).
At t = 5.4 seconds, U _n ^÷ (Q) reached a and the specific SPRT was started (marked with ☆). U _n ^÷ (Q) of the specific SPRT was lower than a ′, and the failure of Q was declared (t = 6.4 seconds, ◇ mark).
On the other hand U _n ^- (Θ) is also affected, ☆ mark appeared to t = 3.84 seconds. As a result of the specific SPRT, it was found that there was no failure in the Θ sensor, and the MSPRT was reset at t = 4.84 seconds (mark Δ). After this, the ☆ mark appeared again at t = 6.0 seconds because of the failure of Q. A failure occurred at t = 2.0 seconds,
Since U _n ^÷ (Q) had already become large at this point, it took a long time to find it.

FIG. 11 shows the case of Θ failure (t = 2.0 seconds, 2 °).
The failure time is late, but the failure is large, so U _n ⁺ (Θ)
Reacts quickly. In this example, the failure identification required time is 1.72 seconds, which is faster than the example of FIG.

〔The invention's effect〕

Different from the multi-system sensor, failure detection can be specified by a single sensor that has no comparison target. Also, if this method is applied to a multiplex system, the file operability can be improved without increasing the sensor hardware of the multiplex system.
It is possible to further improve the fault tolerance capability by identifying the second fault in the heavy system sensor and activating the degraded mode.

[Brief description of drawings]

FIG. 1 is an overall configuration diagram for clarifying the configuration of the present invention, FIG. 2 is a block diagram showing a concept of analytical redundancy management by inter-sensor relational expression / SPRT method, and FIG. 3 is inter-sensor relational expression / SPRT. FIG. 4 is a diagram showing a procedure for identifying a fault by the method, FIG. 4 is a graph for comparing the conventional fault identifying method and the fault identifying method of the present invention, and FIG. 5 is a flow chart showing a procedure for threshold determination in the MSPRT method. Graphs showing the relationship of the threshold values, FIGS. 6 and 7 show changes in the residual error γ and the likelihood ratio u when the rate sensor (Q sensor) and the attitude sensor (Θ sensor) of the single system sensor are faulty, respectively. The graphs, FIGS. 8 to 11 are graphs similar to FIGS. 6 and 7 showing the results of the single-system sensor failure detection simulation under various conditions. Q, P, R ... Rate sensor, Θ, Φ, Ψ ... Attitude sensor, 1 ... Failure identifying means, 2 ... First determining means, 3 ... Second determining means, 4 ... Selection means, 5 ... Control means.

Claims (2)

[Claims] 1. In a device for detecting a failure of a plurality of sensors used for a moving body such as an aircraft including a rate sensor and an attitude sensor and specifying the failed sensor, a failure identification calculation is performed for each sensor to detect the failure likelihood. A fault identifying calculation means for obtaining a ratio, a first determining means for determining whether or not the failure likelihood ratio is below a threshold value for each sensor, and a determination whether the sensor under inspection is a rate sensor or an attitude sensor. Receiving the outputs of the first determining means, the second determining means, and the selecting means, the second determining means for selecting the rate sensor associated with the attitude sensor when the sensor under inspection is the attitude sensor Control means for controlling the failure identification calculation means, wherein the control means is a rate sensor if the sensor whose failure likelihood ratio is below a threshold is a rate sensor. For the sensor whose failure likelihood ratio is below the threshold is the attitude sensor, the failure identification calculation is performed for the rate sensor associated with the attitude sensor. A fault sensor identification device characterized by: 2. A method of detecting a failure of a plurality of sensors used for a mobile object such as an aircraft including a rate sensor and an attitude sensor and specifying a failed sensor, wherein a failure identification calculation is performed for each sensor to detect a failure likelihood. For each sensor, determine whether the failure likelihood ratio is below the threshold, determine whether the sensor under test is a rate sensor or an attitude sensor, and determine whether the sensor under test is the attitude sensor. In this case, the rate sensor associated with the attitude sensor is selected, and if the sensor with a failure likelihood ratio below the threshold is a rate sensor, the failure identification calculation is performed again for that rate sensor to determine the failure likelihood ratio. If the sensor whose value is below the threshold is an attitude sensor, failure specification calculation is performed for the rate sensor associated with that attitude sensor. Constant method.