JPH04161822A - Method and apparatus for detecting and specifying fault of body motion sensor - Google Patents

Abstract

PURPOSE:To make it possible to specify the faulty sensor of sensors in one series when fault specifying computation is performed after the occurrence of the fault by using the face that a rate sensor can detect the fault and an attitude sensor cannot detect the fault. CONSTITUTION:The fault tolerance ratio of each sensor is obtained with a fault specifying computation means 1. Whether the ratio becomes lower than a threshold value or not is judged with a first judging means 2. Whether the sensor under inspection is a rate sensor or an attitude sensor is judged with a second judging means 3. When the rate sensor is selected, a control means 5 starts the fault specifying computation from this time point. When the fault tolerance ratio becomes lower than the threshold value again, the fault of that rate sensor is specified. When the attitude sensor is selected, the rate sensor which is strongly related to that attitude sensor on the residual computation at this time point is selected with a selecting means 4, and the fault specifying computation is started. When the fault tolerance ratio becomes lower than the threshold value, it is judged that there is no fault in that attitude sensor. When the threshold value does not reach the fault tolerance ratio, the fault of the attitude sensor is specified.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a method and apparatus for detecting a failure in a sensor that detects the angular velocity, attitude, and orientation of a moving object such as an aircraft, and for identifying a failed sensor. In particular, the present invention utilizes software to achieve fail operability without increasing the redundancy of multiple sensors.
The present invention belongs to a technical field called analytical redundancy management technology for securing ty), and relates to a technology that equivalently increases redundancy by using information from other types of sensors, etc. in software instead of hardware output.

[Prior art]

As one method of analytical redundancy management, a method using a dynamic relational expression between sensor outputs and statistical calculation (hereinafter referred to as an inter-sensor relational expression/5PRT (Sequential Prob
ability ratio Te5t) method. ) has been proposed.

Figure 2 shows the principle of identifying faults in dual-system sensors using the 5PRT method. In this method, failure information (residuals) is extracted using a dynamic relational expression between sensor outputs, the influence of noise is removed using a likelihood ratio test, and the probability that a failure has occurred is calculated.

The third procedure for identifying faults in dual-system sensors using the 5PRT method
As shown in the figure. Two systems (SY
SI and 5YS2) outputs are directly compared, and if the difference becomes abnormal, it is determined that at least one of the two sensors of the same type (sensor C) is malfunctioning,
Fault identification calculations are performed using the method shown in Figure 2. At this time, the failure likelihood ratio becomes a negative value over time for a sensor with a failure, and a positive value for a sensor without a failure, so a negative dark value is set, and sensors below this value are determined to have a failure. .

When applying this method to a single system, it is not possible to compare sensor outputs, so it is necessary to initialize 5PRT calculations at regular intervals and perform fault identification calculations for each sensor at all times (MSPRT method). . However, if the sensors that perform failure identification calculations are multiple sensors, including a rate sensor that detects angular velocity or an attitude sensor that detects angle used in a moving body such as an aircraft, as shown in Figure 4, Even if there is a failure in the rate sensor (Q sensor), it is indistinguishable from a failure in the related attitude sensor (θ sensor), so even if failure identification calculations are performed constantly, the failure cannot be identified. .

SUMMARY OF THE INVENTION Therefore, an object of the present invention is to provide a method and apparatus capable of detecting a faulty sensor and specifying the faulty sensor in a single-system sensor that has no object for comparison unlike a multi-system sensor.

[Means to solve the problem]

Therefore, according to the first feature of the present invention, as shown in FIG.
, Φ, Cao (pitch attitude angle, roll attitude angle, azimuth angle) In a device that detects failures of multiple sensors used in moving bodies such as aircraft and identifies failed sensors, failure identification calculations are performed for each sensor. a fault identification calculation means 1 for calculating a fault likelihood ratio by performing a fault determination calculation means 1, and a first determining means 2 for determining whether or not the fault likelihood ratio for each sensor is below a threshold value;
a second determining means 3 for determining whether the sensor under test is a rate sensor or a posture sensor; and means 4 for selecting a rate sensor associated with the posture sensor when the sensor under test is a posture sensor. and the first determining means, the second
and means 5 for controlling the fault identification calculation means in response to the outputs of the determination means and the selection means, and when the selected sensor is a rate sensor, the control means performs the fault identification calculation again for the rate sensor. There is provided a faulty sensor identification device characterized in that when the selected sensor is an attitude sensor, fault identification calculation is performed for a rate sensor associated with the attitude sensor.

According to a second feature of the present invention, in a method for detecting a failure of a plurality of sensors including a rate sensor or an attitude sensor used in a moving object such as an aircraft and identifying a failed sensor, a failure detection method for each sensor is provided. Perform specific calculations to determine the failure likelihood ratio, determine for each sensor whether the failure likelihood ratio is below a threshold, determine whether the sensor under test is a rate sensor or an attitude sensor, and perform the test. If the sensor inside is an attitude sensor, select the rate sensor related to the attitude sensor, and if the selected sensor is a rate sensor, perform the fault identification calculation again for the rate sensor, and then select the selected sensor. A fault sensor identification method is provided, which is characterized in that when the attitude sensor is an attitude sensor, a fault identification calculation is performed for a rate sensor associated with the attitude sensor.

A comparison between the conventional method and the method of the present invention is shown in FIG. As shown in the figure, the problem with the conventional method was that it was not possible to distinguish between a failure in the rate sensor and a failure in the attitude sensor. It would be nice if there was a way to tell if it is. For this purpose, the present invention utilizes the following properties of fault identification calculations.

The first property is that a rate sensor can detect a failure no matter when the failure identification calculation is started after the failure occurs. The second property is that for the attitude sensor, even if a failure identification calculation is started after a failure has occurred, the failure will not be detected, and only failures that occur during the execution of the failure identification calculation can be discovered.

Utilizing this property, in the single-system rate sensor and attitude sensor fault identification method of the present invention, if the rate sensor failure likelihood ratio falls below a threshold and a rate sensor failure is suspected, from that point on We start the fault identification calculation for that rate sensor, and if the fault likelihood ratio for that rate sensor is again below the dark value, we identify that the faulty sensor is that rate sensor, and If the failure likelihood ratio does not reach the threshold value, it is determined that there is no failure in the rate sensor, and if the failure likelihood ratio of the attitude sensor is below the dark value and a failure of the attitude sensor is suspected, From that point on, we start fault identification calculations for rate sensors that are strongly related to that attitude sensor in terms of residual calculation, and if the failure likelihood ratio for that related rate sensor falls below the threshold, it is determined that there is no fault in that attitude sensor. If the failure likelihood ratio of the associated rate sensor does not reach the threshold,
The malfunctioning sensor is identified as the attitude sensor.

〔Example〕

Hereinafter, embodiments of the present invention will be described. Prior to that, for the convenience of understanding the present invention, the basic idea of the present invention will be explained first, and then the embodiments of the present invention will be explained.

Below, a calculation method of the inter-sensor relational expression/5PRT method, a failure detection method of a single system rate sensor and attitude sensor, and simulation results will be shown.

(1) Sensor relational expression/5PRT method Sensor relational equation/5PRT (Sequential P
The robustness ratio Te5t) method is F
DI (Fault Detection and Isolation)
ion and l5olation) method.

Many FDI methods have been devised, but they can be classified based on the method of estimating the sensor signal and generating a residual between the estimated value and the sensor signal, and the method of comparing the residual with a threshold for fault detection. . Residual generation methods can be broadly classified into those using observers and Kalman filters, and other methods, and comparison methods can be broadly classified into methods that simply compare and methods that use statistical methods.

The inter-sensor relational expression/5PRT method is a method that uses a relational expression of aircraft state quantities in aircraft dynamics to calculate the residual, and uses a statistical method to process the residual. The basic inter-sensor relationship equation/5PRT method is applied to dual-system sensors, and when a failure occurs in one of the dual-system sensors, it is possible to determine which type of sensor has failed by directly comparing sensor signals. After determining whether a sensor of that type is faulty, it is used to determine which of the two sensors of that type is faulty.

The FDI system based on the inter-sensor relationship equation/5PRT method is designed assuming bias failure, but in reality,
It can also detect lamp failures. Another feature of this method is that it has higher robustness than methods using Kalman filters and observers, and calculations are relatively simple.

The basics of the inter-sensor relational expression/5PRT method are P=Φ−ψ5i
This is the use of relational expressions between aircraft states such as ne.

For example, if we use the relationship P = Φ - sin θ, θ, Φ, tF (pitch angle, roll angle, yaw angle) from the attitude gyro
The roll rate P can be calculated from the gyro, and by comparing the calculated P with the P signal from the gyro, it is possible to know whether there is a failure. In reality, since sensor signals always contain noise, there is a risk of erroneous diagnosis due to calculation errors caused by noise. Avoid these things,
The 5PRT method uses a statistical method to handle sensor signals in order to increase the accuracy of FDI. A method for detecting failures in rate sensors and attitude sensors using the inter-sensor relational equation/5PRT method is shown below.

■ Residual error generation method As mentioned above, the inter-sensor relational equation/5PRT method uses the relational equation of the aircraft state quantity. Generally, the difference between the signal of the sensor targeted for failure detection (P in the above example) and the signal calculated from another sensor (Φ-1!l'5ine) is called a residual. The following six relational expressions are used for FDI of the rate signal and attitude signal.

(2) Since the 0 formula includes tan θ and 5ece, it cannot be used as it is over the entire range of 0 to 360° with respect to θ, so it is used by transforming it into the following formula.

Φ=P+ψ5ine ■Cao:=
(Φ-P) sin θ + (Q sin Φ + R cos Φ) case ② It is assumed that the failure detection calculation is performed every sample time T. The formula for calculating the residual γ used in the inter-sensor relational formula/5PRT method is the following formula, which is a discretization of the above six relational formulas.

Q: γ,'(Q) =Σ[)L'T$-1 -((e+,-e+-+) cos'U++
('F+-LF+-+) cosTL sin
it)] @I)R: γh'(R) = Σ
[πl′TI 暉1 ((e le +−+ ,) Sin *++ ('
F+ -IF+-+) cos 01 c
os 'J+] ko ■V: γni' (IF
) =Σ [(Cao, '-Cao 1-1') I Wrinkle 1 -1 (Φ, -Φ+-+ T'lT) sin U
++T (U+ sin it +R+ co
s'iL) cos U+) ] (1) Each symbol in the formula has the following meaning.

K: Time (number of discrete values) J: System number of dual system sensor (j = 1 or 2) For variables without j, use the average value of the two systems -: Average value T of the values at times i and i-1 : Sample time ■ Residual test (5PRT method) After calculating the residual γ based on the above formula, the following statistical processing (likelihood ratio test) is performed to determine the failure based on γ. conduct.

First, we formulate two hypotheses H, and H2.

Hl: There is a fault H2: There is no fault In this case, the log-likelihood ratio Zk (K is time) is determined as follows.

P(γiH,) is γ, when the hypothesis Hl is correct.
The probability that the residual appears (likelihood, H).

It means the plausibility that γ appears when is correct. Similarly, P(γ1Ht) is the likelihood that γ appears when H2 is correct. The residual error γ is calculated at a certain time K, and if P(γklH8) is larger than P(γlHw), the probability that hypothesis H1 is correct is higher (the possibility of failure is higher), and in this case Zk is a negative value. Become. Conversely, if the probability of being normal is higher, Z becomes positive, and the higher the probability of being normal, the larger the value of Zk becomes.

This shows that failure can be determined by determining the likelihood ratio using a certain threshold. 5In the PRT method, Z is not Z itself, but the series log-likelihood ratio U.

is used.

The above is the concept of the likelihood ratio test in the 5PRT method, and specifically, the calculation formula is as follows. As mentioned earlier, sensor signals always contain noise, and simple calculations show that Φ
It is also expected that the values of , etc. will jump significantly due to noise.

In calculations using the 5PRT method, the following hypothesis is made in consideration of the influence of noise.

Hl: At time t, there is a fault represented by Gaussian noise with average mk1 variance σ2. (There is sensor noise and a fault.) H2: At time t, there is a fault represented by Gaussian noise with mean 01 variance σt. (There is only sensor noise and no failure.) Under this hypothesis, P(γ, IH,) etc. are as follows.

In this way, the formulas used in actual calculations are simple.

m is a BFM (Bias FailureMag) that indicates how large a failure is expected to be (how large a failure must be detected).
n 1tude), rate sensor: ml
=BFM * (th -to) @attitude sensor
:m,=BFM@1. As shown in the above equation, when a failure occurs, Zk becomes negative, and the sum, U, begins to fall.

A negative value a is taken as the dark value for failure detection, and u ll < a
If (a < 0), it is determined that there is a failure. The reason why a<0 is set here is that due to the influence of noise, u may become <Q near 1=a, and if a=0, an erroneous determination may occur.

(21MSPRT method 5The following points can be raised as problems when performing PRT calculations.

* In 5PRT, the value of U increases indefinitely unless a failure occurs. This is computationally inconvenient and shows that the sensitivity to failure decreases over time.

To address this issue, MSPRT (Modify
There is an improved 5PRT method called the 5PRT method.

This is the 5PRT method with the following improvements added.

# Add a limit to calculation time.

When ELT (Elapsed Time Lim1t) is set and the elapsed time of calculation of 5PRT exceeds ELT,
If there is no failure, return the 5PRT calculation to its initial state and restart.

(3)-Application of 5PRT to heavy-duty sensors Dual-system 1 fa
When considering a sensor system with il operational/2 fail 5afe, ■ Fault identification and separation of dual system sensors ■ Normal/failure judgment after becoming single system sensor (1 failsa)
g■, which has two redundancy management stages (fe capacity), is a basic function of the inter-sensor relational equation/5PRT, and can be realized by direct comparison between sensors and inter-sensor relational equation/5PRT calculation. In this section, we will use the inter-sensor relational formula/5PRT to
This paper describes the results of a study on how to carry out the process.

(a) Inter-sensor relational expression in a single system / 5PRT calculation procedure Inter-sensor relational expression / The 5PRT method is based on fault isolation in a double system, but the following method can detect faults in a single system. can.

■ Constantly execute failure detection calculations of the MSP RT method.

In the 5PRT method, one U7 calculation is required for one hypothesis, so we calculate U, (U,+ and U7−) for a failure of 10m, and a failure of −m, for each sensor. (Calculate sensor type x 2 U.) Since failure information cannot be obtained by direct comparison in a single system, calculation is always performed.

■ Judgment is made as shown in Figure 5.

A-B means the following situation.

A: To the procedure for fault discovery and fault identification B: Normal, λl
5Continue PRT.

C: Normal or extended λ (SPRT revealed no failures).

D: A malfunction is suspected. Extend MSPRT.

b<U, (state proceeding to C) or U. Extend until it reaches kua (proceeding to A).

The reason for setting the threshold value in this procedure is that if only the threshold value a is set, there is a risk that U7 will not reach the threshold value a or less and the failure will be overlooked, such as when a failure occurs immediately before ELT.

, (b) Identification of a faulty sensor In the fault detection calculation of the 5PRT (the same applies to MSPRT) method, when the rate sensor fails, the U of the attitude sensor.

Similarly, when the attitude sensor fails, the rate sensor Uゎ decreases, so one failure may cause two (or more) U゜ to fall below the threshold value a. For this reason,
U of a certain sensor X. When the value becomes low and reaches A in the judgment procedure, whether it is due to a failure of the sensor X itself,
It is necessary to determine whether this is due to a failure in another sensor.

This judgment determines whether a failure has occurred in the rate sensor.
You just need to be able to tell if it's happening with the attitude sensor.

For example, failure detection for the P sensor is based on the formula P = Φ - 5ine, so if U of P reaches a threshold, there are cases where the P sensor itself is malfunctioning, and cases where the Φ and W sensors are It is possible that there is a failure (strictly speaking, θ
Although it is possible that Φ and Cao are malfunctioning, the impact is considered to be smaller than that of Φ and Cao. ) Therefore, if you can distinguish whether the rate sensor or the attitude sensor is malfunctioning, you can determine whether the P sensor is really malfunctioning.

(C) Determining whether a failure has occurred in the rate sensor or attitude sensor The property of the 0-0 equation is used as a method for determining whether a failure has occurred in the rate sensor or attitude sensor.

It is assumed that the value of s in, cos changes little even with a deviation of several degrees of e1Φ, and P, Q, , R, e,
Φ, pay attention to Cao. The terms corresponding to these are different depending on the rate and attitude. Since the attitude signal is processed differentially (θ1-θ, -1, etc.), even if 5PRT is started after the bias failure occurs, its influence cannot be reflected on γ, Li, . In other words, even if 5PRT is activated after a failure occurs, the failure of the posture sensor cannot be discovered. On the other hand, the term regarding the rate sensor uses its own signal such as PT, so when 5PR
Failures can be discovered even if the T is started. This situation is shown in FIG. 6 (Q sensor failure) and FIG. 7 (e sensor failure).

Calculation conditions Aircraft motion: Small aircraft complete linear model Sensor failure, bias Q...1'/see
, e... 1°5 PRT occurs before the start. In the example shown in FIG. 7, the θ sensor is faulty, so no residual error is generated. U, , -(θ) is t=10s
It shows a decreasing trend from around ec, but this is due to the fact that the aircraft motion is calculated using a fully linearized model, so the relationship between variables does not completely match the equation of motion. , does not necessarily detect a failure (A). On the other hand, in the example of FIG.

An example of a procedure for identifying failures using this property will be explained.

■ If U,”(P) is below the threshold a, then 5 for P.
Start PRT. Calculate U,''(P) with this point in time as 1=0.

↓ Make a judgment after 1.5 seconds (Φ or Cao is out of order) ' Reset MSPRT of P sensor and restart ■ If U, "(e) is less than a, start 5PRT for Q and R. At this point 1=0, and in addition to the original MSPRT of Q, R, U, −(Q),
Calculate U, "(R) ↓ After 1.0 seconds, make a judgment... Determine that there is no failure in the rate sensor e Declare a failure in the sensor a' is the 5PRT threshold for failure identification , in order to ensure the discrimination, 1 is slightly more than 0 (+ side) than a.MS
The correspondence between the sensor that detected a failure in the PRT and the failure identification 5PRT that is newly activated for that sensor is as follows.

The time from the start of the specific 5PRT until the final determination is made differs depending on the sensor.

(4) Simulation of detecting single-system sensor failure A simulation was performed to detect failure of a single-system sensor using the method described above.

Calculation conditions Aircraft motion: Small aircraft complete linear model Sensor failure, bias Q...1°/see, θ
...Figure 10 shows the aircraft motion, γ, and the failure signal on the left half, and U on the right half, as before. Further, in the upper three rows of the right half, the specific 5PRT of the sensor that was finally declared to be faulty is shown. The specific 5PRT calculates three Uns, P, Q, and R, for every sensor to simplify the program. The above-mentioned correspondence table is referred to when making the final failure determination.

In the figures after FIG. 8, event marks related to failure detection are added to the figures. The meaning of each mark is as follows.

☆: U, , < a in MSPRT, specific 5PR
I started T.

Mouth: MSPRT was U, <b, and MSPRT was extended.

◇: Failure has been identified.

○: b<U in extended MSPRT. recovered to λl5PRT
I reset it and restarted.

Δ: As a result of the specific 5PRT, it was found that there was no failure in this sensor, so the \l5PRT was reset and restarted.

First, FIG. 8 shows the case where there is no failure.

MSPRT is set every 4 seconds (100 samples), and U7" and U7- become sawtooth. In this example, residual errors occur due to model errors in the aircraft motion calculation, and in the latter half U, - such as Φ 1U, - are separated.

FIG. 9 shows the e-sensor with 10 bias faults added (occurrence time t = 1.0 sec). In this example, U, -(Q) falls and hangs on a at time t = 1.56 seconds (marked with ☆). After this, a specific 5PRT is executed for Q, and as a result, at t = 2.56 seconds, it is found that there is no failure in Q, and the MSPRT of Q is reset and restarted (△ mark) (Specific 5PRT
Medium MSP RT hold).

On the other hand, after the ☆ mark of Q, U of e, +(θ) is applied to a, and the specific S P R-T of e has started (◇ mark, t=2.36 seconds). The specific 5PRT results for θ are:
This is shown in the top three rows of FIG. At the time of final judgment, specific 5P
RT's U,-(P), U,-(Q), U,-(R)
are all positive, indicating that there is no failure in the rate sensor, and a failure is declared in the e-sensor (1 = 3.36 seconds, ◇ mark).

FIG. 10 shows a case where the Q sensor fails at t=2.0 seconds. After t = 2.0, U, "(Q) increases slightly, but does not reach a and reaches b at t = 4.0 seconds. Therefore, MSPRT continues without being reset. (Romark). At t=5.4 seconds, Ufi'' (Q) reached a and the specific 5PPT was started (☆ mark). Specific 5PR
U, ``(Q) of T was less than a', and a failure of Q was declared (t = 6.4 seconds, ◇ mark).

On the other hand, U-(e) was also affected and a 2* mark appeared at L'j, t=3.84 seconds. As a result of the specific 5PRT, it was found that there was no failure in the e-sensor, and the MSPRT was reset at t=4.84 seconds (△ mark). After this, the ☆ mark appeared again at t=6.0 seconds because there was a failure in Q.

A failure occurred at t = 2.0 seconds, but at this point U
fi'' (Q) was a large value, so it took a long time to discover it.

FIG. 11 shows the case of θ failure (t=2.0 seconds, 2°). Although the time of failure occurrence is late, the failure is large, so U,”
The reaction in (e) is fast. In this example, the time required for fault identification is 1.72 seconds, which is faster than the example shown in FIG.

〔Effect of the invention〕

Unlike multiple sensors, failures can be detected and identified using a single sensor that has nothing to compare with. Furthermore, if this method is applied to a multiplexed system, file operability can be increased without increasing the sensor hardware of the multiplexed system.
Fault tolerance can be improved more than ever before, such as by identifying a second failure in a heavy-duty sensor and activating degraded mode.

[Brief explanation of drawings]

Figure 1 is an overall configuration diagram to clarify the configuration of the present invention. Figure 2 is a block diagram showing the concept of analytical redundancy management using the inter-sensor relational formula/5PRT method. Figure 3 is the inter-sensor relational formula/5PRT. FIG. 4 is a graph for comparing the conventional fault identification method and the fault identification method of the present invention. FIG. 5 is a diagram showing the threshold determination procedure in the MSP RT method. Flow chart showing and graph showing relationship between threshold values, No. 6
Figures 8 and 7 are graphs showing changes in the residual γ and likelihood ratio U when the rate sensor (Q sensor) and attitude sensor (e sensor) of the single system sensor fail, respectively, and Figures 8 to 11 Figures 6 and 7 show the results of single-system sensor failure detection simulation under various conditions.
This is a graph similar to the one shown in the figure. Q, P, R...Rate sensor, θ, Φ
, Cao・・・・・・・・・Posture sensor, 1・・・・−・
...-Failure identification means, 2...--First judgment means, 3--Second judgment means, 4...
... Selection means, 5...---- Control means. (a) 7 Figure 5 PRT --- One posture sensor (b) 1C1- No. 8 No failure (a) (b) No. 11 θ sensor failure (t (a) ) Figure = 20SeC, 2°) (b)

Claims (2)

[Claims] (1) In a device that detects failures in multiple sensors used in moving bodies such as aircraft, including rate sensors or attitude sensors, and identifies failed sensors, a failure identification calculation is performed for each sensor to determine the failure likelihood ratio. a first determining means for determining whether the failure likelihood ratio for each sensor is below a threshold; and a second determining means for determining whether the sensor under inspection is a rate sensor or an attitude sensor. determination means, and if the sensor under test is a posture sensor, the rate/rate associated with the posture sensor;
means for selecting a sensor; means for controlling the failure identification calculation means in response to outputs from the first determining means, second determining means, and selecting means; and the controlling means is configured such that the selected sensor is a rate sensor. If the selected sensor is an attitude sensor, the fault identification calculation is performed again for the rate sensor, and if the selected sensor is an attitude sensor, the fault identification calculation is performed for the rate sensor related to the attitude sensor. Failure sensor identification device. (2) In a method for detecting failures in multiple sensors used in moving bodies such as aircraft, including rate sensors or attitude sensors, and identifying failed sensors, failure identification calculations are performed for each sensor to determine the failure likelihood ratio. determine whether the failure likelihood ratio is below a threshold for each sensor, determine whether the sensor under test is a rate sensor or an attitude sensor, and determine whether the sensor under test is an attitude sensor. Select the rate sensor associated with the attitude sensor, and if the selected sensor is a rate sensor, perform the fault identification calculation again for that rate sensor, and if the selected sensor is an attitude sensor, perform the fault identification calculation for that rate sensor again. A fault sensor identification method characterized by performing fault identification calculations for related rate sensors.