CA2165489A1 - Fdic method for minimizing measuring failures in a measuring system comprising redundant sensors - Google Patents
Fdic method for minimizing measuring failures in a measuring system comprising redundant sensorsInfo
- Publication number
- CA2165489A1 CA2165489A1 CA002165489A CA2165489A CA2165489A1 CA 2165489 A1 CA2165489 A1 CA 2165489A1 CA 002165489 A CA002165489 A CA 002165489A CA 2165489 A CA2165489 A CA 2165489A CA 2165489 A1 CA2165489 A1 CA 2165489A1
- Authority
- CA
- Canada
- Prior art keywords
- sensors
- parity
- failure
- measured
- vector
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 238000000034 method Methods 0.000 title claims abstract description 55
- 239000013598 vector Substances 0.000 claims abstract description 62
- 238000002955 isolation Methods 0.000 claims abstract description 25
- 238000001514 detection method Methods 0.000 claims abstract description 21
- 230000009466 transformation Effects 0.000 claims abstract description 8
- 238000012545 processing Methods 0.000 claims description 11
- 238000012360 testing method Methods 0.000 claims description 3
- 238000007476 Maximum Likelihood Methods 0.000 abstract description 4
- 230000003044 adaptive effect Effects 0.000 abstract description 2
- 239000011159 matrix material Substances 0.000 description 15
- 239000000306 component Substances 0.000 description 8
- 238000005259 measurement Methods 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 3
- 229940000425 combination drug Drugs 0.000 description 3
- 230000001419 dependent effect Effects 0.000 description 3
- NLZUEZXRPGMBCV-UHFFFAOYSA-N Butylhydroxytoluene Chemical compound CC1=CC(C(C)(C)C)=C(O)C(C(C)(C)C)=C1 NLZUEZXRPGMBCV-UHFFFAOYSA-N 0.000 description 2
- 238000012937 correction Methods 0.000 description 2
- 230000000875 corresponding effect Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 150000002500 ions Chemical class 0.000 description 2
- NWONKYPBYAMBJT-UHFFFAOYSA-L zinc sulfate Chemical compound [Zn+2].[O-]S([O-])(=O)=O NWONKYPBYAMBJT-UHFFFAOYSA-L 0.000 description 2
- AYFVYJQAPQTCCC-GBXIJSLDSA-N L-threonine Chemical compound C[C@@H](O)[C@H](N)C(O)=O AYFVYJQAPQTCCC-GBXIJSLDSA-N 0.000 description 1
- 230000001133 acceleration Effects 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 238000000354 decomposition reaction Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000018109 developmental process Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000013139 quantization Methods 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 230000000717 retained effect Effects 0.000 description 1
- 230000035945 sensitivity Effects 0.000 description 1
- 238000000844 transformation Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G01—MEASURING; TESTING
- G01D—MEASURING NOT SPECIALLY ADAPTED FOR A SPECIFIC VARIABLE; ARRANGEMENTS FOR MEASURING TWO OR MORE VARIABLES NOT COVERED IN A SINGLE OTHER SUBCLASS; TARIFF METERING APPARATUS; MEASURING OR TESTING NOT OTHERWISE PROVIDED FOR
- G01D3/00—Indicating or recording apparatus with provision for the special purposes referred to in the subgroups
- G01D3/08—Indicating or recording apparatus with provision for the special purposes referred to in the subgroups with provision for safeguarding the apparatus, e.g. against abnormal operation, against breakdown
Abstract
The method according to the invention for mini-mizing measured quantities which are determined from sensors affected by measuring failures and are detected by a plurality of redundant sensors connected to form a measuring system, by detecting and isolating the sensors affected by failures, provides that the sensor values measured by all the sensors are mapped by a linear transformation into a vector in the parity space (parity vector), the dimension of the parity space being deter-mined by the redundance of the measuring system, which is to say by the number of sensors and the dimension of the quantity to be measured. The principle of the method consists in that, by projection of the measured parity vector onto all possible subspaces, it is determined which of the subspaces at each failure level contains the largest proportion of the measured parity vector. By omitting the sensor combinations belonging to these subspaces, the best sensor combination at each failure level can be determined.
The invention fundamentally differs from known parity methods or maximum likelihood methods in that the geometrical interpretation of the properties of the parity space and their consequent use for isolating simultaneously occurring multiple failures are used, the directions in the parity space being determined in an off-line analysis, and the isolation results being provided in a precalculated table. In particular, the method allows an optimally possible adaptive matching of the detection thresholds to the general noise level of the sensors assumed to be failure-free.
The invention fundamentally differs from known parity methods or maximum likelihood methods in that the geometrical interpretation of the properties of the parity space and their consequent use for isolating simultaneously occurring multiple failures are used, the directions in the parity space being determined in an off-line analysis, and the isolation results being provided in a precalculated table. In particular, the method allows an optimally possible adaptive matching of the detection thresholds to the general noise level of the sensors assumed to be failure-free.
Description
2 1 ~ 8 9 FDIC method for m;n;m; 7ing measuring failures in a measuring system compri~ing re~lln~nt sensors The invention relates to a method for m;n;m; zing measured quantities which are determined by sensors affected by possible measuring failure~ and are acquired by a plurality of such redundant sen~ors, connected to form a measuring system, by detecting and isolating the faulty sensors. Methods of this kind are generally known as FDIC methods (Failure Detection, Isolation and Correc-tion).
If redundant sensors are available for measuringa measured quantity to be determined, then it is in principle possible to detect failures in individual sensors or a plurality of sensors by comparison of the data delivered by the sensors. If, in addition, the faulty ~ensors are isolated, then it is pos~ible to eliminate the measuring failure by omitting the sensors detected as being faulty.
This problem is very general and occurs in a multiplicity of possible applications. Some applications, which may be mentioned purely by way of example, are:
- measurement of movement in inertial ~ystems with redundant inertial sensors (gyroscopes, accelero-meters) (possibly with nonparallel axes), - position determination in satellite navigation systems with redundant satellite configuration.
Existing methods for solving the problem can be broadly divided into two categories:
- Grouping of the system of sensors in sensor combina-tions with min;m~l redundance by evaluation of all individual combinations and subsequent combinatorial logic for determining the largest possible failure-free ~ensor combination (parity methods).
- Isolating that individual sensor which contributeR
most to the overall di~crepancy (Chi-square criterion) and subsequent omission of this sen~or ("maximum likelihood" method~).
The known disadvantages of these method~ are, in 21~ ~8~
. - 2 -the case of parity methods:
- The number of individual combinations with ~;n;m~l redundance to be taken into account grows combinato-rially (i.e. as n!) with the number of sensors.
Since the parity of each combination must be valuated, the cost of the method increases commensurately.
- Each individual parity is evaluated discretely as either "good" or "bad" by comparison with predeter-mined threshold values. A parity which only just violates a threshold value is not distinguished from a large threshold-value violation. The same is true for threshold-value undershoots. The resulting total pattern of the parity violations does not, there-fore, in a comparatively wide range of sensor fail-ures, permit unambiguous interpretation and must be interpreted by heuristic means. This can lead to unnecessary misinterpretations. The additional introduction of various ("large" and "small") thre-shold values can only partly ameliorate this problem and increases the cost of the method.
- Due to the fact that the selection of threshold values is generally fixed, an unexpectedly high noise level in all the sensor values leads to com-plete failure of the method, since, possibly, all individual combinations exceed the threshold values and, beyond the threshold values, discrimination no longer takes place. In order to avoid this problem, the threshold values must be matched to-the worst possible case, which leads to an undesirably high insensitivity of the method in "normal operation".
- Owing to the fact that the individual parities are broadly divided into higher/lower than the threshold value, singularities, that is to say sensor data combinations which do not, in principle, permit unambiguous isolation of the failure, can only be roughly detected and only partly distinguished from unambiguous situations. The result of this is that either singularities remain undi~covered or cases 216~ 48~
which are actually unambiguous are treated as a singularity. Failure to discover singularities can lead to wrong decisions, and treating cases which are actually unambiguous as a singularity can impair the integrity of the method, since a smaller amount of reliable information is generally relied upon in the treatment of singularities.
In the case of "maximum likelihood" methods:
- Since these methods are based on the assumption that, at any particular given time, only one sensor delivers faulty data, if multiple failures actually occur simultaneously, false isolation decisions can be made.
- After the occurrence and isolation of an individual failure, it is necessary to reconfigure the para-meters of the method in real time to the corres-ponding (n-1) sensor configuration, in order also to detect and isolate further individual failure~
possibly occurring later. The further behavior of the sensors previously isolated as faulty is no longer included in this new configuration. Possible "recovery" of these sensors can only be detected by parallel processing of a plurality of configura-tions, which correspondingly increases the proces sing cost of the method.
The object of the invention is therefore to provide an improved FDIC method, which is free of the mentioned disadvantages, in the prior art, which result in parity methods or in maximum likelihood methods.
The method according to the invention for m;n;m;zing meaguring failures, according to the generic type mentioned at the outset, i~ defined according to the invention by the fundamental features of patent claim 1.
Further developments and extension~ of the concept of the invention are contained in the dependent patent claims and are explained and illustrated in the following description, first generally and then with the aid of examples. Thus, for example, the developed variant method according to patent claim 2 serves to make the 2~6~9 method practicable even at high processing frequencies, for which actually carrying out the processing in accor-dance with the definition according to claim 1 would require too much computing power.
The method according to the invention essentially differs from the hitherto known method~, referred to above, by - the geometrical interpretation of the proper-ties of the parity space and their consequent use for isolating simultaneously occurring multiple failures;
- the off-line analysis of the directions in the parity space and the provision of the isolation results in a precalculated table, and by - the optionally possible adaptive matching of the detection thresholds to the general noise level of the failure-free sensors.
The sensor values (measurement vector) measured by all the sensors are mapped by a linear transformation into a vector in the parity space. The dimension of the parity space is determined by the redundance of the measuring system, which is to say by the number of sensors and the dimension of the quantity to be measured.
For example, with 8 nonparallel measuring axes for measuring a 3-~imensional movement quantity (for example speed of rotation or acceleration), the dimension of the associated parity space is equal to 5. A number of subspaces can be defined in this parity space, each of which are characteristic of a particular combination of sensor failures. In the case of the abovementioned example of 8 individual sensor axes for measuring a 3-dimen~ional quantity, these ~ubspaces are:
- 8 one-dimensional subspaces (lines) for characteri-zing uniaxial failures - 28 two-dimensional subspaces (planes) for charac-terizing biaxial failures - 56 three-dimensional subspaces for characterizing triaxial failures - 70 four-dimensional subspaces for characterizing four-axis failure~
~16~ ~8~
(Comment: five-axis failures can still be detected, but not isolated, and failures relating to a larger number of axes cannot even be detected using the sensor system of this example.) These subspaces characterize failure combinations in such a way that, when a particular failure combination is present, the resulting parity vector lies fully within the relevant subspace.
The principle of the method consists in deter-m;~;~g, by projection of the measured parity vector onto all possible subspaces, which of the subspaces for each failure level (uniaxial, biaxial, ...) involves the greatest portion of the measured parity vector. By omitting the sen~or combinations associated with these subspaces, the best sensor combination can then be determined at each failure level. The result of this failure isolation is independent of any threshold values, since it is not determined by the magnitude (the length~
of the measured parity vector, but only by its direction.
The magnitude of the parity vector, or of the projection of the parity vector onto the subspaces, is only employed for the failure detection, which is to say in order to decide whether a failure is present at all, or whether a single, double, triple failure, etc., should be assumed.
(This decision, too, can be made without "a priori'~
threshold values, if the projections onto the subspaces with m;n;m~l redundance are optionally employed as a measure for these threshold values.) Measures to improve the efficiency are-essential for practical embodiment of this principle in real-time processing. Since the failure isolation depends only on the direction of the parity vector, it is possible to calculate the projections of the parity vector onto the characteristic subspaces off line, outside the real-time application, and to provide the result of the failure isolation in a table. The cost to be expended in real time i~ then restricted to the calculation of the parity vector and of a table key from the direction of the parity vector, using which key the re~ult~ of the failure X165 ~
. . .
isolation are then called up from the table. In order to m;n;m; ze the required table size, use may be made of the symmetries in the parity space, which are given from the symmetry of the sensor axial arrangement.
The improvements which can be achieved with this method are:
- Failure isolation takes place without threshold values, which is to say that it can take place without "a priori" assumptions regarding the actual noise of the failure-free sensors.
- The sensitivity actually achievable in the failure detection, and therefore the ~uality of the output signal, can be adaptively matched to the noise of the failure-free sensors.
15 - During isolation of the failure, apparent singulari-ties are avoided and actual singularities are det-ected as such.
- In contrast to existing parity methods, the proces-sing co~t needed in real time for failure detection and isolation is in principle determined only by the dimension of the parity space, and is independent of the number of possible sensor combinations. Thus, for example, the 163 possible combinations of 8 uniaxial accelerometers, arranged with nonparallel axes, can be isolated with the same cost as the 11 possible combinations of 4 biaxial gyroscopes arranged with nonparallel axes.
- In contrast to existing ~m~x;mllm likelihood"
methods, it is in addition always possible, within the bounds of intrinsic limits, to detect and iso-late simultaneously occurring multiple failures correctly.
The method according to the invention is presented below in three sections, in which detailed explanations are given:
- in section A of the basic principles, - in section B of the implementation of the failure-detection method, with the aid of flow charts, and - in section C of two application examples.
216548~
For the purposes of the explanation, reference is made to the appended drawings, in which Figure 1 illustrates a statistical density distribution (Chi-square distribution) of the resulting length of a parity vector for degrees of freedom of 1 to 5;
Figure 2 demonstrates false-alarm probabilities as a function of predeterminable threshold values for various degrees of freedom; 0 Figure 3 illustrates the flow chart of the execution of a method according to the invention;
Figure 4 shows the execution of a method with stored isolation decision; and Figure 5 illustrates the parity space for an application example in which four sensors are provided in order to measure a scalar measured quantity.
A. Basic principles The basic principle underlying the method is a linear or linearized relationship between the quantities to be determined and the sensor values mea~ured in the failure-free ca~e.
~ = A x ~ e (1) s indicating the sensor values combined to form measure-ment vectors, x indicating the quantity to be measured and e indicating the sensor failure. The matrix A des-cribes the relationship between the two for the failure-free case.
The estimated value for the quantity to be measured is given by the measured sensor values according to .~ = Hs (2) H = ~ r~l) 1 ,1 H, as pseudoinverse of the matrix A, providing the linear least squares fit, and the assumption being made below that the relevant inverse exists, which is to say that the mea~ured quantity c~n indeed be determined.
216~8~
As regards the residues, which is to say the deviations between actual sensor values (affected by failures) and the sensor values associated with the esti-mated measured value, the following equation is valid r = s ~
= (1 - ,1 ~ ) s (3) = Rs The magnitude of the residue vector r is a mea~ure of the consi~tency of the sensor data, such that, with fully consistent sensor data, r is equal to zero, whereas when the sensor data are affected by failures, r is different than zero and, in principle, allows con-clusions regarding the failure. For efficient analysis of the ~ensor data consistency, r is not, however, directly taken as a starting point, but rather R is firstly diagonalized according to ~'~'1 ''' ~
0 A2 y (4) ~ 0 -- 0 A~J
R is by definition real and symmetrical, 80 that thi~
diagonalization is always pos~ible. In addition, a property of the eigenvalues Ai is that they can only as~ume the-values 0 and 1, the degeneracy of the eigen-value 0 being determined by the dimen~ion of the measured quantity, and the degeneracy of the eigenvalue 1 being determined by the number of redundant sensors. For the decomposition of R according to (4), this means that, in the matrix V, only the rows with the eigenvalues 1 contribute to R. Let m be the dimension of the quantity to be measured and n be the number of sensors, then the dimension of the matrix V is (n-m) x m, and the (n-m) rows of V can be constructed from an orthonormalized set of eigenvectors of R with the eigenvalue 1.
The matrix V has the following properties 216~ l~9 g vr y = R
yvr = 1 R Vr. = yr VR = Y (5 y~r = O
H Y~ = O
Y~ = O
The mapping p = V ~ (6) defines, for a measured vector 8, a parity vector p in which all the information regarding the failure state of the sensor values i8 contained.
In particular r r = p p (7) which i8 to say that the length of the residue vector r is e~ual to the length of the parity vector p and serves as a measure of the consistency of the sensor combination containing all sen~ors.
A conclusion can be drawn in the following way from the direction of p as to which sensors contribute how much to the overall failure. If, for example, a single failure is present in sensor i, then the parity vector determined according to (6) lies fully in the direction defined by the ith column of V. In the case of a double failure, for example in the ~ensor~ i and j, the resulting parity vector lies in the plane spanned by the ith and jth column~ of V. The column vectors of the matrix V thuR respectively define, for particular failure combinations, characteristic subQpaces in which the reaulting parity vector is contained. This assignment of subspaces of the parity space to failure combinations can be continued with an increasing number of sensors affect-ed by failures, for as long as the number of associated column vector~ does not yet span the entire parity space.
In the case of n sensors and an ~-dimensional mea~ured 216~8~
quantity, the parity space has the dimension (n-m) and the matrix V consists of n characteristic column vectors.
Only (n-m) column vectors are required to span the parity space fully, which is to say that it is possible to isolate failures in up to (n-m-l ) sensors in this way.
In order to test the hypothesis that failures are present in a particular combination k of sensors, one of the projections p~= C~p (8) o~; = 0,~ p with the property O~rO~, + p~rp~, = p ~p (9) is formed, the rows of the transformation matrix C~ being formed by orthonormalization of the column vectors of V
involved in the combination k. The corresponding trans-formation 0~ projects onto the respective orthogonal subspace. The relationship (9) can be used respectively to determine only the projection ontc the subspace with smaller dimensionality, as a result of which the proces-sing cost is reduced.
The following consistency criteria are satisfied:
The quantities e~; = P~ P~ (io) T p are a measure of which portion of the observed inconsis-tency is due to the sensors involved in the combination k, or respectively still remains if these sensors are omitted.
The total number K of sensor combinations whose failures can, in principle, be isolated is given by A ~
- 216~ ~8~
the sllmm~n~ in each case describing the number of comb-inations ( f of ~) associated with a failure level f, and the summation runs from the failure-free case ( f = O) up to the m;n;mllm required residual redlln~nce (f =n -m-l ) .
For each of these sensor failure combinations, the consistency of the remaining sensors can be determined according to (8), and, by comparison with a threshold value dependent on the failure level, a decision can be made as to whether the sensor combination remaining in each case affords acceptable consistency. In particular, it is also possible to sort the sensor combination at each failure level in order of increasing inconsistency, and at each failure level to determine the combination with the best consistency. An important property o~ the parity vector, which is used in practical embodiment of the method, consists in that the relative magnitudes of the inconsistencies for the various sensor combinations are determined only by the orientation of the parity vector in the parity space. The absolute magnitude is given by a common factor from the magnitude of the parity vector. The latter does not, however, have any influence on the order of the sensor combinations sorted according to inconsistencies.
Singularities:
Under particular failure conditions it is pos-sible for a plurality of different sensor combinations to give an acceptable consistency for one failure level or also for the best consistency not to be determined unambiguously, in such a way that two different sensor combinations provide consistency values which are very close to the maximum. In the geometrical interpretation of the parity space, this case corresponds to the situa-tion that the parity vector determined from the measured vector lies at the intersection of two (or more) charac-teristic subspaces. If this case occurs at the maximum failure level, then there is a singularity, and un-~higuous failure isolation only on the basis of the currently measured sensor values is not po~sible. An 216~8~
isolation decision can then possibly be made using the data of earlier processing cycles, for example ~uch that an earlier, unambiguously made isolation decision is retained, if this also delivers an acceptable consistency for the current singularity case, or additionally avail-able status information regarding the individual ~en~ors is employed to resolve singularities.
Thre~hold value dete ;n~tion:
In establishment of detection thresholds as acceptance criteria for the inconsistencies of the remaining sensor combinations at the various failure levels, referred to hereafter a~ "threshold values", account must be taken of the fact that even failure-free sensors do not deliver absolutely consistent measured data, but are affected by some inaccuracies.
These inaccuracies of the failure-free sensora establish a lower limit for the threshold values to be selected, it also being possible to take into account a safety factor in order to avoid false alarms, this safety factor being determined by the statistical distribution of the inaccuracies of failure-free sensors and the required m~x;mllm fal~e alarm rate.
An upper limit for the threshold values to be selected is given from the external accuracy requirement~
of the application, which establish which failures can still be accepted in the measured quantity to be deter-mined, or at which rate missed detection is permissible.
A prerequisite for a technically meaningful application must be that the inaccuracies of the failure-free sensor permit a sufficiently accurate determinationof the measured quantity, which is to say that the upper limit for the threshold values mu~t lie considerably above the abovementioned lower limit.
If an independent, stati~tical normal di~tribu-tion (with variance 1, to which the threshold values arethen related) is in each case assumed for the inaccura-cies of the failure-free sensors, then a Chi-square di~tribution with degree of freedom v=(n-m) results 4 ~ ~
through equation (7) for the statistical density distribution of the resulting length of the parity vector.
2VI2 ~V~
This density distribution is represented in Figure 1 for various degrees of freedom. In the case of failure-free sensors, this corre~ponds to the statistical distribution of the rPm~ining inconsistencies ~ at the various fail-ure levels. The means for each degree of freedom are re~pectively equal to the degree of freedom. The lower limits for the threshold values S3i3 for a predetermined, maximum permissible false alarm rate P are determined by ~ (13) P~ JR~
and the upper limit~ for the threshold values S3~ can, with a m~xi mllm permissible failure ~xi of the ith compo-nent of the mea~ured quantity to be determined, be estimated as Sy H~
Hi~ being the elements of the leaRt squares tran~formation matrix. Figure 2 gives the relationship between selected threshold value (in unit~ of a2 of the ~ensor inaccuracy) and the resulting false alarm probability.
Under nominal condition~, that i~ to say if the ~ensor inaccuracy of the failure-free ~ensors ha~ the assumed distribution, then the threshold value~ deter-mined in thi~ way effect the desired fal~e alarm rate and failure limit~ for the mea~ured quantity. However, under circum~tances in which (temporarily) all of the ~ensors exhibit larger inaccuracies than assumed, unde~ired failure de~ections can occur. In order to avoid thi~, the - 21~8~
threshold values can be dynamically matched to the lowest inconsistency of the highest failure level, which is to say to the inconsistency of the best sensor combination with m; n;mllm number of redundant sensors. Instead of the above-described threshold values S~, threshold values of the form Sy = n~;C[S,, ,a ~ ,t]~
are then selected, the factor a being chosen, as a function of the failure level, or of the degree of freedom, for example such that a = ~ ~ 1 The effect of this selection of the threshold value~ i~
that, even with unexpectedly high inaccuracy of all sensors, the method accept~ the best sensor combination at the latest at the maximum failure level, and even failures at the lower failure level~ are only detected when individual sensors are actually significantly le~s accurate than other~.
B. Implementation of the method In order to carry out the failure detection and isolation method, it is not generally required to evaluate respectively all sensor combination~ or sensor failure combinations. Instead of thi~, the method schema-tically represented in Figure 3 can be used.
In this case the parity vector is first deter-mined (box 1) and the consistency of the overall sensorcombination is calculated therefrom.
By comparison with a threshold value which i~
selected ~pecifically for the failure level f (here f=O), whether the con~i~tency of the overall ~en~or combination i~ acceptable i~ detected (box 2).
If 80, then all sensors are ~ufficiently failure-free and can be employed for determ;ning the measured quantity (box 3). The method is then (for the current processing cycle) terminated.
Otherwi~e, the sen~or combination~ of the failure 21~5~8~
level 1, which result from omission of one sensor in each case, are first evaluated (box 6), and the best sensor combination at this failure level is determined.
If this best sensor co-mbination is acceptable, which is to say that the r~m~;n;ng inconsistency lies below a threshold value (dependent on the failure level) (box 5), then the isolation decision can be ended with the best sensor combination at this failure level (box 10) .
Otherwise, a test is carried out a~ to whether the m~i ml~m failure level has already been reached (box 5), and if this is not the case, the method i8 continued for the next higher failure level (jump to box 4). If the m~im~lm failure level has been reached without a suffi-cient consistency having been determined in the remaining sensors at the m~imllm failure level, it is assumed that too many sensors are faulty, and, as an "emergency solution", the best sensor combination at the m~Xi mum failure level is isolated. This ca~e can only occur if the threshold values of the individual failure level are rigidly predetermined and are not dynamically matched.
In applications in which the geometry of the sensor system, and therefore also the geometry of the characteristic subspaces in the parity space, change not at all or only slowly compared to the required processing frequency, a method according to Figure 4 can be selected in order to increase the efficiency further.
After the parity vector has been determined from the sensor value~ ~box 1), the norm of the parity vector is determined, and the parity vector is suitably normali-zed (box 2). A normalization particularly suitable for the purpose required here consists in normalizing the component with the m~; mum magnitude to the value +1 by multiplication of all the components by a factor. The index of the m~;mum component serves as a first element in the table key. The remaining portion of the table key is then obtained from the remaining components of the parity vector by quantizing the re~pective value range [-1, +1] into q equal ~ections. A table formed in thi~
216S 48~
way then has, in the case of a d-~;m~n~ional parity space - and a quantization of the components into q sections, Z = d qd-l entries, which respectively code for one direction of the parity vector. This number gives an upper limit, which can be further reduced by exploiting possible applica-tion-specific symmetries in the parity space.
After the table key has been determined from the components of the parity vector (box 3), isolation information stored under this key is called up (box 4).
At each table key (direction of the parity vector), the f respective best sensor combinations are provided in order of increasing inconsistency for each failure level f.
For the detection and isolation decision (box 5), only these respective best sensor combinations are then evaluated, by projection of the parity vector onto the associated subspaces, at each failure level. In this case, the sequence of the above-described stepped method can then again be used.
Independently of whichever of these methods was used to establish the consistency of the sensor combina-tions, the sensor combination actually to be used iR then selected. Each sensor combination has its own least squares transformation matrix Nl, in which the sensors to be omitted are no longer taken into account, and the value of the quantity to be measured is given according to (2) from the measured vector.
C. Application examples Four th~r~eters In this example, the application for a part-icularly simple case is demonstrated, in which redundant sensors are used for measuring a scalar (1-dimensional) measured quantity. In this case, 4 sensors were chosen, 80 that, on the one hand, it is even possible to isolate simultaneously occurring double failures and, on the other hand, the parity space, which is three-dimension21 216~g~
in this case, still gives clear ideas regarding the geometry in the parity ~pace. Instead of the thermo-meters, mentioned here, for measuring temperature, it is naturally possible to consider any other scalar measured quantities/sensors in exactly the same way.
The relationship between the temperature and the meaRured values T~ is here given as ~T~
2 _ 1 T
_ ~T~J
Then H (1 1 1 1) and ~3 _~
1 3 1 _1 _1 _1 3 _1 _1 1 1 3 ~ 4 4 4 4 with a ~,, 1 1 1 1 _ ~ 2 2 2 2 The number of pos~ible, isolatable failure combination~
is here ~=11, and the corre~ponding co~binations, with 21~5 18~
the associated projection matrices, are given in the following table, the projection onto the sub~pace of smaller ~;m~n~ion having been chosen in each case.
Number of Faulty Pro~ectlon ~atrlces faulty sensors sensor(~
C~
C~ = ~ (1 1 1) 1 3 C~ = 1 (-1 -1 1) C~
0 2 1.2 0~ a-2 1.3 0~ a 2 1.4 0~ = 1 (1 1 0) 2 2.3 0~ 0) 2 2.4 0~ =-- tO 1 -1) 2 3.4 o,~ = ~ (1 0 1) Tab. 1: Projection matrice~ for the characteri~tic ~ub-space~ of the 4-thermometer example.
't 216~9 Figure 5 illustrates the geometrical conditions in the three-dimensional parity space for the above example with four thermometers. The four characteristic directions for individual failures in this case lie along the space diagonals (regions A) defined by the four thermometers Tl to T4. Six planes in all are spanned by these four direc-tions, and these planes correspond to the respective double failures (regions B), the respective width of the indicated "bulge" specifying the magnitude of the perm-issible establishable inaccuracies of failure-free sensors. The intersections of these planes show the singularity regions in which unambiguous double failure isolation is not possible (regions C). If the direction of the parity vector lies in the remaining regions of the represented sphere (regions D), then there is a failure in more than two thermometers, which can no longer be isolated. The width of the regions depends on the in-accuracy to be assumed for failure-free sensors. In the representation of Figure 5 only a typical region is represented, by bold interrupted bordering, for each region.
Position det~rmin~tion by measuring the pseudodistance to navigation satellite~
In this case, position determination from meas-ured "pseudodistances" is to be considered. The measure-ment equation has (here after the conventional linear-ization by a known approximated value for the position), in the case of n observed satellites, the form-s =
rS~ a~
z ~S" a a a"~ c~-~
a2 + a~ + a~, = 1 the components ~ of the measured vector characterizing the measured pseudodistances to the individual satellites, x, y, z and ~t charactsrizing the compone~ts '. . . ~16548g of the positional correction, or the failure in the receiver clock. The first 3 elements in each row in the measured matrix are respectively the direction cosine of the connecting line between the satellite and the approx-imated position.
Since, in this case, the measured matrix A
changes as a function of the respective satellite con-stellation, further procedural steps must be carried out dynamically for failure detection and isolation, which is to say calculation of the parity transformation V. In this case, however, it is substantially possible to resort to quantities determined anyway for the position determination.
In any case, the transformation matrix E = (ATA ) -lA
is determined, from which the residue matrix R can be determined by R = 1 - AE
An orthonormal set of eigenvectors of R with eigenvalue 1 can be determined from this by means of standard numerical methods, which eigenvectors, as row vectors, respectively form the rows of the matrix V The parity vector determined by P = V ~
is then projected onto the characteristic subspaces, determined by the permissible satellite combinations, and an optimally consistent satellite combination is deter-mined in the abovedescribed way. When determining the permissible satellite combinations, care should be taken to consider only such combinations with a sufficient DOP
value.
Because of the changing satellite constellation, there is no possibility of an off-line precalculation of a decision table, in which an isolation decision for all directions of the parity vector is stored. However, such a calculation can be carried out by a background task, since the satellite constellation only changes slowly.
If redundant sensors are available for measuringa measured quantity to be determined, then it is in principle possible to detect failures in individual sensors or a plurality of sensors by comparison of the data delivered by the sensors. If, in addition, the faulty ~ensors are isolated, then it is pos~ible to eliminate the measuring failure by omitting the sensors detected as being faulty.
This problem is very general and occurs in a multiplicity of possible applications. Some applications, which may be mentioned purely by way of example, are:
- measurement of movement in inertial ~ystems with redundant inertial sensors (gyroscopes, accelero-meters) (possibly with nonparallel axes), - position determination in satellite navigation systems with redundant satellite configuration.
Existing methods for solving the problem can be broadly divided into two categories:
- Grouping of the system of sensors in sensor combina-tions with min;m~l redundance by evaluation of all individual combinations and subsequent combinatorial logic for determining the largest possible failure-free ~ensor combination (parity methods).
- Isolating that individual sensor which contributeR
most to the overall di~crepancy (Chi-square criterion) and subsequent omission of this sen~or ("maximum likelihood" method~).
The known disadvantages of these method~ are, in 21~ ~8~
. - 2 -the case of parity methods:
- The number of individual combinations with ~;n;m~l redundance to be taken into account grows combinato-rially (i.e. as n!) with the number of sensors.
Since the parity of each combination must be valuated, the cost of the method increases commensurately.
- Each individual parity is evaluated discretely as either "good" or "bad" by comparison with predeter-mined threshold values. A parity which only just violates a threshold value is not distinguished from a large threshold-value violation. The same is true for threshold-value undershoots. The resulting total pattern of the parity violations does not, there-fore, in a comparatively wide range of sensor fail-ures, permit unambiguous interpretation and must be interpreted by heuristic means. This can lead to unnecessary misinterpretations. The additional introduction of various ("large" and "small") thre-shold values can only partly ameliorate this problem and increases the cost of the method.
- Due to the fact that the selection of threshold values is generally fixed, an unexpectedly high noise level in all the sensor values leads to com-plete failure of the method, since, possibly, all individual combinations exceed the threshold values and, beyond the threshold values, discrimination no longer takes place. In order to avoid this problem, the threshold values must be matched to-the worst possible case, which leads to an undesirably high insensitivity of the method in "normal operation".
- Owing to the fact that the individual parities are broadly divided into higher/lower than the threshold value, singularities, that is to say sensor data combinations which do not, in principle, permit unambiguous isolation of the failure, can only be roughly detected and only partly distinguished from unambiguous situations. The result of this is that either singularities remain undi~covered or cases 216~ 48~
which are actually unambiguous are treated as a singularity. Failure to discover singularities can lead to wrong decisions, and treating cases which are actually unambiguous as a singularity can impair the integrity of the method, since a smaller amount of reliable information is generally relied upon in the treatment of singularities.
In the case of "maximum likelihood" methods:
- Since these methods are based on the assumption that, at any particular given time, only one sensor delivers faulty data, if multiple failures actually occur simultaneously, false isolation decisions can be made.
- After the occurrence and isolation of an individual failure, it is necessary to reconfigure the para-meters of the method in real time to the corres-ponding (n-1) sensor configuration, in order also to detect and isolate further individual failure~
possibly occurring later. The further behavior of the sensors previously isolated as faulty is no longer included in this new configuration. Possible "recovery" of these sensors can only be detected by parallel processing of a plurality of configura-tions, which correspondingly increases the proces sing cost of the method.
The object of the invention is therefore to provide an improved FDIC method, which is free of the mentioned disadvantages, in the prior art, which result in parity methods or in maximum likelihood methods.
The method according to the invention for m;n;m;zing meaguring failures, according to the generic type mentioned at the outset, i~ defined according to the invention by the fundamental features of patent claim 1.
Further developments and extension~ of the concept of the invention are contained in the dependent patent claims and are explained and illustrated in the following description, first generally and then with the aid of examples. Thus, for example, the developed variant method according to patent claim 2 serves to make the 2~6~9 method practicable even at high processing frequencies, for which actually carrying out the processing in accor-dance with the definition according to claim 1 would require too much computing power.
The method according to the invention essentially differs from the hitherto known method~, referred to above, by - the geometrical interpretation of the proper-ties of the parity space and their consequent use for isolating simultaneously occurring multiple failures;
- the off-line analysis of the directions in the parity space and the provision of the isolation results in a precalculated table, and by - the optionally possible adaptive matching of the detection thresholds to the general noise level of the failure-free sensors.
The sensor values (measurement vector) measured by all the sensors are mapped by a linear transformation into a vector in the parity space. The dimension of the parity space is determined by the redundance of the measuring system, which is to say by the number of sensors and the dimension of the quantity to be measured.
For example, with 8 nonparallel measuring axes for measuring a 3-~imensional movement quantity (for example speed of rotation or acceleration), the dimension of the associated parity space is equal to 5. A number of subspaces can be defined in this parity space, each of which are characteristic of a particular combination of sensor failures. In the case of the abovementioned example of 8 individual sensor axes for measuring a 3-dimen~ional quantity, these ~ubspaces are:
- 8 one-dimensional subspaces (lines) for characteri-zing uniaxial failures - 28 two-dimensional subspaces (planes) for charac-terizing biaxial failures - 56 three-dimensional subspaces for characterizing triaxial failures - 70 four-dimensional subspaces for characterizing four-axis failure~
~16~ ~8~
(Comment: five-axis failures can still be detected, but not isolated, and failures relating to a larger number of axes cannot even be detected using the sensor system of this example.) These subspaces characterize failure combinations in such a way that, when a particular failure combination is present, the resulting parity vector lies fully within the relevant subspace.
The principle of the method consists in deter-m;~;~g, by projection of the measured parity vector onto all possible subspaces, which of the subspaces for each failure level (uniaxial, biaxial, ...) involves the greatest portion of the measured parity vector. By omitting the sen~or combinations associated with these subspaces, the best sensor combination can then be determined at each failure level. The result of this failure isolation is independent of any threshold values, since it is not determined by the magnitude (the length~
of the measured parity vector, but only by its direction.
The magnitude of the parity vector, or of the projection of the parity vector onto the subspaces, is only employed for the failure detection, which is to say in order to decide whether a failure is present at all, or whether a single, double, triple failure, etc., should be assumed.
(This decision, too, can be made without "a priori'~
threshold values, if the projections onto the subspaces with m;n;m~l redundance are optionally employed as a measure for these threshold values.) Measures to improve the efficiency are-essential for practical embodiment of this principle in real-time processing. Since the failure isolation depends only on the direction of the parity vector, it is possible to calculate the projections of the parity vector onto the characteristic subspaces off line, outside the real-time application, and to provide the result of the failure isolation in a table. The cost to be expended in real time i~ then restricted to the calculation of the parity vector and of a table key from the direction of the parity vector, using which key the re~ult~ of the failure X165 ~
. . .
isolation are then called up from the table. In order to m;n;m; ze the required table size, use may be made of the symmetries in the parity space, which are given from the symmetry of the sensor axial arrangement.
The improvements which can be achieved with this method are:
- Failure isolation takes place without threshold values, which is to say that it can take place without "a priori" assumptions regarding the actual noise of the failure-free sensors.
- The sensitivity actually achievable in the failure detection, and therefore the ~uality of the output signal, can be adaptively matched to the noise of the failure-free sensors.
15 - During isolation of the failure, apparent singulari-ties are avoided and actual singularities are det-ected as such.
- In contrast to existing parity methods, the proces-sing co~t needed in real time for failure detection and isolation is in principle determined only by the dimension of the parity space, and is independent of the number of possible sensor combinations. Thus, for example, the 163 possible combinations of 8 uniaxial accelerometers, arranged with nonparallel axes, can be isolated with the same cost as the 11 possible combinations of 4 biaxial gyroscopes arranged with nonparallel axes.
- In contrast to existing ~m~x;mllm likelihood"
methods, it is in addition always possible, within the bounds of intrinsic limits, to detect and iso-late simultaneously occurring multiple failures correctly.
The method according to the invention is presented below in three sections, in which detailed explanations are given:
- in section A of the basic principles, - in section B of the implementation of the failure-detection method, with the aid of flow charts, and - in section C of two application examples.
216548~
For the purposes of the explanation, reference is made to the appended drawings, in which Figure 1 illustrates a statistical density distribution (Chi-square distribution) of the resulting length of a parity vector for degrees of freedom of 1 to 5;
Figure 2 demonstrates false-alarm probabilities as a function of predeterminable threshold values for various degrees of freedom; 0 Figure 3 illustrates the flow chart of the execution of a method according to the invention;
Figure 4 shows the execution of a method with stored isolation decision; and Figure 5 illustrates the parity space for an application example in which four sensors are provided in order to measure a scalar measured quantity.
A. Basic principles The basic principle underlying the method is a linear or linearized relationship between the quantities to be determined and the sensor values mea~ured in the failure-free ca~e.
~ = A x ~ e (1) s indicating the sensor values combined to form measure-ment vectors, x indicating the quantity to be measured and e indicating the sensor failure. The matrix A des-cribes the relationship between the two for the failure-free case.
The estimated value for the quantity to be measured is given by the measured sensor values according to .~ = Hs (2) H = ~ r~l) 1 ,1 H, as pseudoinverse of the matrix A, providing the linear least squares fit, and the assumption being made below that the relevant inverse exists, which is to say that the mea~ured quantity c~n indeed be determined.
216~8~
As regards the residues, which is to say the deviations between actual sensor values (affected by failures) and the sensor values associated with the esti-mated measured value, the following equation is valid r = s ~
= (1 - ,1 ~ ) s (3) = Rs The magnitude of the residue vector r is a mea~ure of the consi~tency of the sensor data, such that, with fully consistent sensor data, r is equal to zero, whereas when the sensor data are affected by failures, r is different than zero and, in principle, allows con-clusions regarding the failure. For efficient analysis of the ~ensor data consistency, r is not, however, directly taken as a starting point, but rather R is firstly diagonalized according to ~'~'1 ''' ~
0 A2 y (4) ~ 0 -- 0 A~J
R is by definition real and symmetrical, 80 that thi~
diagonalization is always pos~ible. In addition, a property of the eigenvalues Ai is that they can only as~ume the-values 0 and 1, the degeneracy of the eigen-value 0 being determined by the dimen~ion of the measured quantity, and the degeneracy of the eigenvalue 1 being determined by the number of redundant sensors. For the decomposition of R according to (4), this means that, in the matrix V, only the rows with the eigenvalues 1 contribute to R. Let m be the dimension of the quantity to be measured and n be the number of sensors, then the dimension of the matrix V is (n-m) x m, and the (n-m) rows of V can be constructed from an orthonormalized set of eigenvectors of R with the eigenvalue 1.
The matrix V has the following properties 216~ l~9 g vr y = R
yvr = 1 R Vr. = yr VR = Y (5 y~r = O
H Y~ = O
Y~ = O
The mapping p = V ~ (6) defines, for a measured vector 8, a parity vector p in which all the information regarding the failure state of the sensor values i8 contained.
In particular r r = p p (7) which i8 to say that the length of the residue vector r is e~ual to the length of the parity vector p and serves as a measure of the consistency of the sensor combination containing all sen~ors.
A conclusion can be drawn in the following way from the direction of p as to which sensors contribute how much to the overall failure. If, for example, a single failure is present in sensor i, then the parity vector determined according to (6) lies fully in the direction defined by the ith column of V. In the case of a double failure, for example in the ~ensor~ i and j, the resulting parity vector lies in the plane spanned by the ith and jth column~ of V. The column vectors of the matrix V thuR respectively define, for particular failure combinations, characteristic subQpaces in which the reaulting parity vector is contained. This assignment of subspaces of the parity space to failure combinations can be continued with an increasing number of sensors affect-ed by failures, for as long as the number of associated column vector~ does not yet span the entire parity space.
In the case of n sensors and an ~-dimensional mea~ured 216~8~
quantity, the parity space has the dimension (n-m) and the matrix V consists of n characteristic column vectors.
Only (n-m) column vectors are required to span the parity space fully, which is to say that it is possible to isolate failures in up to (n-m-l ) sensors in this way.
In order to test the hypothesis that failures are present in a particular combination k of sensors, one of the projections p~= C~p (8) o~; = 0,~ p with the property O~rO~, + p~rp~, = p ~p (9) is formed, the rows of the transformation matrix C~ being formed by orthonormalization of the column vectors of V
involved in the combination k. The corresponding trans-formation 0~ projects onto the respective orthogonal subspace. The relationship (9) can be used respectively to determine only the projection ontc the subspace with smaller dimensionality, as a result of which the proces-sing cost is reduced.
The following consistency criteria are satisfied:
The quantities e~; = P~ P~ (io) T p are a measure of which portion of the observed inconsis-tency is due to the sensors involved in the combination k, or respectively still remains if these sensors are omitted.
The total number K of sensor combinations whose failures can, in principle, be isolated is given by A ~
- 216~ ~8~
the sllmm~n~ in each case describing the number of comb-inations ( f of ~) associated with a failure level f, and the summation runs from the failure-free case ( f = O) up to the m;n;mllm required residual redlln~nce (f =n -m-l ) .
For each of these sensor failure combinations, the consistency of the remaining sensors can be determined according to (8), and, by comparison with a threshold value dependent on the failure level, a decision can be made as to whether the sensor combination remaining in each case affords acceptable consistency. In particular, it is also possible to sort the sensor combination at each failure level in order of increasing inconsistency, and at each failure level to determine the combination with the best consistency. An important property o~ the parity vector, which is used in practical embodiment of the method, consists in that the relative magnitudes of the inconsistencies for the various sensor combinations are determined only by the orientation of the parity vector in the parity space. The absolute magnitude is given by a common factor from the magnitude of the parity vector. The latter does not, however, have any influence on the order of the sensor combinations sorted according to inconsistencies.
Singularities:
Under particular failure conditions it is pos-sible for a plurality of different sensor combinations to give an acceptable consistency for one failure level or also for the best consistency not to be determined unambiguously, in such a way that two different sensor combinations provide consistency values which are very close to the maximum. In the geometrical interpretation of the parity space, this case corresponds to the situa-tion that the parity vector determined from the measured vector lies at the intersection of two (or more) charac-teristic subspaces. If this case occurs at the maximum failure level, then there is a singularity, and un-~higuous failure isolation only on the basis of the currently measured sensor values is not po~sible. An 216~8~
isolation decision can then possibly be made using the data of earlier processing cycles, for example ~uch that an earlier, unambiguously made isolation decision is retained, if this also delivers an acceptable consistency for the current singularity case, or additionally avail-able status information regarding the individual ~en~ors is employed to resolve singularities.
Thre~hold value dete ;n~tion:
In establishment of detection thresholds as acceptance criteria for the inconsistencies of the remaining sensor combinations at the various failure levels, referred to hereafter a~ "threshold values", account must be taken of the fact that even failure-free sensors do not deliver absolutely consistent measured data, but are affected by some inaccuracies.
These inaccuracies of the failure-free sensora establish a lower limit for the threshold values to be selected, it also being possible to take into account a safety factor in order to avoid false alarms, this safety factor being determined by the statistical distribution of the inaccuracies of failure-free sensors and the required m~x;mllm fal~e alarm rate.
An upper limit for the threshold values to be selected is given from the external accuracy requirement~
of the application, which establish which failures can still be accepted in the measured quantity to be deter-mined, or at which rate missed detection is permissible.
A prerequisite for a technically meaningful application must be that the inaccuracies of the failure-free sensor permit a sufficiently accurate determinationof the measured quantity, which is to say that the upper limit for the threshold values mu~t lie considerably above the abovementioned lower limit.
If an independent, stati~tical normal di~tribu-tion (with variance 1, to which the threshold values arethen related) is in each case assumed for the inaccura-cies of the failure-free sensors, then a Chi-square di~tribution with degree of freedom v=(n-m) results 4 ~ ~
through equation (7) for the statistical density distribution of the resulting length of the parity vector.
2VI2 ~V~
This density distribution is represented in Figure 1 for various degrees of freedom. In the case of failure-free sensors, this corre~ponds to the statistical distribution of the rPm~ining inconsistencies ~ at the various fail-ure levels. The means for each degree of freedom are re~pectively equal to the degree of freedom. The lower limits for the threshold values S3i3 for a predetermined, maximum permissible false alarm rate P are determined by ~ (13) P~ JR~
and the upper limit~ for the threshold values S3~ can, with a m~xi mllm permissible failure ~xi of the ith compo-nent of the mea~ured quantity to be determined, be estimated as Sy H~
Hi~ being the elements of the leaRt squares tran~formation matrix. Figure 2 gives the relationship between selected threshold value (in unit~ of a2 of the ~ensor inaccuracy) and the resulting false alarm probability.
Under nominal condition~, that i~ to say if the ~ensor inaccuracy of the failure-free ~ensors ha~ the assumed distribution, then the threshold value~ deter-mined in thi~ way effect the desired fal~e alarm rate and failure limit~ for the mea~ured quantity. However, under circum~tances in which (temporarily) all of the ~ensors exhibit larger inaccuracies than assumed, unde~ired failure de~ections can occur. In order to avoid thi~, the - 21~8~
threshold values can be dynamically matched to the lowest inconsistency of the highest failure level, which is to say to the inconsistency of the best sensor combination with m; n;mllm number of redundant sensors. Instead of the above-described threshold values S~, threshold values of the form Sy = n~;C[S,, ,a ~ ,t]~
are then selected, the factor a being chosen, as a function of the failure level, or of the degree of freedom, for example such that a = ~ ~ 1 The effect of this selection of the threshold value~ i~
that, even with unexpectedly high inaccuracy of all sensors, the method accept~ the best sensor combination at the latest at the maximum failure level, and even failures at the lower failure level~ are only detected when individual sensors are actually significantly le~s accurate than other~.
B. Implementation of the method In order to carry out the failure detection and isolation method, it is not generally required to evaluate respectively all sensor combination~ or sensor failure combinations. Instead of thi~, the method schema-tically represented in Figure 3 can be used.
In this case the parity vector is first deter-mined (box 1) and the consistency of the overall sensorcombination is calculated therefrom.
By comparison with a threshold value which i~
selected ~pecifically for the failure level f (here f=O), whether the con~i~tency of the overall ~en~or combination i~ acceptable i~ detected (box 2).
If 80, then all sensors are ~ufficiently failure-free and can be employed for determ;ning the measured quantity (box 3). The method is then (for the current processing cycle) terminated.
Otherwi~e, the sen~or combination~ of the failure 21~5~8~
level 1, which result from omission of one sensor in each case, are first evaluated (box 6), and the best sensor combination at this failure level is determined.
If this best sensor co-mbination is acceptable, which is to say that the r~m~;n;ng inconsistency lies below a threshold value (dependent on the failure level) (box 5), then the isolation decision can be ended with the best sensor combination at this failure level (box 10) .
Otherwise, a test is carried out a~ to whether the m~i ml~m failure level has already been reached (box 5), and if this is not the case, the method i8 continued for the next higher failure level (jump to box 4). If the m~im~lm failure level has been reached without a suffi-cient consistency having been determined in the remaining sensors at the m~imllm failure level, it is assumed that too many sensors are faulty, and, as an "emergency solution", the best sensor combination at the m~Xi mum failure level is isolated. This ca~e can only occur if the threshold values of the individual failure level are rigidly predetermined and are not dynamically matched.
In applications in which the geometry of the sensor system, and therefore also the geometry of the characteristic subspaces in the parity space, change not at all or only slowly compared to the required processing frequency, a method according to Figure 4 can be selected in order to increase the efficiency further.
After the parity vector has been determined from the sensor value~ ~box 1), the norm of the parity vector is determined, and the parity vector is suitably normali-zed (box 2). A normalization particularly suitable for the purpose required here consists in normalizing the component with the m~; mum magnitude to the value +1 by multiplication of all the components by a factor. The index of the m~;mum component serves as a first element in the table key. The remaining portion of the table key is then obtained from the remaining components of the parity vector by quantizing the re~pective value range [-1, +1] into q equal ~ections. A table formed in thi~
216S 48~
way then has, in the case of a d-~;m~n~ional parity space - and a quantization of the components into q sections, Z = d qd-l entries, which respectively code for one direction of the parity vector. This number gives an upper limit, which can be further reduced by exploiting possible applica-tion-specific symmetries in the parity space.
After the table key has been determined from the components of the parity vector (box 3), isolation information stored under this key is called up (box 4).
At each table key (direction of the parity vector), the f respective best sensor combinations are provided in order of increasing inconsistency for each failure level f.
For the detection and isolation decision (box 5), only these respective best sensor combinations are then evaluated, by projection of the parity vector onto the associated subspaces, at each failure level. In this case, the sequence of the above-described stepped method can then again be used.
Independently of whichever of these methods was used to establish the consistency of the sensor combina-tions, the sensor combination actually to be used iR then selected. Each sensor combination has its own least squares transformation matrix Nl, in which the sensors to be omitted are no longer taken into account, and the value of the quantity to be measured is given according to (2) from the measured vector.
C. Application examples Four th~r~eters In this example, the application for a part-icularly simple case is demonstrated, in which redundant sensors are used for measuring a scalar (1-dimensional) measured quantity. In this case, 4 sensors were chosen, 80 that, on the one hand, it is even possible to isolate simultaneously occurring double failures and, on the other hand, the parity space, which is three-dimension21 216~g~
in this case, still gives clear ideas regarding the geometry in the parity ~pace. Instead of the thermo-meters, mentioned here, for measuring temperature, it is naturally possible to consider any other scalar measured quantities/sensors in exactly the same way.
The relationship between the temperature and the meaRured values T~ is here given as ~T~
2 _ 1 T
_ ~T~J
Then H (1 1 1 1) and ~3 _~
1 3 1 _1 _1 _1 3 _1 _1 1 1 3 ~ 4 4 4 4 with a ~,, 1 1 1 1 _ ~ 2 2 2 2 The number of pos~ible, isolatable failure combination~
is here ~=11, and the corre~ponding co~binations, with 21~5 18~
the associated projection matrices, are given in the following table, the projection onto the sub~pace of smaller ~;m~n~ion having been chosen in each case.
Number of Faulty Pro~ectlon ~atrlces faulty sensors sensor(~
C~
C~ = ~ (1 1 1) 1 3 C~ = 1 (-1 -1 1) C~
0 2 1.2 0~ a-2 1.3 0~ a 2 1.4 0~ = 1 (1 1 0) 2 2.3 0~ 0) 2 2.4 0~ =-- tO 1 -1) 2 3.4 o,~ = ~ (1 0 1) Tab. 1: Projection matrice~ for the characteri~tic ~ub-space~ of the 4-thermometer example.
't 216~9 Figure 5 illustrates the geometrical conditions in the three-dimensional parity space for the above example with four thermometers. The four characteristic directions for individual failures in this case lie along the space diagonals (regions A) defined by the four thermometers Tl to T4. Six planes in all are spanned by these four direc-tions, and these planes correspond to the respective double failures (regions B), the respective width of the indicated "bulge" specifying the magnitude of the perm-issible establishable inaccuracies of failure-free sensors. The intersections of these planes show the singularity regions in which unambiguous double failure isolation is not possible (regions C). If the direction of the parity vector lies in the remaining regions of the represented sphere (regions D), then there is a failure in more than two thermometers, which can no longer be isolated. The width of the regions depends on the in-accuracy to be assumed for failure-free sensors. In the representation of Figure 5 only a typical region is represented, by bold interrupted bordering, for each region.
Position det~rmin~tion by measuring the pseudodistance to navigation satellite~
In this case, position determination from meas-ured "pseudodistances" is to be considered. The measure-ment equation has (here after the conventional linear-ization by a known approximated value for the position), in the case of n observed satellites, the form-s =
rS~ a~
z ~S" a a a"~ c~-~
a2 + a~ + a~, = 1 the components ~ of the measured vector characterizing the measured pseudodistances to the individual satellites, x, y, z and ~t charactsrizing the compone~ts '. . . ~16548g of the positional correction, or the failure in the receiver clock. The first 3 elements in each row in the measured matrix are respectively the direction cosine of the connecting line between the satellite and the approx-imated position.
Since, in this case, the measured matrix A
changes as a function of the respective satellite con-stellation, further procedural steps must be carried out dynamically for failure detection and isolation, which is to say calculation of the parity transformation V. In this case, however, it is substantially possible to resort to quantities determined anyway for the position determination.
In any case, the transformation matrix E = (ATA ) -lA
is determined, from which the residue matrix R can be determined by R = 1 - AE
An orthonormal set of eigenvectors of R with eigenvalue 1 can be determined from this by means of standard numerical methods, which eigenvectors, as row vectors, respectively form the rows of the matrix V The parity vector determined by P = V ~
is then projected onto the characteristic subspaces, determined by the permissible satellite combinations, and an optimally consistent satellite combination is deter-mined in the abovedescribed way. When determining the permissible satellite combinations, care should be taken to consider only such combinations with a sufficient DOP
value.
Because of the changing satellite constellation, there is no possibility of an off-line precalculation of a decision table, in which an isolation decision for all directions of the parity vector is stored. However, such a calculation can be carried out by a background task, since the satellite constellation only changes slowly.
Claims (5)
1. A method for minimizing measured quantities which are derived from sensors affected by possible measuring failures and are detected by a plurality of such redun-dant sensors connected to form a measuring system, by detecting and isolating the sensors affected by failures, wherein a) the sensor values measured by all the sensors and combined to form a measured vector are mapped by a linear transformation into a vector in a parity space (parity vector), the dimension of which space is determined by the redundance of the measuring system, which is to say by the number and/or the orientation of the sensors and the dimension of the quantity to be measured;
b) the absolute magnitude of the parity vector is determined and compared with a first detection threshold, and if this first detection threshold is not exceeded, a failure-free state is concluded, whereas, if the detection threshold is exceeded, c) the measured parity vector is projected onto all the subspaces characteristic of the possible failure states, the dimensions of which subspaces are deter-mined by the number of possible faulty sensors associated with the respective failure state, and in order to isolate the failures, it is established which projection of the parity vector onto a sub-space, respectively belonging to the relevant fail-ure determination level, provides the largest prop-ortion of the measured parity vector, d) a test is thereupon carried out as to whether the residual failure then remaining exceeds a second detection threshold, and if this second detection threshold has not been exceeded, procedural step e) is proceeded to, whereas, if this second detection threshold is exceeded, procedural steps c) and, similarly, d) are carried out again with the next failure determination level, and e) by omitting the sensor value combination belonging to the respective subspaces with the largest propor-tion of the parity vector at the relevant failure determination level, the best sensor combination is determined.
b) the absolute magnitude of the parity vector is determined and compared with a first detection threshold, and if this first detection threshold is not exceeded, a failure-free state is concluded, whereas, if the detection threshold is exceeded, c) the measured parity vector is projected onto all the subspaces characteristic of the possible failure states, the dimensions of which subspaces are deter-mined by the number of possible faulty sensors associated with the respective failure state, and in order to isolate the failures, it is established which projection of the parity vector onto a sub-space, respectively belonging to the relevant fail-ure determination level, provides the largest prop-ortion of the measured parity vector, d) a test is thereupon carried out as to whether the residual failure then remaining exceeds a second detection threshold, and if this second detection threshold has not been exceeded, procedural step e) is proceeded to, whereas, if this second detection threshold is exceeded, procedural steps c) and, similarly, d) are carried out again with the next failure determination level, and e) by omitting the sensor value combination belonging to the respective subspaces with the largest propor-tion of the parity vector at the relevant failure determination level, the best sensor combination is determined.
2. The method as claimed in claim 1, wherein the failure isolation is carried out off-line, or by back-ground processing, by calculating all possible projec-tions of the parity vectors onto the characteristic subspaces, and the result is provided stored in a table, the elements of which are employed via the correspond-ingly coded direction of the parity vector as a table key.
3. The method as claimed in claim 1 or 2, wherein the detection thresholds can be selected by external guidelines.
4. The method as claimed in one of the preceding claims, wherein at least the first detection threshold is determined by possible noise values and/or permissible inaccuracies of the sensors.
5. The method as claimed in one of the preceding claims, wherein the number of sensors is taken into account in the guidelines for the detection thresholds.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| DEP4446900.4 | 1994-12-27 | ||
| DE4446900 | 1994-12-27 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CA2165489A1 true CA2165489A1 (en) | 1996-06-28 |
Family
ID=6537322
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA002165489A Abandoned CA2165489A1 (en) | 1994-12-27 | 1995-12-18 | Fdic method for minimizing measuring failures in a measuring system comprising redundant sensors |
Country Status (5)
| Country | Link |
|---|---|
| US (1) | US5661735A (en) |
| EP (1) | EP0720004B1 (en) |
| JP (1) | JP2635952B2 (en) |
| CA (1) | CA2165489A1 (en) |
| DE (1) | DE59507817D1 (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115790670A (en) * | 2023-02-10 | 2023-03-14 | 中国科学院国家空间科学中心 | Redundant strapdown inertial measurement unit fault detection method and system |
Families Citing this family (30)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| IT1286727B1 (en) * | 1996-10-10 | 1998-07-17 | Magneti Marelli Spa | METHOD FOR THE TREATMENT OF A PLURALITY OF SIGNALS |
| US6009355A (en) * | 1997-01-28 | 1999-12-28 | American Calcar Inc. | Multimedia information and control system for automobiles |
| DE19704582A1 (en) * | 1997-02-07 | 1998-08-20 | Rollei Fototechnic Gmbh | Method for equalizing measured values or for equalizing the stress on the routes of a route network connected to one another via nodes, and route network dimensioned according to the method |
| EP0913746A3 (en) * | 1997-10-31 | 2000-04-12 | Honeywell Inc. | Sensor invalidation system |
| DE69813040T2 (en) | 1998-08-17 | 2003-10-16 | Aspen Technology Inc | METHOD AND DEVICE FOR SENSOR CONFIRMATION |
| US6594620B1 (en) | 1998-08-17 | 2003-07-15 | Aspen Technology, Inc. | Sensor validation apparatus and method |
| US6876991B1 (en) | 1999-11-08 | 2005-04-05 | Collaborative Decision Platforms, Llc. | System, method and computer program product for a collaborative decision platform |
| US6609036B1 (en) * | 2000-06-09 | 2003-08-19 | Randall L. Bickford | Surveillance system and method having parameter estimation and operating mode partitioning |
| US6917839B2 (en) * | 2000-06-09 | 2005-07-12 | Intellectual Assets Llc | Surveillance system and method having an operating mode partitioned fault classification model |
| US6598195B1 (en) * | 2000-08-21 | 2003-07-22 | General Electric Company | Sensor fault detection, isolation and accommodation |
| AT4497U3 (en) * | 2001-03-28 | 2001-12-27 | Avl List Gmbh | METHOD FOR ANALYZING AND EVALUATING MEASURED VALUES OF AN OPEN TEST SYSTEM |
| US20040088341A1 (en) * | 2001-12-12 | 2004-05-06 | Lee Susan C | Method for converting a multi-dimensional vector to a two-dimensional vector |
| US7093168B2 (en) * | 2002-01-22 | 2006-08-15 | Honeywell International, Inc. | Signal validation and arbitration system and method |
| FR2842596B1 (en) * | 2002-07-16 | 2005-06-10 | Commissariat Energie Atomique | METHOD FOR TESTING MEASUREMENT SENSOR PROPER OPERATION |
| US7451003B2 (en) * | 2004-03-04 | 2008-11-11 | Falconeer Technologies Llc | Method and system of monitoring, sensor validation and predictive fault analysis |
| FR2871949B1 (en) * | 2004-06-21 | 2006-09-01 | Renault Sas | METHOD FOR MONITORING ONE OR MORE PHYSICAL PARAMETERS AND FUEL CELL USING THE SAME |
| US20080168339A1 (en) * | 2006-12-21 | 2008-07-10 | Aquatic Informatics (139811) | System and method for automatic environmental data validation |
| US7805245B2 (en) * | 2007-04-18 | 2010-09-28 | Honeywell International Inc. | Inertial measurement unit fault detection isolation reconfiguration using parity logic |
| KR100964793B1 (en) * | 2007-05-03 | 2010-06-21 | 중앙대학교 산학협력단 | Method for detecting and isolating fault in redundant sensors, and method for accommodating fault in redundant sensors |
| US7502705B2 (en) * | 2007-05-29 | 2009-03-10 | International Business Machines Corporation | Sensor subset selection for reduced bandwidth and computation requirements |
| DE102011075545A1 (en) * | 2011-05-10 | 2012-11-15 | Robert Bosch Gmbh | Method and device for checking a sensor signal and for controlling an occupant protection means of a vehicle |
| US9261614B2 (en) * | 2012-06-18 | 2016-02-16 | Halliburton Energy Services, Inc. | Statistics-based seismic event detection |
| FR3017705B1 (en) * | 2014-02-18 | 2017-07-07 | Airbus Operations Sas | METHOD OF MELTING SENSOR DATA. |
| CN105424035B (en) * | 2015-10-30 | 2018-06-01 | 北京航天控制仪器研究所 | Inertial measurement system multisensor redundancy approach |
| US20170284903A1 (en) * | 2016-03-30 | 2017-10-05 | Sas Institute Inc. | Monitoring machine health using multiple sensors |
| US10685283B2 (en) | 2018-06-26 | 2020-06-16 | Sas Institute Inc. | Demand classification based pipeline system for time-series data forecasting |
| US10560313B2 (en) | 2018-06-26 | 2020-02-11 | Sas Institute Inc. | Pipeline system for time-series data forecasting |
| US20210247753A1 (en) * | 2020-02-07 | 2021-08-12 | Kabushiki Kaisha Yaskawa Denki | State estimation device, system, and manufacturing method |
| CN113324505B (en) * | 2021-04-23 | 2022-06-14 | 上海卫星工程研究所 | Method and system for judging consistency of displacement sensors between double-super-satellite cabins |
| CN113189968B (en) * | 2021-05-08 | 2022-08-26 | 哈尔滨工业大学 | Distributed fault diagnosis method for interconnected industrial process |
Family Cites Families (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US4472806A (en) * | 1982-05-03 | 1984-09-18 | The Boeing Company | Signal selection and fault detection apparatus |
| US4580234A (en) * | 1982-08-02 | 1986-04-01 | Nippon Business Consultant Co., Ltd. | Measurement system of enhanced reliability |
| US4772445A (en) * | 1985-12-23 | 1988-09-20 | Electric Power Research Institute | System for determining DC drift and noise level using parity-space validation |
| FI896219A0 (en) * | 1989-04-28 | 1989-12-22 | Antti Aarne Ilmari Lange | ANALYZING AND FOUNDATION CALIBRATION AV DETEKTORSYSTEM. |
| DE3929404A1 (en) * | 1989-09-05 | 1991-03-07 | Bodenseewerk Geraetetech | METHOD AND DEVICE FOR DETECTING AND IDENTIFYING ERRORS ON SENSORS |
| DE4100501A1 (en) * | 1991-01-10 | 1992-07-16 | Bodenseewerk Geraetetech | Detecting and identifying faults at sensors for state values - using association matrix giving optimal relationship between characteristic vectors and associated classification vectors |
| JPH05281199A (en) * | 1992-03-31 | 1993-10-29 | Nuclear Fuel Ind Ltd | Flaw-detection data evaluation device and method |
| DE4244014A1 (en) * | 1992-12-24 | 1994-07-07 | Bodenseewerk Geraetetech | Detection and identification of sensor errors e.g. for aircraft controller |
| US5479161A (en) * | 1994-03-25 | 1995-12-26 | Honeywell Inc. | Automatic calibration of redundant sensors |
-
1995
- 1995-11-14 DE DE59507817T patent/DE59507817D1/en not_active Expired - Fee Related
- 1995-11-14 EP EP95117943A patent/EP0720004B1/en not_active Expired - Lifetime
- 1995-12-18 CA CA002165489A patent/CA2165489A1/en not_active Abandoned
- 1995-12-26 US US08/578,840 patent/US5661735A/en not_active Expired - Fee Related
- 1995-12-27 JP JP7341848A patent/JP2635952B2/en not_active Expired - Lifetime
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115790670A (en) * | 2023-02-10 | 2023-03-14 | 中国科学院国家空间科学中心 | Redundant strapdown inertial measurement unit fault detection method and system |
| CN115790670B (en) * | 2023-02-10 | 2023-05-05 | 中国科学院国家空间科学中心 | Redundant strapdown inertial measurement unit fault detection method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| EP0720004A2 (en) | 1996-07-03 |
| EP0720004A3 (en) | 1996-08-07 |
| JP2635952B2 (en) | 1997-07-30 |
| JPH08233620A (en) | 1996-09-13 |
| DE59507817D1 (en) | 2000-03-23 |
| US5661735A (en) | 1997-08-26 |
| EP0720004B1 (en) | 2000-02-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2165489A1 (en) | Fdic method for minimizing measuring failures in a measuring system comprising redundant sensors | |
| US5357449A (en) | Combining estimates using fuzzy sets | |
| Hseuh et al. | Performance modeling based on real data: a case study | |
| Gertler et al. | A new structural framework for parity equation-based failure detection and isolation | |
| Basseville et al. | Statistical model-based damage detection and localization: subspace-based residuals and damage-to-noise sensitivity ratios | |
| EP1055239B1 (en) | Ultrasensitive surveillance of sensors and processes | |
| EP0632353A1 (en) | System and method for measuring the operation of a device | |
| Rank et al. | Norm based design of fault detectors | |
| JP4528335B2 (en) | Sensor performance verification apparatus and method | |
| Wünnenberg et al. | Dynamic model based incipient fault detection concept for robots | |
| Su et al. | Intelligent prognostics system design and implementation | |
| EP0227479A2 (en) | System for determining DC drift and noise level using parity-space signal validation | |
| Ray et al. | Fault detection and isolation in a nuclear reactor | |
| RU2126903C1 (en) | Pickup failure detection and object condition checking method | |
| Hayward et al. | Efficient collision prediction among many moving objects | |
| CN112380073B (en) | Fault position detection method and device and readable storage medium | |
| Keller et al. | Fault detection of multiple biases or process leaks in linear steady state systems | |
| Patton et al. | A robust parity space approach to fault diagnosis based on optimal eigenstructure assignment | |
| Soika | Grid based fault detection and calibration of sensors on mobile robots | |
| Lee et al. | Uncertainty self-management with perception net based geometric data fusion | |
| Lefebvre et al. | Online statistical model recognition and state estimation for autonomous compliant motion | |
| Polenta et al. | Microcomputer-based fault detection using redundant sensors | |
| Caglioti | An entropic criterion for minimum uncertainty sensing in recognition and localization. I. Theoretical and conceptual aspects | |
| Guidorzi et al. | Structural monitoring of the Tower of the Faculty of Engineering in Bologna using MEMS-based sensing | |
| Chen et al. | Robust statistical process monitoring |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| FZDE | Discontinued |