Inertial measurement unit fault detection isolation reconfiguration using parity logic

A method of implementing a fault-tolerant-avionic architecture in a vehicle includes using parity logic to monitor the functionality of at least three non-fault-tolerant inertial measurement units during a parity check and calculating a threshold from expected inertial measurement unit performance during a parity check. If a failure of an inertial measurement unit is detected based on the calculated threshold, then the method further includes identifying the failed inertial measurement units based on a direction of a parity vector in parity space. Each inertial measurement unit comprises at least one triad of sensors.

BACKGROUND

When inertial measurement units are used to track vehicles, such as aircrafts or guided missiles, a failure in the one of the inertial measurement units can cause the vehicle to veer off track. When mission success is critical, the tolerance for failure is reduced to zero. The inertial measurement units that are fault tolerant are very expensive so the cost of systems that require fault tolerant inertial measurement units can be prohibitive, especially in vehicles which are only able to be used one time, such as missiles.

SUMMARY

In a first embodiment, a method of implementing a fault-tolerant-avionic architecture in a vehicle is provided. The method includes using parity logic to monitor the functionality of at least three non-fault-tolerant inertial measurement units during a parity check, calculating a threshold from expected inertial measurement unit performance during a parity check. If a failure of an inertial measurement unit is detected based on the calculated threshold, then identifying the failed inertial measurement units based on a direction of a parity vector in parity space. Each inertial measurement unit comprises at least one triad of sensors.

In accordance with common practice, the various described features are not drawn to scale but are drawn to emphasize features relevant to the present invention. Reference characters denote like elements throughout figures and text.

DETAILED DESCRIPTION

FIGS. 1-3are block diagrams representative of embodiments of double-fault-tolerant-avionics systems in a vehicle. The double-fault-tolerant-avionics architecture of the double-fault-tolerant-avionics system in the vehicle permits use of the double-fault-tolerant-avionics system after one inertial measurement unit100-iof the four inertial measurement units100(A-D) fails. Only if a second of the four inertial measurement units fails, does the double-fault-tolerant-avionics system stop functioning. In one implementation of this embodiment, a backup inertial measurement unit is used to permit continued use of the double-fault-tolerant-avionics system.

FIG. 1is a block diagram representative of one embodiment of a double-fault-tolerant-avionics system50in a vehicle20. The double-fault-tolerant-avionics architecture of the double-fault-tolerant-avionics system50in the vehicle20permits use of the double-fault-tolerant-avionics system50after one inertial measurement unit100-iof the four inertial measurement units100(A-D) fails.

The double-fault-tolerant-avionics system50includes a vehicle master computer200, four non-fault-tolerant inertial measurement units100(A-D) and a backup non-fault-tolerant inertial measurement unit115-A. The non-fault-tolerant inertial measurement units100(A-D) are also referred to herein as “inertial measurement units100(A-D).” The non-fault-tolerant inertial measurement units100(A-D) and the backup inertial measurement unit115-A are single-string non-fault tolerant units. A single failure in a single-string inertial measurement unit results in a failure of the entire inertial measurement unit.

Each non-fault-tolerant inertial measurement unit100(A-D) includes a respective triad of accelerometers110(A-D). Each triad of accelerometers110includes three acceleration sensors. The acceleration sensors that form one triad are orthogonally aligned with respect to each other in order to measure the acceleration in each of the three orthogonal directions, such as the axes represented by the vectors X, Y and Z or the axes represented by the vectors X′, Y′ and Z′. The acceleration sensors that form the triads are attached to a mounting frame of the vehicle20so that they experience the same acceleration as the vehicle20.

The triad of accelerometers110-ican have a different orientation or the same orientation as the triad of accelerometers110-j. For example, the triad of accelerometers110-A and100-B can be aligned with the vectors X, Y and Z, the triad of accelerometers110-C can be aligned with the vectors X′, Y′ and Z′ and the triad of accelerometers110-D and110-E can be aligned with other sets of orthogonal vectors. In another implementation of this embodiment, the triad of accelerometers110(A-E) are all aligned to the same axes, such as the axes parallel to vectors X, Y and Z.

The vehicle20can be a satellite, a missile, a jet, an airplane, a helicopter and any other type of airborne vehicle. The non-fault tolerant accelerometers110can be commercial off the shelf (COTS) devices, a micro-electro-mechanical system (MEMS) accelerometer, such as a Honeywell BG1930 MEMS Inertial Measurement Unit (IMU), QA-2000 and QA-3000 pendulous mass accelerometers, SFIR and PIGA pendulous integrating gyro accelerometers, and other types of accelerometers.

In one implementation of this embodiment, the double-fault-tolerant-avionics system50includes more than four non-fault-tolerant inertial measurement units100(A-N). In another implementation of this embodiment, the double-fault-tolerant-avionics system50includes more than one backup non-fault-tolerant inertial measurement units115(A-M). In yet another implementation of this embodiment, the double-fault-tolerant-avionics system50does not include a backup non-fault-tolerant inertial measurement unit115-A.

The vehicle master computer200includes a programmable processor210, a memory215, and at least one storage medium220. The programmable processor210in the vehicle master computer200receives input from the inertial measurement units100(A-D) via connections111. Specifically, the programmable processor210receives information indicative of acceleration of the vehicle20from a triad of accelerometers110(A-D) in each of the at least inertial measurement units100(A-D).

The vehicle master computer200is communicatively coupled to the backup inertial measurement unit115-A via connection112. The connection112can be used as required to send input from the back up inertial measurement unit115-A to the programmable processor210in the event that one of the inertial measurement units100(A-D) fails. The connections111and112can be trace lines, wires, optical communication links or radio frequency links.

The programmable processor210executes the computer-executable instructions230stored in the storage medium220. The computer-executable instructions230comprises various elements of software, each including the computer code, variable storage, control logic, and software interfaces that allow the vehicle master computer200to interact with the inertial measurement units100and115. The programmable processor210executes software and/or firmware that causes the programmable processor210to perform at least some of the processing described here as being performed by the vehicle master computer200and/or the programmable processor210. At least a portion of such software and/or firmware executed by the programmable processor210and any related data structures are stored in memory215during execution. Memory215comprises any suitable memory now known or later developed such as, for example, random access memory (RAM), read only memory (ROM), and/or registers within the programmable processor210.

In one implementation, the programmable processor210comprises a microprocessor or microcontroller. Moreover, although the programmable processor210and memory215are shown as separate elements inFIG. 1, in one implementation, the programmable processor210and memory215are implemented in a single device (for example, a single integrated-circuit device). The software and/or firmware executed by the programmable processor210comprises a plurality of program instructions that are stored or otherwise embodied on the storage medium220from which at least a portion of such program instructions are read for execution by the programmable processor210. In one implementation, the programmable processor210comprises processor support chips and/or system support chips such as application-specific integrated circuits (ASICs).

Storage devices suitable for tangibly embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and DVD disks. Any of the foregoing may be supplemented by, or incorporated in, specially-designed ASICs.

The computer-executable instructions230and/or firmware executing on the programmable processor210processes the acceleration information received from the inertial measurement units100(A-D) and uses the received information to monitor the functionality of the non-fault-tolerant inertial measurement units100(A-D) using parity logic.

The programmable processor210is able to detect any failure of any one of the inertial measurement units100(A-D) based on a threshold calculated from expected inertial measurement unit performance during a parity check. The programmable processor210is able to identify the failed inertial measurement unit100-ibased on a direction of a parity vector in parity space. When a failure is detected, the programmable processor210suspends operation of the failed inertial measurement unit100-i.

In one implementation of this embodiment, when a failure is detected, the programmable processor210operates the backup inertial measurement unit115-A in the fault tolerant-avionic system50to track the vehicle20and continues to use parity logic to monitor the functionality of operational measurement units using the fully functioning inertial measurement units100(j-l) and the backup inertial measurement unit.

In another implementation of this embodiment, the programmable processor continues to use parity logic to monitor the health and functionality of the three remaining fully functioning measurement units100(without the use of the backup inertial measurement unit115-A so that three fully functioning inertial measurement units100(j-l) are used to track the vehicle20after the failure. In this case, if a second inertial measurement unit fails, the second failure is detected by the programmable processor210. Then the programmable processor210is required to operate the backup inertial measurement unit115-A in the fault tolerant-avionic system50in order to continue to use parity logic to monitor the functionality of operational measurement units so that the two fully functioning inertial measurement units100(j-k) and the backup inertial measurement unit115-A, which is also fully functioning, are used to track the vehicle20after the second failure. If there are additional backup inertial measurement units115, then the double-fault-tolerant-avionics system50can still operate with the programmable processor210monitoring the functionality of the fully functioning inertial measurement units100and the fully functioning backup inertial measurement units115.

The software and the method by which the programmable processor functions is described below with reference to methods500and600ofFIGS. 5 and 6, respectively.

FIG. 2is a block diagram representative of one embodiment of a double-fault-tolerant-avionics system51in a vehicle20. The double-fault-tolerant-avionics system51shown in vehicle20includes a vehicle master computer201, four non-fault-tolerant inertial measurement units300(A-D) and a backup non-fault-tolerant inertial measurement unit315-A. The non-fault-tolerant inertial measurement units300(A-D) are also referred to herein as “inertial measurement units300(A-D).”

Each non-fault-tolerant inertial measurement unit300(A-D) includes a respective triad of gyroscopes120(A-D), also referred to herein as “gyros120(A-D).”Each triad of gyros120includes three angular rate sensors (also referred to herein as “angular velocity sensors”). The rate sensors that form one triad are orthogonally aligned with respect to each other in order to measure the angular velocity of the vehicle20in each of the three orthogonal directions, such as the axes represented by the vectors X, Y and Z or the axes represented by the vectors X′, Y′ and Z′. The angular velocity sensors that form the triads are attached to the mounting frame of the vehicle20so that they move with the same angular velocity as the vehicle20.

The triad of gyros120-ican have a different orientation or the same orientation as the triad of gyros120-j. For example, the triad of gyros120-A and120-B can be aligned with the vectors X, Y and Z, the triad of gyros120-C can be aligned with the vectors X′, Y′ and Z′ and the triad of gyros120-D and120-E can be aligned with other sets of orthogonal vectors. In another implementation of this embodiment, the triad of gyros120(A-E) are all aligned to the same axes, such as the axes parallel to vectors X, Y and Z.

The non-fault tolerant gyroscopes120are commercial off the shelf (COTS) devices, a micro-electro-mechanical system (MEMS) gyro, laser gyros, fiber optic gyros, single and dual degree of freedom spinning wheel gyros, or other types of gyro.

In one implementation of this embodiment, the double-fault-tolerant-avionics system51includes more than four non-fault-tolerant inertial measurement units300(A-N). In another implementation of this embodiment, the double-fault-tolerant-avionics system51includes more than one backup non-fault-tolerant inertial measurement units315(A-M). In yet another implementation of this embodiment, the double-fault-tolerant-avionics system51does not include a backup non-fault-tolerant inertial measurement unit315A.

The vehicle master computer201has the same structure and function as the vehicle master computer200described above with reference toFIG. 1except that vehicle master computer201includes computer-executable instructions231rather than computer-executable instructions230. The programmable processor210in the vehicle master computer201receives input from the inertial measurement units300(A-D) via connections113. Specifically, the programmable processor210receives computer-executable instructions231of the vehicle20from the triad of gyros120(A-D) in each of the at least inertial measurement units300(A-D).

The vehicle master computer201is communicatively coupled to the backup inertial measurement unit315-A via connection114. The connection114can be used as required to send input from the back up inertial measurement unit315-A to the programmable processor210in the event that one of the inertial measurement units300(A-D) fails. The connections113and114can be trace lines, wires, optical communication links or radio frequency links.

The programmable processor210executes the computer-executable instructions231stored in the storage medium220. The computer-executable instructions231comprises various elements of software, each including the computer code, variable storage, control logic, and software interfaces that allow the vehicle master computer201to interact with the inertial measurement units300and315. The programmable processor210executes software and/or firmware that causes the programmable processor210to perform at least some of the processing described here as being performed by the vehicle master computer201and/or the programmable processor210. At least a portion of such software and/or firmware executed by the programmable processor210and any related data structures are stored in memory215during execution.

The computer-executable instructions231and/or firmware executing on the programmable processor210processes the angular rate information received from the inertial measurement units300(A-D) and uses the received information to monitor the functionality of the non-fault-tolerant inertial measurement units300(A-D) using parity logic. The programmable processor210is able to detect any failure of any one of the inertial measurement units300(A-D) based on a threshold calculated from expected inertial measurement unit performance during a parity check. The programmable processor210is able to identify the failed inertial measurement unit300-ibased on a direction of a parity vector in parity space. When a failure is detected, the programmable processor210suspends operation of the failed inertial measurement unit300-i.

In one implementation of this embodiment, when a failure is detected, the programmable processor210operates the backup inertial measurement unit115-A in the fault tolerant-avionic system51to track the vehicle20and continues to use parity logic to monitor the functionality of operational inertial measurement units300(j-l) using the fully functioning inertial measurement units300(j-l) and the backup inertial measurement unit315-A.

In another implementation of this embodiment, the programmable processor continues to use parity logic to monitor the functionality of the three remaining operational measurement units300(without the use of the backup inertial measurement unit315-A so that three fully functioning inertial measurement units300(j-l) are used to track the vehicle20after the failure. In this case, if a second inertial measurement unit fails, the second failure is detected by the programmable processor210. Then the programmable processor210is required to operate the backup inertial measurement unit315-A in the fault tolerant-avionic system51in order to continue to use parity logic to monitor the functionality of operational measurement units so that the two fully functioning inertial measurement units300(j-k) and the backup inertial measurement unit315-A are used to track the vehicle20after the second failure. If there are additional backup inertial measurement units315, then the double-fault-tolerant-avionics system51can still operate with the programmable processor210monitoring the functionality of the fully functioning inertial measurement units300and the fully functioning backup inertial measurement units315.

The software and the method by which the programmable processor functions is described below with reference to methods500and600ofFIGS. 5 and 6, respectively.

FIG. 3is a block diagram representative of one embodiment of a double-fault-tolerant-avionics system52in a vehicle20. The double-fault-tolerant-avionics system52shown in vehicle20includes a vehicle master computer202, four non-fault-tolerant inertial measurement units400(A-D) and a backup non-fault-tolerant inertial measurement unit415-A. The non-fault-tolerant inertial measurement units400(A-D) are also referred to herein as “inertial measurement units400(A-D).”

Each non-fault-tolerant inertial measurement unit400(A-D) includes a respective triad of accelerometers110(A-D) and triad of gyroscopes120(A-D). Each triad of gyros120and the triad of accelerometers110in each inertial measurement unit400can be aligned to the same or different set of orthogonal axes, such as the axes represented by the vectors X, Y and Z and/or the axes represented by the vectors X′, Y′ and Z′. The angular velocity sensors and accelerometers that form the triad of sensors are attached to the mounting frame of the vehicle20so that they move at the same angular rate and with the same acceleration as the vehicle20.

In one implementation of this embodiment, the double-fault-tolerant-avionics system52includes more than four non-fault-tolerant inertial measurement units400(A-N). In another implementation of this embodiment, the double-fault-tolerant-avionics system52includes more than one backup non-fault-tolerant inertial measurement units415(A-M). In yet another implementation of this embodiment, the double-fault-tolerant-avionics system52does not include a backup non-fault-tolerant inertial measurement unit415-A.

The vehicle master computer202has the same structure and function as the vehicle master computer200described above with reference toFIG. 1except that the computer-executable instructions230in vehicle master computer202is replaced by computer-executable instructions232. The programmable processor210in the vehicle master computer201receives input from the inertial measurement units400(A-D) via connections111and113. Specifically, the programmable processor210receives information indicative of acceleration of the vehicle20from a triad of accelerometers110(A-D) in each of the at least inertial measurement units400(A-D) and receives information indicative of angular rate of the vehicle20from the triad of gyros120(A-D) in each of the at least inertial measurement units400(A-D).

The vehicle master computer202is communicatively coupled to the backup inertial measurement unit415-A via connections112and114. The connections112and114can be used as required to send input from the back up inertial measurement unit415-A to the programmable processor210in the event that one of the inertial measurement units400(A-D) fails. If either one of the accelerometers or the gyros fails in an inertial measurement unit400-i, the inertial measurement unit400-iis considered a failure and information indicative of both the acceleration and the rate of the vehicle is received from the backup inertial measurement unit415-A.

The computer-executable instructions232and/or firmware executing on the programmable processor210processes the acceleration and rate information received from the inertial measurement units400(A-D) and uses the received information to monitor the functionality of the non-fault-tolerant inertial measurement units400(A-D) using parity logic. The programmable processor210is able to detect any failure of any one of the inertial measurement units400(A-D) based on a threshold calculated from expected inertial measurement unit performance during a parity check. The programmable processor210is able to identify the failed inertial measurement unit400-ibased on a direction of a parity vector in parity space. When a failure is detected, the programmable processor210suspends operation of the failed inertial measurement unit400-i.

In one implementation of this embodiment, when a failure is detected, the programmable processor210operates the backup inertial measurement unit115-A in the fault tolerant-avionic system52to track the vehicle20and continues to use parity logic to monitor the functionality of operational inertial measurement units400(j-l) using the fully functioning inertial measurement units400(j-l) and the backup inertial measurement unit415-A.

In another implementation of this embodiment, the programmable processor continues to use parity logic to monitor the functionality of the three remaining operational measurement units400(without the use of the backup inertial measurement unit415-A so that three fully functioning inertial measurement units400(j-l) are used to track the vehicle20after the failure. In this case, if a second inertial measurement unit fails, the second failure is detected by the programmable processor210. Then the programmable processor210is required to operate the backup inertial measurement unit415-A in the fault tolerant-avionic system52in order to continue to use parity logic to monitor the functionality of operational measurement units so that the two fully functioning inertial measurement units400(j-k) and the backup inertial measurement unit415-A are used to track the vehicle20after the second failure. If there are additional backup inertial measurement units415, then the double-fault-tolerant-avionics system52can still operate with the programmable processor210monitoring the functionality of the fully functioning inertial measurement units400and the fully functioning backup inertial measurement units415.

The software and the method by which the programmable processor functions is described below with reference to methods500and600ofFIGS. 5 and 6, respectively.

FIG. 4is a block diagram representative of one embodiment of a single-fault-tolerant-avionics system55in a vehicle20. The single-fault-tolerant-avionics system55differs from the double-fault-tolerant-avionics system52ofFIG. 3in that there are only three non-fault tolerant inertial measurement units400. Computer-executable instructions235are implemented by the programmable processor210to determine a failure of an inertial measurement unit400(A-C). If a failure is detected in one of the inertial measurement units400in single-fault-tolerant-avionics system55, then the backup inertial measurement unit415-A is automatically used by the programmable processor210to monitor the functionality of the inertial measurement units400as is understandable from the above description of the inertial measurement units400.

The details about the computer-executable instructions executed by the programmable processor210to monitor the IMU functionality in a vehicle20using a fault-tolerant-avionic architecture is now described. An algorithmic coverage (parity logic) is used to detect and isolate a failed inertial measurement unit100and to rank order the inertial measurement units100(A-D) (FIG. 1). The logic is implemented downstream of the inertial measurement units100(A-D) in the vehicle master computer200. The method uses a magnitude squared of the sensed accelerations (and/or sensed rates) of the mounting frame for the inertial measurement units100(A-D) as the measurements. The use of the magnitude squared as the measurement allows for arbitrary relative orientation of the inertial measurement unit mounting frames. The use of the magnitude squared as the measurement also removes any orthogonal rotation errors between the inertial measurement unit mounting axes as an error source in the parity computations.

A threshold is calculated from the expected inertial measurement unit performance and the measurements are compared to the threshold. If the measurements exceed the threshold, one of the inertial measurement units has failed. The direction of the vector formed from the measurements in parity space points to the failed inertial measurement unit in parity space. Then programmable processor210in the vehicle master computer200is thereby able to determine which of the inertial measurement units100(A-D) has failed.

The following assumptions are used in the calculations performed by the computer-executable instructions: data from the four inertial measurement units are fully compensated and time coherent, the sensed acceleration data has been resolved to a common point using appropriate lever arm corrections, the body of the vehicle20is assumed to be sufficiently rigid so that vehicle flexing does not cause significant differences in sensed rates at the various inertial measurement unit locations. If the latter assumption is not valid then the rate differences will be accounted for in the rate parity fault detection thresholds. The algorithmic coverage of faults described herein is extendable to detect and isolate a second fault in three inertial measurement units100(A-C) that were operational after a failure of a first inertial measurement unit110-D. Parity logic is suspended after a second inertial measurement unit failure.

In one implementation of this embodiment, a backup inertial measurement unit115-A is implemented after the failure of a first inertial measurement unit110-D. In another implementation of this embodiment, a backup inertial measurement unit115-A is implemented after a second failure of a second inertial measurement unit so that parity logic is not suspended after a second inertial measurement unit failure.

FIG. 5is a flow diagram of one embodiment of a method500to use parity logic to monitor the functionality of at least three non-fault-tolerant inertial measurement units, each inertial measurement unit comprising at least one triad of sensors in accordance with the present invention. Method500is described with reference to the double-fault-tolerant-avionics systems50-55ofFIGS. 1-4. Computer-executable instructions230, such as software, firmware or other program code for performing the methods described herein are executed by the programmable processor210of the vehicle master computer200.

At step502, the programmable processor receives information indicative of measurements, such as acceleration and/or angular rate of the vehicle20, via connections111and/or113. If the double-fault-tolerant-avionics system is the double-fault-tolerant-avionics system50ofFIG. 1, the programmable processor210receives information indicative of acceleration of the vehicle20. If the double-fault-tolerant-avionics system is the double-fault-tolerant-avionics system51ofFIG. 2, the programmable processor210receives information indicative of angular rate of the vehicle20. If the double-fault-tolerant-avionics system is the double-fault-tolerant-avionics system52ofFIG. 3, the fully compensated sensed mounting frame incremental velocity are read from the triad of gyroscopes120(A-D) and the fully compensated sensed mounting frame accelerations are read from the triad of accelerometers110(A-D) in the respective inertial measurement units400(A-D).

At step504, it is determined if the information indicative of measurements is filtered. Filtering is used to reduce the noise level of the data. If a low pass filter is used with a long time constant the filter is heavy filtering and the noise is greatly reduced. Heavily filtered data is used to determine “soft failures” in which the performance of the inertial measurement unit gradually deteriorates. If no filter is used, then the programmable processor210is able to detect a “hard failure” or a “catastrophic failure,” in which the performance of the inertial measurement unit suddenly deteriorates significantly. In one implementation of this embodiment, of a catastrophic failure, the inertial measurement unit stops functioning. In one implementation of this embodiment, the filtering is a first order finite impulse response (FIR) filter algorithm implemented by the programmable processor210to filter the information indicative of measurements received.

The filtering algorithms are shown below as equations (1A) and (1B):
p1i:=(1 0 0)·pi,
p2i:=(0 1 0)·pi, and
p3i:=(0 0 1)·pi,(1A)
which are inserted into the following equations (1B):

If the information is not filtered, the flow proceeds to step506. At step506, measurement vectors are formed based on a square of the magnitude of the unfiltered information indicative of measurements received from at least three inertial measurement units. The equations shown herein, other than equation 39, are shown for the acceleration measurements but they are extendable to include angular velocity as is understandable based on a reading of this specification and a skill in the art.

If information indicative of acceleration is received at the programmable processor210, the programmable processor210squares and sums the sensed acceleration from each accelerometer in each direction (such as X, Y, and Z). In this manner, an acceleration measurement my is formed for each inertial measurement unit as shown in equation (1C).
fA2=(fAX2+fAY2+fAZ2)m1=fA2
fB2=(fBX2+fBY2+fBZ2)m2=fB2
fC2=(fCX2+fCY2+fCZ2)m3=fC2
fD2=(fDX2+fDY2+fDZ2)m4=fD2Equation (1C)

The measurement vector is the measurement from each of the accelerometers. The measurement vector is a (4×1) vector comprising m1, m2, m3, and m4when there are four inertial measurement units each with a triad of accelerometers. The measurement vector is a (3×1) vector comprising m1, m2, and m3when there are three inertial measurement units each with a triad of accelerometers.

If information indicative of angular velocity is received at the programmable processor210, the programmable processor210squares and sums the sensed velocity for each direction (such as X, Y, and Z) to form a velocity measurement m1. The measurement vector is a (4×1) vector when there are four inertial measurement units with a triad of gyros. The measurement vector is a (3×1) vector when there are three inertial measurement units each with a triad of gyros.

Likewise, if information indicative of both acceleration and angular velocity is received at the programmable processor210, the programmable processor210squares and sums the sensed acceleration and squares and sums sensed angular velocity for each direction (such as X, Y, and Z) to form a measurement. There are two 4×1 measurements vectors when there are four IMUs in use. There are two 3×1 measurement vectors when there are three IMUs in use.

If the information is filtered, the flow proceeds to step508from step504. At step508, measurement vectors are formed based on a square of the magnitude of the filtered information indicative of measurements received from the at least three inertial measurement units. The description above made with reference to step506is applicable to this step508, except the measurements in equation (1C) are the filtered measurements.

At step510, the measurement vectors are transposed from the measurement space to a parity space. Equations (2)-(9) show the method used to transpose the measurement vectors into parity space. This step and the following steps are implemented on the vectors generated from the unfiltered data if the flow has proceeded from step506. Likewise, this step and the following steps are implemented on the vectors generated from the filtered data if the flow has proceeded from step508.

H* is the least square estimate matrix pseudo inverse.

The “I(4)” term represents a 4×4 identity matrix.

The parity coefficient matrix elements are derived from matrix W in equation (12). The measurement vectors in the measurement space are transposed into parity vectors in a parity using vector W of equation (12) to generate the vector V as shown in equations (13)-(17). Given that i includes values from 1 to 3 (for the three parity space directions) and j includes values from 1 to 4 (for the four measurement space directions) and Vi,j:=0 then V is a 3×4 matrix:

Letting V1,1:=√{square root over (W1,1)} and V2,2:=√{square root over (W2,2−(V1,2)2)} and for j having values from 2 to

Given that j includes values from 3 to 4,

V2,j:=W2,j-V1,2·V1,jV2,2
and then

Now V3,3:=√{square root over (W3,3−(V1,3)2−(V2,3)2)}{square root over (W3,3−(V1,3)2−(V2,3)2)} so

For j equal to 4 then

V3,j:=W3,j-(V1,3·V1,j)-(V2,3·V2,j)V3,3
so the completed parity vector coefficient matrix becomes:

V=(0.86602540-0.28867513-0.28867513-0.288675130.000000000.81649658-0.40824829-0.408248290.000000000.000000000.707106780.70710678).(17)
When the parity coefficient defining constraints are met the dot product of V and V transpose (VT) are equal to the identity matrix and the dot product of V and H is a zero matrix as shown in equations (18) and (19). The parity coefficient matrix development shown here is identical for measurements from accelerometers and from gyros.

The parity vector is the dot product of V (equation (17)) and m (equation (1C)) written as:
p=V·m.(20)

At step512, the magnitude squared of the parity vectors is dynamically calculated as the vehicle20moves and the inertial measurement units are continuously monitored. During the parity check, the magnitude squared of the parity vector is compared to the threshold. Thus as the inertial measurement units are sending data to the programmable processor, the programmable processor performs the calculations to determine the magnitude squared of the parity vectors and the threshold for the magnitude squared of the measurement and then compares them to each other in order to determine if one of the inertial measurement units has failed or is degrading.

The algorithm that is executed by the programmable processor in order to dynamically calculate the magnitude squared of the parity vectors is shown herein for the accelerometers. The gyros have a similar development which is not shown but which is understandable based on a reading of this specification by one of skill in the art.

Sensed acceleration in mounting frame for the ithinertial measurement unit (after sculling, size effect and lever arm correction to a common point) is:
fM—measuredi=δBi+(I+δSFi+δHi)·fM—truei+ηi(21)
where ηi includes velocity readout noise and velocity random walk noise. The measured sensed acceleration in the mounting frame from the ithinertial measurement unit is true sensed acceleration plus error:
fM—measuredi=fMi+δfMi(22)

The measurement vector to be formed using the four scalar measured sensed accelerations from inertial measurement units100(A-D) is

By expanding equation (24) and neglecting terms of order δ2and noting that fMiT·δfMi=δfMiT·fMione obtains:

The parity vector is formed assuming no systematic errors (e.g., bias errors, scaling factors errors, and non-orthothogality) and assuming the elements of the parity vector have zero mean randomly distributed white noise.

Recalling equation (20), p=V·m, and substituting equation (25) into equation (20), the parity vector is

Equation (26) is expanded as:

Note that the first term on the right is zero (parity coefficient matrix times truth sensed acceleration squared). This leaves the error:

For compactness of notation, equation (28) is rewritten as equation (29), with the understanding that the quantities in the last term on the right are expressed in mounting frame coordinates. There are four individual triads (for example,110(A-D)) and working with scalar measurements (sensed measurements squared) from each inertial measurement unit100(A-D), the mounting frame is taken to be the mounting frame associated with each individual inertial measurement unit.

Note that the (2,1), (3,1) and (3,2) components of the V matrix (equation 17) are zero and expand equation 29 into components to obtain:
p1=V1,1·(fAT·δfA)+V1,2·(fBT·δfB)+V1,3·(fCT·δfC)+V1,4·(fDT·δfD)
p2=V2,2·(fBT·δfB)+V2,3·(fCT·δfC)+V2,4·(fDT·δfD)
p3=V3,3·(fCT·δfC)+V3,4·(fDT·δfD)  (30)

The fault detection function is the inner product of the parity vector:
DF=(p1)2+(p2)2+(p3)2(31)
Equation 31 is the magnitude squared of the parity vector and this value is to be compared with the threshold for the magnitude squared of the measurement.

At step514, the threshold for the magnitude squared of the measurement is dynamically calculated, in order to determine if an inertial measurement unit has failed or is degrading. The algorithm that is executed by the programmable processor in order to dynamically calculate the threshold is shown herein for the accelerometers. The gyros have a similar development which is not shown but which is understandable based on a reading of this specification by one of skill in the art.

The threshold is computed assuming the p vector elements are uncorrelated and using the expected value of the fault detection function as shown in equation (32):
E(DF)=E└(p1)2┘+E└(p2)2┘+E└(p3)2┘  (32)

Substituting equation (30) into equation (32), expanding, and assuming that the errors in inertial measurement unit100(A-D) are uncorrelated results in:

Expand one of the expected value terms on the right hand side of equation 33 in order to see the form of the expression. The subscripts 1, 2, and 3 refer to mounting frame axes, such as X, Y, and Z, for the inertial measurement unit, which is inertial measurement unit100-A in equation (34):
E└(fAT·δfA)2┘=E[(fA1·δfA1+fA2·δfA2+fA3·δfA3)2]  (34)

Expanding equation (34), taking the expected value, and assuming that the orthogonal mounting frame errors are uncorrelated with one another gives,
E└(fAT·δfA)2┘=fA12·E[(δfA1)2]+fA22·E[(δfA2)2]+fA32·E[(δfA3)2]

Substitution of equations (35) into equation (33) results in the form for the expected value of the detection function. This is the basis for the computation of the fault detection threshold:

The next step is to develop equation (36) considering bias, scale factor (SF), non-orthogonality (nonoth), readout noise (ro) and random walk errors (rw). The composite expected value of the detection function is shown in the next paragraph.

After including such errors, the composite expected value of the detection function becomes:
E(DF)=E(DF—bias)+E(DF—SF)+E(DF—nonorth)+E(DF—ro)+E(DF—nw)  (37)

Equation 37 is expanded to form equation 38 when the actual values for the errors are written out for the sensed accelerations. Equation 38 is the expected value from the sensed acceleration and includes the velocity read out noise and the velocity random walk which are represented as

Equation 37 is expanded to form equation 39 when the actual values for the errors are written out for the sensed rate. Equation 38 is the expected value for the sensed angular velocity and includes the angle readout noise and angle random walk which are represented as

Equations (38) and (39) are the dynamically calculated thresholds for the acceleration and angular velocity, respectively. At step518, if the magnitude of the parity vector is greater than the threshold, the programmable processor210determines that one of the inertial measurement units failed. The magnitude of the parity vector (equation (31)) is compared to the acceleration threshold (equation 38) if the acceleration was measured by the inertial measurement units. The magnitude of the parity vector (equation (31)) is compared to the angular velocity threshold (equation (39)) if the angular velocity was measured by the inertial measurement units.

If it was determined that an inertial measurement unit failed at step518, then the programmable processor210determines a direction of the parity vector to determine which inertial measurement unit has failed.

The parity vector directions are written as:

The equation development shown above applies to unfiltered and filtered parity vector data. In the case of filtered parity data, the corresponding threshold is filtered in the same manner as the parity vector so that they remain coherent in time. The performance of each of the inertial measurement units (e.g.,100(1-4)) is rank ordered based on the equations (40). The smallest theta angle (θi) indicates the direction along which the parity vector lies. This direction identifies the worst performing inertial measurement unit. Conversely, the largest angle indicates the direction of the best performing inertial measurement unit.

FIG. 6is a flow diagram of one embodiment of a method600to use parity logic to monitor the functionality of at least three non-fault-tolerant inertial measurement units, each inertial measurement unit comprising at least one triad of sensors in accordance with the present invention. The method600describes how the programmable processor210operates when an inertial measurement unit fails.

The programmable processor210uses parity logic to monitor the functionality of at least three non-fault-tolerant inertial measurement units at step602. At step604, the programmable processor determines if a failure of an inertial measurement unit is detected during a parity check that is implemented as described above for method500. If no inertial measurement unit has failed the flow proceeds back to602and the programmable processor continues to monitor the functionality of the inertial measurement units.

In one implementation of this embodiment, the programmable processor210uses parity logic to monitor the functionality of at least three non-fault-tolerant inertial measurement units only during critical-maneuver stages of the vehicle operation. For example, if the vehicle is a satellite, the inertial measurement units are all operating and monitored during ascent to orbit and re-entry since ascent to orbit and re-entry are critical-maneuver stages of the satellite operation and fault tolerance is essential. During the on-orbit coast of the exemplary satellite, the inertial measurement units may or may not be ON all the time, since the on-orbit coast of the satellite is a non-critical-maneuver stage. In one embodiment of this case, even when the inertial measurement units are ON they are not necessarily monitored the whole time they are ON. In another implementation of this embodiment, during the on-orbit coast or other non-critical-maneuver stages of a vehicle, only one of the inertial measurement units is ON some of the time after an assessment of the functionality of the inertial measurement units is completed. If only one of the inertial measurement units is ON, the parity check for the functionality of the inertial measurement units cannot be implemented since three or more inertial measurement units are required to monitor the functionality of the inertial measurement units using the parity check as described herein.

If one of the inertial measurement units has failed, the flow proceeds to step606. At step606, the programmable processor210identifies which of the three or four inertial measurement units have failed based on a direction of the parity vector in parity space as described above with reference to steps518and520of method500ofFIG. 5. The programmable processor210suspends operation of the failed inertial measurement unit at step608. At step610, the programmable processor210determines if this failure is a first failure of the fault-tolerant-avionics system. At step612, the programmable processor210determines if the fault-tolerant-avionics system is a double-fault-tolerant-avionics system or a single-fault-tolerant-avionics system.

If the failure is a first failure and the system is a double-fault-tolerant-avionics system, the programmable processor determines if a backup inertial measurement unit is to be used after a single failure at step614. In one implementation of this embodiment, there is no backup inertial measurement unit to be used. In another implementation of this embodiment, the backup inertial measurement unit is only used if the vehicle is in a critical mode of operation.

If a backup inertial measurement unit is to be used after a single failure, the flow proceeds to step616, and the programmable processor210operates the backup inertial measurement unit to track the vehicle20. Then the flow proceeds to step618and the programmable processor210continues to use parity logic to monitor the functionality of the three remaining operational inertial measurement units.

If a backup inertial measurement unit is not to be used after a single failure, the flow proceeds to step618, and the programmable processor210continues to use parity logic to monitor the functionality of the three remaining operational inertial measurement units. In one implementation of this embodiment, the programmable processor210continues to use parity logic to monitor the functionality of at least three non-fault-tolerant inertial measurement units based on an input from the vehicle master computer200that the vehicle20is in a critical-maneuver stage.

If the failure is a first failure and the system is a single-fault-tolerant-avionics system, the flow proceeds to step616, and the programmable processor210operates the backup inertial measurement unit to track the vehicle20. Then the flow proceeds to step618and the programmable processor210continues to use parity logic to monitor the functionality of the three remaining operational inertial measurement units.

If the failure is a second failure, the flow proceeds to step616, and the programmable processor210operates the backup inertial measurement unit to track the vehicle20. Then the flow proceeds to step618and the programmable processor210continues to use parity logic to monitor the functionality of the three remaining operational inertial measurement units.

From step618, the flow proceeds back to step604and the programmable processor210proceeds through steps606to618if a failure is detected a second time.

The methods and techniques described here may be implemented in digital electronic circuitry, or with a programmable processor (for example, a special-purpose processor or a general-purpose processor such as a computer) firmware, software, or in combinations of them. Apparatus embodying these techniques may include appropriate input and output devices, a programmable processor, and a storage medium tangibly embodying program instructions for execution by the programmable processor. A process embodying these techniques may be performed by a programmable processor executing a program of instructions to perform desired functions by operating on input data and generating appropriate output. The techniques may advantageously be implemented in one or more programs that are executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and to transmit data and instructions to, a data storage system, at least one input device, and at least one output device. Generally, a processor receives instructions and data from a read-only memory and/or a random access memory.