Patent Application
20240359819
Software-based solutions must follow a rigorous development and verification process in order to be certified for safety-critical applications, e.g., aircraft-based navigation and positioning systems where the risk of presenting hazardously misleading information (HMI) is present. For example, certified analog gyroscopic sensors (e.g., angular rate sensors) may be replaceable by commercial off the shelf (COTS) digital sensors, which provide high performance and accuracy at a comparatively low cost. However, these next-generation digital sensors require software components to enable their performance and accuracy within sufficient integrity bounds for safety-critical certification, and the process of providing the requisite design assurance artifacts for certification is both difficult and expensive.
In a first aspect, an aircraft-based attitude and heading reference system (AHRS) is disclosed. In embodiments, the AHRS includes a primary digital gyroscopic sensor triad for determining a primary angular velocity vector of the aircraft. The AHRS further includes at least two certified backup analog gyroscopic sensor triads, each capable of determining a backup angular velocity vector. The AHRS receives aiding parameters from aircraft-based sensors and, based on the aiding parameters, determines a primary attitude solution (e.g., based on the primary angular velocity vector) and at least one secondary or backup attitude solution (e.g., based on the two or more backup angular velocity vectors). The AHRS includes an output voter for comparing the primary and backup attitude solutions, and when the primary attitude solution sufficiently deviates from the backup attitude solution/s (provided no other faults are detected with respect to the primary and backup gyroscopic sensor triads) a solution fault is declared with respect to the primary gyroscopic sensor triad.
In some embodiments, the AHRS declares a backup miscompare fault if the two or more backup angular velocity vectors deviate from each other.
In some embodiments, the AHRS declares a primary miscompare fault if the primary angular velocity vector sufficiently deviates from the backup angular velocity vectors.
In some embodiments, the backup attitude solution is based on an average of two or more backup angular velocity vectors.
In some embodiments, a first backup attitude solution is based on a first backup angular velocity vector, and a second backup attitude solution is based on a second backup angular velocity vector, and the solution fault is declared if the primary attitude solution deviates from one or both backup attitude solutions.
In some embodiments, the AHRS declares an output fault of the primary digital gyroscopic sensor triad if its data output (e.g., the primary angular velocity vector) is stale, corrupted, or missing.
In some embodiments, the AHRS declares an output fault of a backup gyroscopic sensor triad if its data output (e.g., the associated backup angular velocity vector) is stale, corrupted, or missing.
In some embodiments, the aiding parameters include a true airspeed of the aircraft, an altitude of the aircraft, or a linear acceleration of the aircraft.
In a further aspect, an aircraft-based method for monitoring and verifying angular rate sensors is disclosed. In embodiments, the method includes determining a primary angular velocity vector of an aircraft via an aircraft-based primary digital gyroscopic sensor triad. The method includes determining two or more backup angular velocity vectors of the aircraft via backup analog gyroscopic sensor triads (e.g., two or more triads or sets). The method includes receiving aiding parameters from aircraft-based air data/acceleration sensors. The method includes determining a primary attitude solution based on the aiding parameters and the primary angular velocity vector. The method includes determining at least one backup attitude solution based on the aiding parameters and the backup angular velocity vectors. The method includes declaring a solution fault of the primary digital gyroscopic sensor triad if the primary attitude solution sufficiently deviates from at least one backup attitude solution.
In some embodiments, the backup attitude solutions include a first attitude solution based on the first backup angular velocity vector and a second attitude solution based on the second backup angular velocity vector.
In some embodiments, a single backup attitude solution is based on an average of the first and second backup angular velocity vectors.
In a still further aspect, an aircraft-based method for monitoring and verifying angular rate sensor sets is disclosed. In embodiments, the method includes determining a primary angular velocity vector of an aircraft via an aircraft-based primary digital gyroscopic sensor triad. The method includes determining two or more backup angular velocity vectors of the aircraft via backup analog gyroscopic sensor triads. The method includes declaring either 1) a primary miscompare fault of the primary digital gyroscopic sensor triad, if the primary angular velocity vector sufficiently deviates from one or more of the backup angular velocity vectors; or 2) a backup miscompare fault of the one or more backup gyroscopic sensor triads, if the backup angular velocity vectors sufficiently deviate from each other.
This Summary is provided solely as an introduction to subject matter that is fully described in the Detailed Description and Drawings. The Summary should not be considered to describe essential features nor be used to determine the scope of the Claims. Moreover, it is to be understood that both the foregoing Summary and the following Detailed Description are example and explanatory only and are not necessarily restrictive of the subject matter claimed.
The detailed description is described with reference to the accompanying figures. The use of the same reference numbers in different instances in the description and the figures may indicate similar or identical items. Various embodiments or examples (“examples”) of the present disclosure are disclosed in the following detailed description and the accompanying drawings. The drawings are not necessarily to scale. In general, operations of disclosed processes may be performed in an arbitrary order, unless otherwise provided in the claims. In the drawings:
Before explaining one or more embodiments of the disclosure in detail, it is to be understood that the embodiments are not limited in their application to the details of construction and the arrangement of the components or steps or methodologies set forth in the following description or illustrated in the drawings. In the following detailed description of embodiments, numerous specific details may be set forth in order to provide a more thorough understanding of the disclosure. However, it will be apparent to one of ordinary skill in the art having the benefit of the instant disclosure that the embodiments disclosed herein may be practiced without some of these specific details. In other instances, well-known features may not be described in detail to avoid unnecessarily complicating the instant disclosure.
As used herein a letter following a reference numeral is intended to reference an embodiment of the feature or element that may be similar, but not necessarily identical, to a previously described element or feature bearing the same reference numeral (e.g., 1, 1a, 1b). Such shorthand notations are used for purposes of convenience only and should not be construed to limit the disclosure in any way unless expressly stated to the contrary.
Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by any one of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).
In addition, use of “a” or “an” may be employed to describe elements and components of embodiments disclosed herein. This is done merely for convenience and “a” and “an” are intended to include “one” or “at least one,” and the singular also includes the plural unless it is obvious that it is meant otherwise.
Finally, as used herein any reference to “one embodiment” or “some embodiments” means that a particular element, feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment disclosed herein. The appearances of the phrase “in some embodiments” in various places in the specification are not necessarily all referring to the same embodiment, and embodiments may include one or more of the features expressly described or inherently present herein, or any combination or sub-combination of two or more such features, along with any other features which may not necessarily be expressly described or inherently present in the instant disclosure.
Broadly speaking, embodiments of the inventive concepts disclosed herein are directed to systems and methods for providing rigorous but cost-effective monitoring and fault detection with respect to high performance primary digital angular rate sensor sets (e.g., sensor triads, triaxial sensors) via similarly cost-effective backup analog angular rate sensor triads or sets as backup units, allowing the use of commercial off the shelf (COTS) digital angular rate sensor sets in safety-critical applications. For example, aircraft-based AHRS may incorporate non-certified but high-performance COTS three-axis digital gyroscopic sensor triads to provide attitude solutions (e.g., aircraft orientation relative to its x/y/z or pitch/roll/yaw rotational axes) at safety-critical levels of accuracy without resorting to the cumbersome and expensive process of generating the design assurance artifacts necessary for formal certification.
Further, monitoring and fault detection according to the inventive concepts disclosed herein is designed to detect both “fast” and “slow” failure modes with respect to the gyroscopic sensor sets and their underlying software. For example, rate voting with respect to direct outputs of the primary (digital) and backup (analog) sensor triads may detect sudden larger-scale bias errors, while output voting with respect to attitude solutions incorporating the primary and analog sensor triads may detect less perceptible drifting in the primary sensor triads before the drift becomes significant enough to provide a risk of returning hazardously misleading information (HMI).
Embodiments of the inventive concepts disclosed herein may be applicable to aircraft-based attitude and heading reference systems (AHRS) where attitude (e.g., orientation) and/or position/navigation/time (PNT) solutions of safety-critical integrity are required. In some embodiments, monitoring and fault detection of digital angular rate sensor triads or sets may be applicable to head tracking systems, e.g., wherein rapid high-integrity determination of a position and orientation (“pose”) of a pilot's head relative to an aircraft cockpit, and of the aircraft relative to a navigation or earth-centered reference frame, may be required.
Referring now to
In embodiments, the AHRS 100 may provide safety-critical attitude solutions based on parameters received from other aircraft-based sensors 110 and angular rate measurements ω determined by the primary and backup gyroscopic sensor sets 102, 104, 106. For example, the primary gyroscopic sensor set 102 may be a non-certified digital three-axis angular rate sensor or sensor triad, e.g., implemented as a silicon micromechanical system (MEMS), and configured to determine a primary angular velocity vector (e.g., angular rate triad, angular velocity measurement set), e.g., a set of three orthogonal angular rate measurements ω1, relative to three rotational axes (e.g., x/y/z, pitch/roll/yaw). Further, the backup gyroscopic sensor sets 104, 106 may be analog three-axis angular rate sensors or sensor triads configured to respectively determine a backup aircraft angular velocity vector ω2, ω3, also relative to the three rotational axes. In embodiments, the backup gyroscopic sensor sets 104, 106 may not be as accurate or precise as the primary gyroscopic sensor set 102; however, the backup gyroscopic sensor sets may be similarly cost-effective, reliable, and capable of providing sufficiently accurate angular rate measurements to serve as a reference for monitoring of the primary gyroscopic sensor sets.
In embodiments, the AHRS 100 may be communicatively coupled to, and may receive aiding parameters from, additional aircraft-based aiding sensors 110. For example, aiding sensors 110, and/or aiding parameters received therefrom, may include aircraft heading sensors 112, true airspeed (TAS) sensors 114, barometric altimeter 116, and/or accelerometer 118 (e.g., linear acceleration).
In embodiments, the AHRS 100 may identify or detect angular rate faults (e.g., primary rate faults) associated with the primary gyroscopic sensor set 102 based on comparisons and votes with respect to the and the angular rate measurements ω2, ω3 received from the backup gyroscopic sensor sets 104, 106. For example, the AHRS 100 may include a rate voter 120 (e.g., executing on the processors 108 of the AHRS). In embodiments, the rate voter 120 may detect “fast” failure modes of the primary gyroscopic sensor set 102 via direct comparison of the raw angular rate measurements ω1 received therefrom and the raw angular rate measurements ω2, ω3 received from the backup gyroscopic sensor sets 104, 106. For example, when the angular rate measurements ω2, ω3 received from the backup gyroscopic sensor sets 104, 106 are substantially in agreement (e.g., within a threshold level) but the angular rate measurements ω1 deviate from measurements ω2, ω3 beyond a threshold level, the AHRS 100 may indicate and/or report a primary miscompare 122 indicative of a likely angular rate fault of the primary gyroscopic sensor set 102. If, however, the raw angular rate measurements ω2, ω3 sufficiently disagree (e.g., beyond a threshold level), the AHRS 100 may indicate/report a backup miscompare 124, e.g., whereby at least one of the backup gyroscopic sensor sets 104, 106 is in a likely failure state.
In embodiments, the AHRS 100 may include an output voter 126. For example, the output voter 126 may identify and detect (e.g., when “fast” faults are not detected by the rate voter 120) slower, longer-term drift errors with respect to the primary gyroscopic sensor set 102 by comparing primary and backup attitude solutions 128, 130 (e.g., limited aided solutions (LAS)). In embodiments, each attitude solution 128, 130 may comprise a high integrity estimate of flight critical aircraft states, e.g., based on an AHRS function (e.g., which estimates aircraft attitude and heading) and a vertical channel (e.g., which estimates baroinertial altitude and vertical speed), taking as input the aiding parameters provided by the aiding sensors 110 and angular rate measurements w. For example, the output voter 126 may compare a primary attitude solution 128 and a backup attitude solution 130, where the primary attitude solution 128 is based on the aiding parameters and the angular rate measurements ω1 received from the primary gyroscopic sensor set 102 and the backup attitude solution 130 is based on the aiding parameters and a moving average ωavg of the angular rate measurements ω2, ω3 received from the backup gyroscopic sensor sets 104, 106 (provided a backup miscompare 124 is not detected). Further, the primary and backup attitude solutions 128, 130 may substantially differ only in their respective incorporation of angular rate measurements ω1 and ωavg.
In embodiments, the output voter 126 may compare each individual component (e.g., pitch angle, roll angle, altitude, climb rate) of the primary and backup attitude solutions 128, 130 with respect to individualized thresholds and persistence to quantify any deviation of the primary attitude solution from the backup attitude solution. For example, if (as noted above) the backup gyroscopic sensor sets 104, 106 sufficiently agree that a backup miscompare 124 is not detected, and the primary attitude solution 128 deviates from the backup attitude solution 130 to at least a threshold level, the output voter 126 may declare and/or report a solution fault 132 (e.g., output miscompare) indicative of an angular rate fault of the primary gyroscopic sensor set 102. In embodiments, the output voter 126 may set any relevant comparison thresholds so as to prevent false alarms, e.g., associated with inherent but non-faulty levels of drift with respect to the primary gyroscopic sensor set 102.
In embodiments, the AHRS 100 may declare and/or report output error faults 134 associated with the primary or backup gyroscopic sensor sets 102, 104, 106. For example, if one or more of the angular rate measurements ω1, ω2, ω3 respectively received from the primary gyroscopic sensor set 102 and the backup gyroscopic sensor sets 104, 106 is associated with stale data, corrupt data, or missing data, an output error fault may be declared with respect to the associated gyroscopic sensor set.
In embodiments, the AHRS 100 may return the primary attitude solution 128 if no solution fault or other associated fault is detected as noted above. If, for example, a fault or failure mode 136 is detected, the AHRS 100 may declare or report the source of the fault, e.g., a primary miscompare 122 or backup miscompare 124 indicated by the rate voter 120; a solution fault 132 (e.g., output miscompare) indicated by the output voter 126; or an output error fault 134 associated with one or more specific gyroscopic sensor sets.
Referring now to
In embodiments, the AHRS 100a may generate, in addition to the primary attitude solution 128, backup attitude solutions 202, 204. For example, the backup attitude solution 202 may be based on the aiding parameters received from the aircraft-based aiding sensors 110 and the angular rate measurements ω2 received from the backup gyroscopic sensor set 104. Similarly, the backup attitude solution 204 may be based on the aiding parameters received from the aircraft-based aiding sensors 110 and the angular rate measurements ω3 received from the backup gyroscopic sensor set 106.
In embodiments, the output voter 126a may compare the individual components of the primary attitude solution 128 and the backup attitude solution 202, the output voter 126b may compare individual components of the primary attitude solution 128 and the backup attitude solution 204, and the output voter 126c may compare individual components of the two backup attitude solutions 202 and 204. If, for example, the backup attitude solutions 202, 204 sufficiently deviate from each other, the output voter 126c may declare a backup miscompare 206. In embodiments, if the output voter 126c indicates the backup attitude solutions 202, 204 as substantially in agreement, but the output voters 126a, 126b indicate that the primary attitude solution 128 sufficiently deviates from either or both of the backup attitude solutions, an output miscompare 132 may be declared and/or reported. For example, either the backup miscompare 206 or the output miscompare 132 may be indicative of a solution fault in the primary gyroscopic sensor set 102.
In embodiments, similarly to the AHRS 100 of
Referring now to
At a step 302, an aircraft-based primary gyroscopic sensor set (e.g., digital three-axis angular rate sensor, sensor triad) determines primary angular velocity measurements associated with a rotational motion of the aircraft.
At a step 304, at least two backup gyroscopic sensor sets (e.g., analog three-axis angular rate sensors, sensor triad) independently determine backup angular velocity measurements associated with the rotational motion.
At a step 306, the AHRS receives aiding parameters from aircraft-based aiding sensors. For example, the aiding parameters may include a true airspeed (TAS), barometric altitude, and/or linear acceleration readings.
At a step 308, the AHRS determines a primary attitude solution based on the sensed aiding parameters and the primary angular velocity measurements received from the primary gyroscopic sensor set.
At a step 310, the AHRS determines at least one backup attitude solution based on the sensed aiding parameters and the backup angular velocity measurements. For example, a first backup attitude solution may incorporate backup angular velocity measurements from a first backup gyroscopic sensor set, and a second backup attitude solution may incorporate backup angular velocity measurements from a second, different backup gyroscopic sensor set. In some embodiments, a backup attitude solution may be based on an average of the first and second backup angular velocity measurements.
At a step 312, an output voter of the AHRS detects a solution fault of the primary gyroscopic sensor set based on a comparison of the primary attitude solution and the backup attitude solutions. For example, the AHRS may compare individual components (e.g., pitch angle, roll angle, altitude, climb rate) of the primary attitude solution with like components of a backup attitude solution based on an average of backup angular velocity measurements. If the individual components of the primary and backup attitude solutions sufficiently deviate (e.g., relative to individually defined thresholds), the solution fault is detected. In some embodiments, multiple output voters compare the components of the primary attitude solution to those of each backup attitude solution, and the components of each backup attitude solution. If, for example, the components of each backup attitude solution sufficiently agree but the components of the primary attitude solution deviate sufficiently from those of one or more backup attitude solutions, the solution fault is detected.
Referring now to
At a step 402, an aircraft-based primary gyroscopic sensor set (e.g., digital three-axis angular rate sensor, sensor triad) determines primary angular velocity measurements associated with a rotational motion of the aircraft.
At a step 404, at least two backup gyroscopic sensor sets (e.g., analog three-axis angular rate sensors, sensor triad) independently determine backup angular velocity measurements associated with the rotational motion.
At a step 406, a rate voter of the AHRS compares the primary angular velocity measurements received from the primary digital gyroscopic sensor set to the backup angular velocity measurements to determine if miscompare faults are present. For example, the rate voter declares a primary miscompare if the primary angular velocity measurement sufficiently deviates from either backup angular velocity measurement. Alternatively, or additionally, the rate voter declares a backup miscompare if the backup angular velocity measurements do not sufficiently agree.
Embodiments of the inventive concepts disclosed herein may reduce overall system costs while preserving safety critical performance by allowing lower-cost, high-performance commercial off the shelf (COTS) digital and/or software-based sensors to be used and monitored by lower-performing but certified analog components.
It is to be understood that embodiments of the methods disclosed herein may include one or more of the steps described herein. Further, such steps may be carried out in any desired order and two or more of the steps may be carried out simultaneously with one another. Two or more of the steps disclosed herein may be combined in a single step, and in some embodiments, one or more of the steps may be carried out as two or more sub-steps. Further, other steps or sub-steps may be carried in addition to, or as substitutes to one or more of the steps disclosed herein.
Although inventive concepts have been described with reference to the embodiments illustrated in the attached drawing figures, equivalents may be employed and substitutions made herein without departing from the scope of the claims. Components illustrated and described herein are merely examples of a system/device and components that may be used to implement embodiments of the inventive concepts and may be replaced with other devices and components without departing from the scope of the claims. Furthermore, any dimensions, degrees, and/or numerical ranges provided herein are to be understood as non-limiting examples unless otherwise specified in the claims.
This technology was developed with United States government support under contract number W911QY1800246 awarded by the United States Army. The United States government has certain rights in this invention.
