Inertial reference unit and system with enhanced integrity and associated integrity verification method

Abstract

The present invention relates to an inertial reference unit (URI), comprising: a first measurement channel (V1), comprising: a first high-performance inertial measurement unit (UMI1), comprising a first measurement unit for measuring specific force and a first measurement unit for measuring angular velocity, a first calculation unit (CPU1), which can calculate pure inertial data based on the measurement values ​​of the first measurement unit; a second measurement channel (V2), comprising: a second inertial measurement unit (UMI2), which has a lower performance than the first inertial measurement unit (UMI1), comprising a second measurement unit for measuring specific force unit and a second measuring unit for measuring angular velocity; a second calculation unit (CPU2), which is capable of calculating pure inertial data based on the measurement values ​​of the second measuring unit; an integrity check function (CTR), which is capable of implementing a method for checking the integrity of the data of the first measurement channel (V1) based on the data provided by the second measurement channel (V2); a synchronization unit, which is used to synchronize the measurement values ​​of the first inertial measurement unit and the measurement values ​​of the second inertial measurement unit; the first inertial measurement unit and the second inertial measurement unit are mechanically fixedly installed in the inertial reference unit (URI).

Description

Technical Field

[0001] The present invention relates to the field of assisting in piloting and / or navigating aircraft having electric flight controls, and more particularly to the field of civil aviation.

[0002] More particularly, the invention relates to supplying inertial reference units and inertial reference systems for aircraft having electronic flight controls and to verifying the integrity of said units and said systems. Background Art

[0003] To fly and / or navigate an aircraft, it is necessary to know certain flight parameters of the aircraft. The flight parameters of the aircraft include, among other things, ground-related parameters (or inertial references) and may also include air-related parameters (or air references).

[0004] The ground-related flight parameters may include altitude, attitude (roll, pitch, heading), acceleration, speed (especially angular velocity), etc.

[0005] The determination unit for determining flight parameters relative to the ground comprises an inertial unit, also denoted "inertial reference system" or simply "inertial system". An inertial reference system may be denoted by the acronym "IRS". An IRS comprises one or more inertial reference units, each denoted by the acronym "IRU" or "URI". An IRU comprises an inertial measurement unit (denoted by the acronym "IMU" or "UMI") and an associated computer and sometimes a display. An IMU comprises inertial sensors, typically gyrometers and accelerometers.

[0006] Air-related flight parameters may include air speed, Mach number, vertical speed, static pressure, total pressure, air temperature, etc.

[0007] The determination unit for determining air-related flight parameters comprises wind and air pressure sensors and an associated computer, the assembly forming an Air Data Unit or "ADU".

[0008] Inertial units that can also determine air-related flight parameters are called "ADIRS", an acronym for "Air Data Inertial Reference System". The corresponding inertial reference unit is denoted "ADIRU", an acronym for "Air Data Inertial Reference Unit".

[0009] The determined flight parameters are sent to a user device on board the aircraft, such as a control unit for controlling an engine or a tail, and / or a display system for displaying the flight parameters, for example in a cockpit of the aircraft.

[0010] For reasons of operational safety of the aircraft, it is recommended that flight parameters are determined and displayed by both at least one primary inertial reference unit (which may be indicated as "primary unit" throughout this specification) and at least one backup inertial reference unit (which may also be indicated as "auxiliary inertial reference unit" or simply "auxiliary unit"). The auxiliary unit may provide redundancy for the primary unit and is used in particular in the event of a failure of the primary unit. In order to enhance operational safety of the aircraft, the primary unit and the auxiliary unit are preferably not identical. The term "not identical" refers to units that perform the same function but are different (e.g. different design, different hardware, etc.).

[0011] The backup inertial reference unit usually has a lower performance level than the primary unit.

[0012] The performance class (or performance level) of an inertial reference unit is defined according to the accuracy level of the equipment (at least the sensors) forming the unit, ie the accuracy level of the measurements achieved by said equipment.

[0013] The primary inertial reference unit usually consists of a dedicated housing in which sensors as well as a computer and sometimes a display are arranged. These sensors form a high-performance inertial measurement unit (IMU) capable of calculating and displaying flight parameters to the pilot and doing so in a manner that allows said pilot to safely fly the aircraft (in the so-called normal mode).

[0014] A standby inertial reference unit is typically an item of autonomous electronic equipment, which may be denoted using the term "standby" or the acronym "IESI" for "Integrated Electronic Standby Instrument". Such an instrument typically comprises a dedicated housing in which sensors, a computer and sometimes a display screen are arranged. In the same manner as the primary unit, the standby inertial reference unit may display flight parameters and potentially some other data independently of the primary unit, but delivers these data in a more summarized manner and with lower accuracy than the primary unit. In the event of a failure of the primary unit, the pilot uses the data displayed on the standby unit to fly the aircraft. The display typically follows the same layout as the primary unit.

[0015] The avionics architecture of aircraft with electric flight controls is typically based on one of the architectures known as "triplex" or "quadruplex", or on variations of these architectures.

[0016] Figure 1 The triad architecture shown in is a system that includes three main units (A) and one or two auxiliary units (B or C), where the main units (A) have a high performance level and are identical from a hardware and software perspective, and the auxiliary units (B or C) are typically AHRUs (from the term "Attitude and Heading Reference Unit"), which have a lower performance level than the main units and are different from the three main units.

[0017] Figure 2 The quadruplex architecture shown in is a system based on two first main units (A1) having a high performance level and two second main units (A2), the first main unit (A1) having a performance level lower than the two first main units but sufficient to supply the flight controls, or having an equivalent performance level. The two second main units are preferably different from the two first main units. The quadruplex architecture may include one or two auxiliary units (B or C), which are typically AHRUS with a performance level lower than the first and second main units.

[0018] Although, from the point of view of completeness and continuity, both triplex and quadruplex architectures provide substantially the same features in their nominal configuration, i.e., as long as no equipment declares itself faulty, some differences arise in the case of an aircraft taking off under "MMEL", i.e., when it is detected that an item of equipment has already failed, and then a new fault arises during flight and the faulty equipment's built-in test module (also called "BIT" (standing for "Built-In Test")) does not detect this fault. This second type of undetected fault is called "Undetected Error Data" and may be denoted "UED".

[0019] In the case of a three-way architecture, since takeoff is performed under MMEL, there are now only two main units A. If a UED failure occurs in one of the two remaining units A, it is not known how to distinguish which of the two units has failed. In other words, it is not known how to vote between the two units A. The flight control abandons the normal driving law and then switches to the direct driving law, that is, the pilot must use the information provided by one or more backup units (B or C) and displayed on the instrument panel to resume driving in manual mode. In addition, this architecture cannot detect common mode failures of the three main units (or common mode failures of two main units under MMEL).

[0020] In the case of a quadruple architecture, takeoff at MMEL is less punitive, since there are still three main units able to supply the flight controls (A1 and 2 A2s or 1 A2 and 2 A1s). Therefore, in the case of a failure affecting only one of the three main units, the faulty unit can be easily detected and excluded, typically by means of an attitude consistency check. On the other hand, in the case of a second failure, this leads to the same problems as in the case of a first failure at MMEL in a triplex architecture.

[0021] When there are two main units of different types, the quadruplex architecture can better detect common mode failures of the main units. On the other hand, in the event of a common mode failure, it is not possible to choose which main unit is reliable. In particular, if there is a difference between the first main unit A1 and the second main unit A2, it ends up with a 2-to-2 vote without being able to determine which unit is reliable. The flight control abandons the normal driving law and switches to direct driving law, i.e. the pilot must use the information provided by one or more backup units (B or C) to resume driving in manual mode.

[0022] Additionally, if there is no difference between the first main unit A1 and the second main unit A2, a common mode fault cannot be detected, which corresponds to the same situation in the triplex architecture.

[0023] Therefore, the tri-plex or quad-plex architecture provides limited availability of the primary inertial information required for normal flight control modes.

[0024] Some solutions have been proposed in order to improve the reliability of aircraft piloting and / or navigation assistance systems, which are described below.

[0025] Patent US5297052 relates to an inertial reference and air data system comprising built-in redundancy for preventing system failure in the event of failure of one or more components forming the system. The system comprises a redundant main unit (IRU or ADIRU) on the one hand and a spare unit on the other hand. The solution in the patent involves achieving redundancy in the main unit by increasing the number of high-performance sensors in the IRU or ADIRU (typically 6 accelerometers and 6 gyroscopes and 4 processor circuits operating in parallel). The processor circuit processes and compares the outputs of the gyroscopes and accelerometers and sends these outputs to 3 voting circuits. The solution in patent US5297052 is to increase the number of high-performance sensors, thereby significantly increasing the price, weight and volume of the system.

[0026] Patent application US2010152929 describes an aircraft inertial system comprising: at least two inertial reference units (IRUs) providing a first inertial signal data set; and at least two attitude and heading reference units (AHRUs) which are lower performance backup units providing a second inertial signal data set; a primary flight display receiving the first inertial signal data set and the second inertial signal data set; and a backup flight display receiving at least the second inertial signal data set. During operation, at least some of the inertial signal data from the at least two AHRUs are compared with the inertial signal data provided by the at least two IRUs. When a single failure occurs, the primary flight display continues to operate with operational redundancy on at least three units of the IRU and the AHRU, and the backup flight display operates using units other than the primary flight display. Since the AHRU is indicated to be different from the IRU, but the IRUs are not different from each other and the AHRUs are not different from each other, there is a risk of common mode failure despite the redundancy. In fact, the system is similar to a quadruple system, but in which the main unit A2 is replaced by an auxiliary unit. Therefore, the system retains the same disadvantages. Additionally, patent application US2010152929 is mainly directed to the display of data in the event of a failure. Therefore, the pilot turns to direct driving law. Finally, the data compared is the attitude. However, since the attitude provided by the AHRU may show very large errors, the comparison threshold must be high.

[0027] Patent application US20080262729 relates to a method for implementing a fault-tolerant avionics architecture, the architecture comprising three or four non-fault-tolerant inertial measurement units (i.e., high-performance inertial measurement units) and a backup inertial measurement unit, all of which are physically separate but all coupled to a processor. Each high-performance inertial measurement unit comprises a triplet of accelerometers and / or gyroscopes, i.e., three accelerometers and / or three gyroscopes. The processor is capable of detecting a first fault of the high-performance inertial measurement unit based on a threshold value calculated based on expected performance during a parity check, and then detecting a second fault, the processor is capable of suspending the operation of the failed inertial measurement unit, and then causing the backup inertial measurement unit to operate with the high-performance inertial measurement unit that has not failed to continue tracking the vehicle. The processor can continue to use the parity check logic to monitor the functionality of the system. The parity check method includes comparing the measurements from redundant sensors (in this case, the redundant sensors between various high-performance inertial measurement units), and applying a mathematical formula to the differences between the measurements (typically adding the squares of the differences), and then checking whether the result of the formula follows the typical noise probability law. If the result does not follow the expected law, a fault or deviation is inferred. In this patent application, the number of sensor triplets is increased, thereby increasing the price, weight and volume of the system. In addition, the parity check method is not the most efficient method for comparing high-performance inertial measurement units and backup inertial measurement units in this architecture. Finally, the calculation is performed under the assumption that the aircraft supporting the inertial measurement unit is strong enough to not cause any significant difference in the speed detected at various positions of the inertial measurement unit. Therefore, this imposes constraints on the aircraft. If the above assumptions are not true, it is required to increase the parity check error detection threshold.

[0028] Patent FR3038048 describes an inertial measurement system for an aircraft, comprising: an inertial unit of a first type, comprising at least three angle sensors and three linear sensors, aligned on three separate sensitive axes; an inertial unit of a second type, comprising at least four angle sensors and four linear sensors, aligned on four separate sensitive axes, the second unit being configured to be able to autonomously self-monitor (particularly in the absence of the first unit); and a processing unit connected to these units. The system is designed to calculate inertial data items from three angle sensors and three linear sensors of the first inertial unit in a conventional manner. Additionally, according to the second unit, four inertial data items can be obtained from four separate combinations of three angle sensors and three linear sensors selected from the sensors of the inertial unit of the second type, the processing unit being designed to compare the four inertial data items with each other in order to determine whether the inertial unit of the second type has failed. In this patent application, the number of sensors is increased, thereby significantly increasing the price, weight and volume of the system. Additionally, there is no aspect of handling processor failures; in other words, if there is a processor failure, no redundant processor is able to take over. More generally, the system described in patent FR3038048 does not take into account common mode faults, among other things.

[0029] One object of the present invention is to propose an avionics system for assisting the piloting and / or navigation of an aircraft with electric flight controls which makes it possible to improve the verification of the integrity of the flight parameters provided.

[0030] More specifically, the present invention aims to more accurately and faster identify failures of and / or drifts on a primary inertial reference unit.Accordingly, the present invention aims to provide an inertial reference unit that is able to perform self-monitoring.

[0031] Additionally, for a system comprising a plurality of inertial reference units, the invention aims to determine one or more defective inertial reference units (and conversely, one or more reliable inertial reference units), and even to correct for failures and / or drifts of one or more defective inertial reference units. In particular, the invention aims to prevent the electric flight control from switching to direct mode.

[0032] Another object of the present invention is to avoid common mode failures on the inertial reference unit and / or the avionics system.

[0033] It would be advantageous for the present invention to achieve these objectives without complicating, overburdening, and / or increasing the cost of the inertial reference unit and, therefore, without complicating, overburdening, and / or increasing the cost of the avionics system. Summary of the invention

[0034] A first subject of the invention relates to an inertial reference unit for providing and monitoring flight parameters of an aircraft, comprising:

[0035] - A first measurement channel comprising:

[0036] a first high-performance inertial measurement unit comprising a first measurement unit for measuring specific force and a first measurement unit for measuring angular velocity, and

[0037] a first computing unit coupled to the first inertial measurement unit and comprising a first inertial processing function capable of computing pure inertial data based on the measurements of the first measurement unit;

[0038] - A second measurement channel comprising:

[0039] a second inertial measurement unit having a performance lower than that of the first inertial measurement unit and comprising a second measurement unit for measuring specific force and a second measurement unit for measuring angular velocity, and

[0040] a second calculation unit coupled to the second inertial measurement unit and comprising a second inertial processing module capable of calculating pure inertial data based on the measurements of the second measurement unit;

[0041] an integrity checking function enabling implementation of a method for checking the integrity of the data of the first measurement channel based on the data provided by the second measurement channel; and

[0042] a synchronization unit for synchronizing the measurement values ​​of the first inertial measurement unit with the measurement values ​​of the second inertial measurement unit;

[0043] The first inertial measurement unit and the second inertial measurement unit are mechanically mounted fixedly to one another in the inertial reference unit.

[0044] According to an advantageous embodiment, the inertial reference unit further comprises a supply unit for providing vertical information to the integrity check function, and the integrity check function is capable of implementing a method for checking the integrity of the data of the first measurement channel based on the data provided by the second measurement channel and based on said vertical information. This enables improved integrity checking, in particular detection of low amplitude gyroscope failures.

[0045] According to a specific embodiment, the vertical information provided is a vertical position, a vertical velocity or a vertical acceleration.

[0046] According to one embodiment, the second inertial measurement unit has medium performance or low performance, preferably low performance.

[0047] According to one embodiment, the first and second measuring units for measuring the specific force comprise accelerometers, preferably one accelerometer per axis.

[0048] According to one embodiment, the first measuring unit and the second measuring unit for measuring the angular velocity comprise gyroscopes, preferably one gyroscope per axis.

[0049] According to one embodiment, the first measuring channel comprises a first power supply unit and the second measuring channel further comprises a second power supply unit.

[0050] The second subject of the invention relates to a method for verifying the integrity of an inertial reference unit according to the first subject of the invention, and more specifically to a method for verifying the integrity of a first measurement channel of an inertial reference unit, said method being implemented in an integrity verification function to verify the integrity of said inertial reference unit and comprising the following steps:

[0051] - a first step of providing consolidated inertial data items originating from a second measurement channel;

[0052] - a second step of determining a first comparison value between the inertial data item originating from the first measurement channel and the reinforced inertial data item originating from the second measurement channel;

[0053] - A third step of comparing the first comparison value with a first threshold value, a value greater than said first threshold value enabling detection of a lack of integrity of the first measurement channel.

[0054] A data item is said to be “hardened” when it has been verified, in particular when a measuring unit used to deliver the data item performs self-monitoring, and / or when it has been corrected.

[0055] According to one embodiment, the method further comprises the step of synchronizing the measurements between the first measurement unit and the second measurement unit of the inertial reference unit.

[0056] According to one embodiment, the method further comprises a preliminary self-monitoring step in a static alignment mode of the first inertial measurement unit and / or the second inertial measurement unit in order to provide reinforced inertial data items originating from the second measurement channel.

[0057] Self-monitoring in static alignment mode is a method known to those skilled in the art. However, provision is made for this preliminary self-monitoring step in static alignment mode to use the fact that the aircraft is at rest, by integrating the sensor increments (accelerometers and gyrometers) in this state of the aircraft in order to infer therefrom the velocity, and this velocity (which should be zero) represents the error of the sensors. For example, using the knowledge (a priori information) of the maximum error limit of the sensors (typically by means of a Kalman filter), the maximum error limit of the velocity can be estimated and compared with the measured velocity. If this measured velocity exceeds a threshold value found using a Kalman filter, the drift of the inertial unit can be inferred therefrom.

[0058] According to one embodiment, the first step comprises a step of correcting the inertial data items originating from the second measurement channel in order to obtain reinforced inertial data items.

[0059] According to a particular embodiment, the correction step is performed using the inertial data items originating from the first measurement channel, for example by applying a first filter to the difference between the inertial data items originating from the second measurement channel and the inertial data items originating from the first measurement channel, said correction step being offset in time with respect to the second step. Such a step of correcting the inertial data items originating from the second measurement channel is preferably performed before the second determination step.

[0060] According to a particular embodiment, the correction step comprises a step of removing a bias from the inertial data item originating from the second measurement channel, said bias being constant within a given bias time, the second step being performed within said bias time.

[0061] According to a particular embodiment, the first comparison value is obtained by applying a second filter to the difference between the corrected inertial data item originating from the second measurement channel and the inertial data item originating from the first measurement channel, the period of the filter being less than the deviation time; and the third step consists in comparing the result of the second filter with a first threshold value.

[0062] According to one embodiment, the compared inertial data items are attitude, angular velocity, specific force and / or acceleration data.

[0063] According to one embodiment, the method further comprises:

[0064] - a fourth step of determining a second comparison value between: the vertical acceleration calculated based on the inertial data originating from the first measurement channel and vertical information provided to the integrity check function, such as a measured vertical position or a measured vertical velocity, said vertical information being previously converted into a vertical acceleration or a measured vertical acceleration; and

[0065] - A fifth step of comparing the second comparison value with a second threshold value, a value greater than said second threshold value enabling detection of a lack of integrity.

[0066] According to a particular embodiment, the second comparison value is obtained by applying a third filter to the difference between the calculated vertical acceleration and the vertical acceleration derived from the vertical information; and the fifth comparison step consists in comparing the result of the third filter with a second threshold.

[0067] A third subject of the invention is an avionics system for assisting the piloting and / or navigation of an aircraft, comprising: at least two inertial reference units according to the first subject of the invention and at least one comparison computer capable of comparing an inertial data item delivered by a first inertial reference unit with an inertial data item delivered by a second inertial reference unit.

[0068] According to one embodiment, the system comprises: three inertial reference units according to the first subject-matter of the invention.

[0069] According to another embodiment, the system comprises two inertial reference units according to the first subject matter of the invention and two further inertial reference units.

[0070] According to one embodiment, the system further comprises: a measuring unit for measuring vertical information, for example, a barometric altimeter, a radio altimeter, a vertical accelerometer, a vertical velocity detector.

[0071] A fourth subject of the invention is a method for verifying the integrity of an avionics system, and more specifically a method for verifying the integrity of an inertial reference unit, said method comprising:

[0072] a first step of comparing an inertial data item delivered by a first inertial reference unit with an inertial data item delivered by a second inertial reference unit in order to determine a malfunction of the inertial reference unit; and, if the first step does not allow for the identification of a malfunctioning inertial reference unit, performing the following operations:

[0073] - implementing the second step of the integrity verification method according to the second subject matter of the invention for at least one inertial reference unit according to the first subject matter of the invention.

[0074] A data item is defined as the value of a parameter delivered at time t. Thus, a purely inertial data item is the value of one of the following parameters delivered at time t: attitude (heading, roll, pitch), angular velocity, specific force, acceleration, velocity, position, etc. When two data items are compared to each other, a person skilled in the art will understand that this involves comparing two data items of the same parameter or comparing two data items of two parameters, at least one of which is suitable for comparison with the other.

[0075] According to the present invention, an inertial measurement unit has high performance if it can provide an attitude with an error less than or equal to 0.2°, medium performance if it can provide an attitude with an error greater than 0.2° and less than 1°, and low performance if it provides an attitude with an attitude error greater than or equal to 1° (e.g., between 2° and 5°). A high performance inertial reference unit is able to find its heading autonomously.

[0076] The principle of the invention is that within the same inertial reference unit, an auxiliary inertial measurement unit with lower performance than a high performance primary inertial measurement unit can monitor the primary inertial measurement unit, the auxiliary inertial measurement unit possibly using vertical information measured external to the inertial measurement unit in addition. The inertial reference unit comprises a calibration function adapted to perform this monitoring. Thus, the inertial reference unit can perform self-monitoring.

[0077] Unlike solutions in which the inertial system includes a (high-performance) primary inertial reference unit and a (medium-performance or low-performance) auxiliary inertial reference unit that can monitor each other, the present invention can provide a high-performance inertial reference unit that can perform self-monitoring, which has the advantages of reduced size, weight and cost.

[0078] The invention consists in combining high performance sensors with low performance (and therefore less expensive and less heavy) sensors in the same inertial reference unit, or even in using other sensors and / or data available in the aircraft, and the verification function consists in carrying out appropriate processing of the data delivered by the sensors and / or data available for monitoring the main inertial measurement unit.

[0079] The verification function may be parameterized to ensure that faults and / or drifts can be detected and identified before the attitude reaches the maximum limit requested by the operator (typically a few degrees).

[0080] Another advantage of the inertial reference unit according to the invention is that it can provide the inertial data that is usually provided by an IESI (Integrated Electronic Standby Instrument) standby inertial reference unit. This can therefore eliminate the inertial part of the IESI. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Other characteristics and advantages of the invention will become apparent from the following description given by way of non-limiting illustration with reference to the accompanying drawings, in which:

[0082] [ Figure 1 ] shows a known "triplex" avionics architecture;

[0083] [ Figure 2 ] shows a known "quadruplex" avionics architecture;

[0084] [ Figure 3 ] shows an example of an inertial reference unit according to the present invention;

[0085] [ Figure 4 ] shows an algorithm for calibrating an inertial reference unit according to the present invention;

[0086] [ Figure 5A ]and[ Figure 5B ] shows that Figure 4 Two examples of time parameters defined in the verification algorithm;

[0087] [ Figure 6 ] is a curve depicting the vertical deviation as a function of time;

[0088] [ Figure 7 ] is a curve depicting the attitude error when detecting angular velocity drift;

[0089] [ Figure 8 ] shows a first example of an avionics system according to the invention comprising three inertial reference units;

[0090] [ Fig. 9 ] shows a second example of an avionics system comprising two inertial reference units according to the invention and two further inertial reference units. DETAILED DESCRIPTION

[0091] Figure 1 and Figure 2 This has been described further above and will not be repeated here.

[0092] The present invention relates to an inertial reference unit for providing and monitoring flight parameters of an aircraft.

[0093] Figure 3 An example of an inertial reference unit according to the invention is shown.

[0094] The inertial reference unit shown is denoted as URI, which consists of:

[0095] - A first measurement channel V1 comprising:

[0096] a first high-performance inertial measurement unit UMI1, comprising a first measurement unit for measuring specific force and a first measurement unit for measuring angular velocity;

[0097] a first computing unit CPU1 coupled to the first inertial measurement unit and comprising a first inertial processing function IP1 capable of calculating pure inertial data based on the information of the first measurement unit, and

[0098] - a first power supply unit PSU1 capable of receiving at least two power supply inputs, for example two 28V inputs (a main power supply and a standby or "backup" power supply);

[0099] - A second measurement channel V2 comprising:

[0100] a second inertial measurement unit UMI2 having a lower performance than the first inertial measurement unit (e.g., having a medium performance or a low performance), and the second inertial measurement unit UMI2 includes a second measurement unit for measuring specific force and a second measurement unit for measuring angular velocity;

[0101] a second computing unit CPU2 coupled to the second inertial measurement unit and comprising a second inertial processing function IP2 capable of calculating pure inertial data based on the information of the second measurement unit, and

[0102] a second power supply unit PSU2 capable of receiving at least two power supply inputs, for example two 28 V inputs (a main power supply and a standby or “backup” power supply);

[0103] an integrity checking function CTR capable of implementing a method for checking the integrity of the first inertial measurement channel V1 based on the inertial data and possibly the vertical information provided by the second measurement channel V2 ; and

[0104] - a supply unit for providing vertical information to the integrity check function CTR;

[0105] The first inertial measurement unit and the second inertial measurement unit are mounted mechanically fixed to each other in the inertial reference unit so as to measure the same movements.

[0106] The inertial reference unit further includes: a synchronization unit for synchronizing the measurement value of the first inertial measurement unit and the measurement value of the second inertial measurement unit, which may be a calculation block installed in the first calculation unit or the second calculation unit, or implemented in a calibration function.

[0107] In particular, the integrity check function CTR can implement a method for checking the integrity of the first inertial measurement unit UMI1 .

[0108] In the example shown, the inertial reference unit comprises a housing, and the first inertial measurement unit and the second inertial measurement unit are mechanically fixedly mounted in the housing.

[0109] The first inertial processing function IP1 (respectively the second inertial processing function IP2 ) is installed in the first computing unit CPU1 (respectively the second computing unit CPU2 ).

[0110] In the example shown, the integrity check function CTR is installed in the housing of the inertial reference unit URI, and more specifically, the integrity check function CTR is installed in the second computing unit CPU2. In particular, considering that the integrity check function must provide integrity information of the first measurement channel V1, it is desirable that the integrity check function CTR is not installed in the measurement channel to be checked.

[0111] As an alternative, the first integrity check function can be installed in the first computing unit CPU1 and the second check function can be installed in the second computing unit CPU2. The first integrity check function and the second integrity check function can communicate with each other. This also makes it possible to check for potential faults of the computer CPU2 when a fault has been detected on the first inertial measurement channel.

[0112] More generally, an inertial reference unit URI may include multiple integrity checking functions that are able to communicate with each other.

[0113] The first calculation unit and the second calculation unit may be embedded cards comprising a microprocessor.In particular, the selection of the first calculation unit (robustness, integrity, resolution, etc.) is preferably based on the performance of the first measurement unit.

[0114] The first computing unit and the second computing unit, and in particular the first inertial processing function and the second inertial processing function, are preferably different.

[0115] The vertical information may be the vertical position, the vertical velocity or the vertical acceleration. Among the sensors capable of measuring this information, mention may be made of a barometric altimeter, a radio altimeter, a vertically accurate accelerometer and a vertical velocity probe. Such sensors are usually not arranged in the inertial reference unit, but are positioned at suitable locations on the aircraft. If the inertial reference unit is an ADIRU (i.e. with aerodynamic data), such sensors are coupled to the inertial reference unit.

[0116] The supply unit for providing the vertical information is for example an ARINC429 or ARINC664 link or a specific bus. Said supply unit designated for providing the vertical information is a transmission unit for sending said information to the integrity check function CTR and thus forms part of the URI of the inertial reference unit. The supply unit should be distinguished from the measurement unit for measuring this information (e.g. the sensor described above), which is usually not integrated into the URI.

[0117] Preferably, the vertical information is considered to be reinforced upstream, ie the vertical information can be used without the need for calibration.

[0118] Before using the provided data, the second inertial measurement unit preferably has performed a self-monitoring, in particular in alignment mode. The self-monitoring is advantageously performed when the aircraft is stationary, typically on the ground.

[0119] Likewise, the first inertial measurement unit has preferably already performed self-monitoring beforehand.In particular, information that the aircraft is stationary can be sent to the second inertial measurement unit, thereby allowing the second inertial measurement unit to initiate its self-monitoring.

[0120] Furthermore, since the supply unit is capable of providing the vertical information, the first measurement unit and the second measurement unit are generally not identical, so common mode failures are avoided. Moreover, additionally, the probability of an equipment item having at least two failures simultaneously in the vertical information, the first inertial measurement unit and the second inertial measurement unit is very low and less than the expected probability of an undetected failure.

[0121] In the example shown, each inertial measurement unit includes three accelerometer sensors that provide specific force and three gyrometer sensors that provide angular velocity. As an alternative, the sensors may be gyroscopes instead of gyrometers.

[0122] According to the example shown, the flows between units and / or functions are as follows:

[0123] - Flow 1 (between UMI1 and IP1): UMI1 clock, UMI1 gyrometer increments, UMI1 accelerometer increments, gyrometer status information and UMI1 accelerometer increments;

[0124] - Flow 2 (between UMI2 and IP2): UMI2 clock, UMI2 gyrometer increments, UMI2 accelerometer increments, gyrometer status information, and UMI2 accelerometer increments;

[0125] - Stream 3 (between IP1 and CTR): pure inertial data of the first measurement channel, in particular attitude (roll R1, pitch T1, heading C1), specific force, angular velocity, estimated gravity, Coriolis force calculated in IP1 based on the data sent in stream 1;

[0126] - Stream 4 (at the output of IP1 to the aircraft's user equipment): pure inertial data of the first measurement channel, in particular the attitude (roll R1, pitch T1, heading C1) calculated in IP1 based on the data sent in stream 1 and which must be identical to the attitude C1, R1, T1 sent in stream 3;

[0127] Stream 5 (at the output of IP2 to CTR): pure inertial data of the second measurement channel, in particular attitude (roll R2, pitch T2, possibly heading C2), specific forces, angular velocities calculated in IP2 based on the data sent in stream 2;

[0128] - Stream 6 (to CTR): transmission of vertical information;

[0129] Stream 7 (at the output of the CTR): Purely inertial data of the first measurement channel V1 and the reinforcement state sent by the calibration function CTR, pure inertial data of the second measurement channel V2 .

[0130] Flows flow between units and / or functions (e.g., Arinc 429 or Arinc 664 links or specific buses).

[0131] The user equipment is, for example, a control unit for controlling an engine or a tail, a display system for displaying flight parameters, for example in the cockpit of an aircraft, or other inertial reference units.

[0132] The data associated with the stream preferably contains a digital data checking mechanism, such as a CRC (standing for "CyclicRedundancy Code"). Although there are units other than CRC for digitally checking the data (e.g., checksums), the abbreviated term CRC will be used to represent this checking. The CRC can be performed on a group of data or on each data item obtained individually. If the CRC does not match the data, the user will invalidate the data. This enables checking whether the data items on the link are corrupted.

[0133] Data can also be functionally invalidated. For example, if the calculated specific force exceeds a reasonable threshold, the specific force can be invalidated. Each data item has validity, and in particular, the data item can be invalidated by a CRC check, but also by other checks.

[0134] The invention also relates to a method for checking the integrity of a first measurement channel of an inertial reference unit, two examples of which are given below. The integrity checking method may be in the form of an algorithm. For this reason, Figure 4 The method shown in may be referred to as a "verification algorithm" hereinafter.

[0135] The integrity check function CTR enables the implementation of a method according to the invention for checking the integrity of a first measurement channel of an inertial reference unit, in particular for checking the integrity of a first inertial measurement unit.

[0136] More specifically, the integrity check function can implement an integrity check method, which includes the following steps:

[0137] - a first step of providing consolidated inertial data items originating from a second measurement channel;

[0138] - a second step of determining a first comparison value between the inertial data item originating from the first measurement channel and the reinforced inertial data item originating from the second measurement channel;

[0139] - A third step of comparing the first comparison value with a first threshold value, a value greater than said first threshold value enabling detection of a lack of integrity of the first measurement channel.

[0140] Description of a first example of a verification algorithm (M2).

[0141] The input to the described verification algorithm is as follows:

[0142] - attitude (heading C1, roll R1, pitch T1) calculated by IP1 and appearing in stream 3;

[0143] - the specific force measured by UMI1, denoted as Fa1, Fb1, Fc1 (along the three axes of UMI1) and present in stream 3;

[0144] - Estimated gravity GRAV: This can be associated with the position estimated by IP1 and appears in stream 3;

[0145] - Possible Coriolis force F Coriolis ;

[0146] - vertical information, e.g. height or vertical position, denoted Zb, provided in stream 6;

[0147] - angular velocity measured by UMI1, denoted as Va1, Vb1, Vc1 (along the three axes of UMI1) and provided by IP1 in stream 3;

[0148] - the specific forces measured by UMI2 and provided by IP2 in flow 5 (their projections in the reference frame of UMI1 are denoted Fa2, Fb2, Fc2);

[0149] - Angular velocities measured by UMI2 and provided in stream 5 by IP2 (their projections in the reference frame of UMI1 are denoted Va2, Vb2, Vc2).

[0150] The projections of the angular velocity and the specific force measured by UMI2 in the geometrical reference system of UMI1 can be performed in the second calculation unit CPU2 or in the calibration function CTR (in this case they are not input data), or in another suitable function. These projections are possible and reliable since the two measurement units UMI1 and UMI2 are mechanically fixedly mounted in the URI and therefore there are no deformations between the measurement units.

[0151] Gravity GRAV can be estimated based on the position provided by IP1 using known and public models (Somigliana, Cassinis, Jeffreys, Welmec, etc. models). Gravity GRAV is preferably calculated in IP1. As an alternative, gravity GRAV can be calculated in the verification function CTR (in this case, gravity GRAV is not an input data item), which requires providing the verification function with the position provided by the first calculation unit, or calculating gravity GRAV in another suitable function.

[0152] Each data item is preferably provided with a validity index, such as "YES" (valid), "NO" (invalid), or "WITHOUT" (no index provided).

[0153] The output of the verification algorithm (stream 7) is as follows:

[0154] - Purely inertial data of the first measurement channel, including at least the attitude (heading C1, roll R1, pitch T1) provided together with its validity index (the same data as appearing in stream 4);

[0155] - The calibration status of the pure inertial data of the first measurement channel, for example: "OK", "KO" or "Not completed";

[0156] - Purely inertial data of the second measurement channel, including at least the attitude (roll R2, pitch T2, possibly heading C2) provided together with an index of its validity (the same data as appearing in stream 5).

[0157] If a data item is provided with an invalidity index, the reinforcement status is preferably identified as "not completed".

[0158] The proposed checksum algorithm (denoted as M2) is formed by two independent blocks M21 and M22, which are executed in each cycle of computing the input data. cycle The period can be on the order of a few milliseconds, for example, 10 ms.

[0159] The first block M21 detects a high amplitude gyro tester failure on UMI. The second block M22 detects a low amplitude gyro tester failure on UMI1.

[0160] Description of the first M21:

[0161] The first block has as input data the angular velocities of the first and second measurement channels, ie, Val, Vb1, Vc1 and Va2, Vb2, Vc2.

[0162] The calculation principle of the first block M21 is described for the angular velocities (Va1 and Va2) of the two measurement channels given along axis a, since it is known that the calculation must be reproduced identically for the angular velocities along axis b (Vb1, Vb2) and along axis c (Vc1, Vc2).

[0163] Testing is also performed on accelerometers, for example using the same calculations as described below. However, it should be noted that gyroscopes can quickly lead to attitude errors. For accelerometers, (threshold) monitoring of the order of a few milligrams (mg) (e.g., 10 mg) is sufficient.

[0164] Since Va2 is an angular velocity provided by a medium or low performance sensor, Va2 has a bias. In the example described, using a low performance sensor (gyrometer), the estimated bias is of the order of 100° / h, evolving with a time constant of the order of 300 s.

[0165] The first block includes the first step of removing bias.

[0166] The deviation of Va2 (expressed as B Va2 ) is calculated by implementing the first filter FT1 on the difference between Va2 and Va1, namely:

[0167] [Mathematical formula 1]

[0168] B Va2 = FT1(Va2-Va1)

[0169] The first filter is a low pass filter, for example, with a cut-off frequency ensuring convergence of the order of 100 s.

[0170] The first block then comprises a second step of applying a second filter to the signal Zc(t) corresponding to the following difference:

[0171] [Mathematical formula 2]

[0172] Zc (t) = Va2(t) - Va1(t) - B Va2 (t-Tb)

[0173] Where Tb is the deviation time.

[0174] The second filter FT2 is implemented in a time period τ as follows:

[0175] [Mathematical formula 3]

[0176]

[0177] It provides a filtered value of Zc(t), ie, Zcf(t).

[0178] The deviation time Tb is a time interval during which the deviation of the low-performance sensor is constant. The deviation time Tb must be greater than the filtering period τ. Specifically, since the filter is implemented within the period τ, at least the filtering period τ is required to detect the error of the angular velocity Va1, and the deviation B during the filtering period is Va2 The measured value must be constant.

[0179] The drift detected on Val(t) after filtering represents an attitude error equal to said drift multiplied by the filtering period. For a drift of 200° / h and a filtering period τ of 50 s, the detected error is 2.7°.

[0180] If reference Figure 5A , then the deviation B is calculated in each calculation cycle t Va2 (t). The signal Zc(t) is also based on Va1(t), Va2(t) and on the stored value of the deviation at time t-Tb (ie, B Va2 (t-Tb)). If a detectable fault occurs at time t, it will be detected at time t+τ. Therefore, the deviation B calculated based on the angular velocity Va1(t-Tb) Va2 (t-Tb) must be valid from t to t+τ (i.e., estimated based on measurements that have not yet failed). Therefore, Va1 must be valid from t-Tb to t-Tb+τ. Therefore, it is necessary to locate t-Tb+τ before t (when the fault occurs) such that:

[0181] [Mathematical formula 4]

[0182] t-Tb+τ<t

[0183] Therefore, the calculation described above is valid if:

[0184] [Mathematical formula 5]

[0185] Tb>τ

[0186] On the other hand, if the deviation time is smaller than the filtering period, this will result in Figure 5B The situation in which the calculation described above is no longer valid.

[0187] Additionally, if Figure 5A In the case that the deviation time Tb is chosen too high relative to the effective change in the deviation, the calculation described above may no longer be valid.

[0188] The filtering period τ is of the order of tens of seconds in order to filter out noise. The filtering period τ must be less than the deviation time. The larger Tb is, the more likely it is to increase the filtering value τ and thus have an accurate detection threshold. However, the value of Tb is related to the instability of the sensor of the second inertial measurement unit, which is usually related to temperature changes. Therefore, the greater the thermal inertia, the more the value of Tb can be increased.

[0189] Preferably, a unit for increasing the thermal inertia of the second inertial measurement unit may be added. For example, an inertial mass may be added to the second measurement unit or it may be thermally stabilized.

[0190] This calibration algorithm can only be implemented if the two measuring units are mechanically fixed to each other in order to measure the same movement and the same deformation.

[0191] Furthermore, it is necessary that the data are as synchronized as possible in order to be able to be compared with one another efficiently (ideally, the measurements should be performed simultaneously, which is difficult to achieve). In order to synchronize the data as much as possible, it is advantageous if the first measuring unit and the second measuring unit are in the same housing.

[0192] Preferably, a step of synchronizing the measured values ​​between the first measuring unit and the second measuring unit is added. For example, the clocks of the first measuring unit and the second measuring unit may be synchronized.

[0193] The first block comprises a third step of comparing Zcf(t) with a first threshold S1 in order to verify whether the value is less than the threshold (in which case the second block M22 described further below verifies validity) or greater than said threshold (and therefore invalid):

[0194] [Mathematical formula 6]

[0195]

[0196] Here, S1 is the first threshold expressed in ° / h.

[0197] S1 is, for example, equal to 200° / h or equal to a value close to 200° / h.

[0198] The first threshold value also corresponds to the usage restriction of the first block M21. Below this threshold value, the second block M22 is allowed to be checked.

[0199] Description of the second M22:

[0200] The second block has Fa1, Fb1, Fc1, C1, R1, T1, Grav, Zb, and possibly F Coriolis As input data. In the example considered, the vertical information Zb is the vertical position.

[0201] The second block comprises a first step of determining the vertical acceleration, calculated in a terrestrial geographic reference system, based on the inertial data of the first measurement channel (at least specific force and attitude), based on the gravity determined at the location, or even based on the Coriolis force. The calculated vertical acceleration (denoted AccZb) is determined, for example, using the following formula:

[0202] [Mathematical formula 7]

[0203]

[0204] Therein, Tgb(C1, R1, T1) is the rotation matrix used to move from the reference system of the first measurement unit IMU1 to the terrestrial geographic reference system using the three attitudes C1, R1, T1 originating from the first measurement channel.

[0205] The rotation matrix Tgb(C1, R1, T1) can be determined in the second block M22, thus in the check function CTR. As an alternative, the rotation matrix Tgb(C1, R1, T1) can be determined in the second calculation unit CPU2 outside the check function, assuming that the distribution of the flow 3 is adapted accordingly.

[0206] The second block comprises a second step of comparison between the calculated vertical acceleration AccZb and the vertical information Zb.

[0207] To this end, the calculated vertical acceleration AccZb and the twice-derived vertical position Zb are filtered by a third low-pass filter FT3 (eg, a third-order low-pass filter) and compared to infer the vertical deviation B therefrom. Zb .

[0208] The Laplace transform can be used to represent the filtering. The vertical deviation B is then determined using the following formula Zb :

[0209] [Mathematical formula 8]

[0210] B Zb =FT3(acczb-p 2 .Zb)

[0211] Among them, p 2 .Zb represents the calculation of acceleration based on the vertical information Zb.

[0212] In the example considered, Zb is the position and is therefore differentiated twice (p 2 ).

[0213] As an alternative, Zb can be the vertical velocity and differentiated once: In this case, consider p.Zr instead of p 2 .Zr

[0214] As an alternative, Zb can be the acceleration, and in this case, it is not differentiated, and Zr is considered instead of p 2 .Zr.

[0215] The third filter FT3 can be expressed as follows:

[0216] [Mathematical formula 9]

[0217]

[0218] The coefficients G1 , G2 and G3 of the third filter make it possible to adjust the passband of said third filter.

[0219] The second block comprises a third step of comparing the vertical deviation BZb with a second threshold value S2.

[0220] The second threshold S2 preferably takes into account the following:

[0221] - a scaling factor and a bias of UMI1, the sum of which may be reduced to 350 μg; and / or

[0222] - Gravity anomalies, the sum of which may be set to 500 μg; and / or

[0223] - Errors associated with the Zb measurements reduced to μg (through correlation between altitude and gravity changes), the sum of which can be set to 600 μg.

[0224] Therefore, the second threshold S2 may be set to 1.5 mg. The second threshold S2 may be set lower or higher around this value. The second threshold S2 may be neither too low to avoid false alarms nor too high to avoid detecting a fault or drift too late.

[0225] By way of example, if the angular velocity drift d is equal to 200° / h on the sensor, resulting in a roll error R1, and if the heading C1 and pitch T1 are assumed to be zero, the roll error is equal to: [Mathematical Formula 10]

[0226] R1=d×t

[0227] Here, t is the time required to detect the error.

[0228] It is also assumed that the plane is actually horizontal, so the specific force F1 (Fa1, Fb1, Fc1) is equal to: [Mathematical formula 11]

[0229]

[0230] The calculated vertical acceleration is given by:

[0231] [Mathematical formula 12]

[0232]

[0233] And the rotation matrix is ​​given by:

[0234] [Mathematical formula 13]

[0235]

[0236] Finally, assuming the vertical position Zb is fixed, this gives:

[0237] [Mathematical formula 14]

[0238] p 2 .Zb=0

[0239] And the velocity is zero, so the Coriolis force is zero. So the calculated vertical acceleration is given by:

[0240] [Mathematical formula 15]

[0241] AccZb=-cos(R1)gray+grav

[0242] And the vertical deviation is given by:

[0243] [Mathematical formula 16]

[0244] B Zb =F(-cos(R1)grav+grav)

[0245] If the vertical deviation B Zb (in mg) plotted as a function of time, we get Figure 6 For example, it can be seen that B Zb It took about 95 seconds to exceed 1.5 mg. After 95 seconds, the roll error will be equal to:

[0246] [Mathematical formula 17]

[0247]

[0248] If now, with the second threshold value S2 equal to 1.5 mg, the drift d of the angular velocity changes, then the attitude error ("angular error") in degrees can be determined when the drift d ("drift error") in degrees per hour is detected, as Figure 7 As shown in the curve.

[0249] It can therefore be seen that with a threshold of 1.5 mg, an angular velocity error of 200° / h can be detected, resulting in a maximum attitude error of 5.3°.

[0250] The first block M2 and the second block M22 of the algorithm are implemented in parallel, so these two blocks can detect the entire angular velocity error range, depending on whether it is less than a first threshold or greater than or equal to said first threshold.

[0251] In addition, certain parameters of the algorithm, such as the first threshold S1, the second threshold S2 and the filtering period τ, can also be set so that the posture error during detection does not exceed a certain posture error limit, as shown above (2.7° for the first block and 5.3° for the second block).

[0252] The verification algorithm M2 outputs the status of integrity, incompleteness or incomplete verification, which can be, for example:

[0253] - Incomplete or "KO" if one of the thresholds for M21 or M22 is exceeded;

[0254] - Complete or "OK" if neither of the thresholds for M21 and M22 are exceeded;

[0255] - Not Completed if verification could not be performed (for example, if the data item is invalid).

[0256] The verification algorithm has the advantages of being simple to implement and fast. The verification algorithm uses information and data that are usually already present in the aircraft, while not implementing any complex calculations. As indicated above, the verification algorithm also makes it possible not to exceed the limit attitude error by cleverly setting certain parameters of the algorithm. This makes it possible to guarantee to the operator that the presence of a fault can be identified before the attitude error reaches the imposed limit.

[0257] Finally, to verify the calculations performed by the first calculation unit, the second calculation unit will reproduce the calculation of the attitude in the current cycle of the first measurement channel using the attitude from the previous calculation cycle and the angular velocity in the current calculation cycle (all provided via stream 3). The attitude in the current cycle of the first measurement channel is then compared with the attitude reproduced by the second calculation channel. The comparison threshold is equal to the accuracy of the calculation units of the two channels.

[0258] Description of the Second Example of the Verification Algorithm

[0259] An alternative to the first example of the two-block algorithm presented above is an algorithm that calculates the pose of the plane in the same way in the first and second calculation units IP1 and IP2, based on the data provided by the first and second measurement units UMI1 and UMI2. The pose is then compared with a threshold, in particular taking into account the asynchrony between the pose calculations. The difference in the calculated pose is only due to a sensor defect, which can therefore be identified.

[0260] This algorithm does not require any vertical information.

[0261] Such an algorithm may be affected by biases in the second measurement unit, which can be removed upstream of the algorithm using a method similar to the steps proposed above for removing biases from the first block.

[0262] However, a disadvantage of this algorithm is that an application must be developed for calculating the attitude in both computing units, since the attitude calculations performed for high-performance inertial measurement units and those performed for medium-performance and low-performance inertial measurement units are generally different.

[0263] In both exemplary algorithms, more generally, as opposed to three gyroscopes and three accelerometers, a single gyroscope and a single accelerometer may be used in the second measurement unit UMI2 by placing the gyroscope on a trisection of the gyroscopes of the first measurement unit UMI1 and the accelerometer on a trisection of the accelerometers of the first measurement unit UMI1. This makes it possible to save sensors and allows a lighter weight and volume of the second measurement unit. One disadvantage is that a failure of the two gyroscopes or the two accelerometers on UMI1 may not be seen by the gyroscope or accelerometer of UMI2. Furthermore, since only a projection of the failure is visible, this generally requires raising the threshold, resulting in the failure being detected later, which therefore makes the verification function less sensitive. Furthermore, in this case, the second measurement unit is no longer able to provide inertial information as a substitute for a dedicated backup device (IESI or backup device).

[0264] The invention also relates to an avionics system for assisting the piloting and / or navigation of an aircraft, comprising a plurality of inertial reference units according to the invention.

[0265] Figure 8 and Fig. 9 Two examples of avionics systems comprising a plurality of inertial reference units according to the invention are shown. Additionally, comparison calculations are performed between the inertial reference units of the system.

[0266] In both exemplary avionics systems, generally, the comparison calculations between the inertial reference units may be performed in one or more computers or by one or more functions within a computer. Additionally, the comparison calculations may be implemented within the inertial reference unit or in a system external to the inertial reference unit. An advantage of performing the comparison calculations within the inertial reference unit is that it allows for reinforcement at the source. An advantage of performing the comparison calculations externally is that it avoids linking between inertial reference units and also facilitates avoiding common mode failures between inertial reference units that are identical to one another. In the remainder of the specification (corresponding to Figure 8 and Fig. 9), a single comparison computer (denoted CC) for each system is considered, which is arranged outside the inertial reference unit.

[0267] Figure 8 A first example of an avionics system comprising three inertial reference units (denoted URI1 , URI2 , URI3 ) and at least one comparison computer CC according to the invention is shown.

[0268] Each inertial reference unit URI1, URI2, URI3 comprises a first measurement channel V1-1, V1-2, V1-3, which comprises:

[0269] - first high performance measurement units UMI1-1, UMI1-2, UMI1-3,

[0270] - a first computing unit CPU1-1, CPU1-2, CPU1-3, comprising a first inertial processing function IP1-1, IP1-2, IP1-3;

[0271] - A first power supply unit PSU1-1, PSU1-2, PSU1-3.

[0272] Each reference unit URI1, URI2, URI3 further comprises a second measurement channel V2-1, V2-2, V2-3, wherein the second measurement channel V2-1, V2-2, V2-3 comprises:

[0273] - second medium performance or low performance measurement units UMI2-1, UMI2-2, UMI2-3;

[0274] - a second computing unit CPU2-1, CPU2-2, CPU2-3, comprising a second inertial processing function IP2-1, IP2-2, IP2-3;

[0275] -Integrity check functions CTR1, CTR2, CTR3;

[0276] - Second power supply units PSU2-1, PSU2-2, PSU2-3.

[0277] Each reference unit further comprises a supply unit for providing vertical information to the integrity check function.

[0278] For URI1, the gestures provided by the first computation unit (in flow 4) are denoted C11, R11 and T11; for URI2, these gestures are denoted C12, R12 and T12; and for URI3, these gestures are denoted C13, R13 and T13. All data are provided with their validity and CRC.

[0279] For URI1, the gestures provided by the second computation unit (in flow 5) are denoted C21, R21 and T21; for URI2, these gestures are denoted C22, R22 and T22; and for URI3, these gestures are denoted C23, R23 and T23. All data are provided with their validity and CRC.

[0280] Stream 7 contains data from streams 4 and 5 and the status of the check function (hardening status). Streams 4 and 7 are directed to the aircraft's user equipment.

[0281] The user equipment items may be electronic flight controls, autopilots, flight management systems, cockpit displays or other inertial reference units, etc.

[0282] When three inertial reference units are available, the comparison computer CC performs a mutual comparison ("cross check") between the attitude data (in particular the heading data C11, C12 and C13, the roll data R11, R12 and R13, and the pitch data T11, T12 and T13). This is sufficient to determine whether an inertial reference unit has failed (assuming a single failure).

[0283] The cross-check is preferably performed using multiple comparison computers in order to ensure redundancy.

[0284] An example of a cross-check is described below, which takes into account the heading, knowing that this example also applies to roll and pitch (the defined thresholds will not necessarily be the same). The heading data provided by the three inertial reference units URI1, URI2, URI3 (data via the first measurement channel, i.e. the high performance measurement channel) are therefore compared with each other and it is checked whether one of the following inequalities exists.

[0285] [Mathematical formula.18]

[0286] |C1j-C1k| C and |C1j-C1i|>S C and |C1k-C1i|>S C

[0287] wherein i, j, and k have different values ​​from each other and may each be equal to 1, 2, or 3, and wherein S C is the heading threshold.

[0288] In the case indicated in formula Mathematical formula .18, from URI i The data is invalidated at the output.

[0289] ​When only two inertial reference units are available, a failure can still be detected by consolidating the data from the two available units, but it is no longer known how to vote to determine which unit has failed. In this case, one or more of the calibration functions CTR1, CTR2, CTR3 can be used to determine which inertial reference unit has failed. In the worst scenario, control is returned to the pilot (direct mode) who can use the output calculated from the second inertial measurement unit UMI2-1, UMI2-2, UMI2-3.

[0290] Fig. 9 A second example of an avionics system is shown comprising two inertial reference units URI1 and URI2 according to the invention and two inertial reference units URI4 and URI5 of different design. There are thus two pairs of non-identical inertial reference units, thereby avoiding common mode failures between them.

[0291] For example, using the same calculations as the first exemplary system, the postures C11, R11, T11 and C12, R12, T12 from the two inertial reference units URI1 and URI2 according to the present invention are compared with the postures C4, R4, T4 and C5, R5, T5 from the other two inertial reference units URI4 and URI5.

[0292] In the event that there is an inconsistency in one of the two types of inertial reference units, data from the type of inertial reference unit that does not exhibit any inconsistency is used.

[0293] In case of a disagreement between the two types, one or more of the verification functions CTR1 , CTR2 may be used in order to determine which inertial reference unit according to the invention has failed.

[0294] Unless otherwise indicated, the various embodiments may be combined with each other.

[0295] Additionally, it should be understood that other embodiments may be used, especially logical modifications may be made. Furthermore, unless otherwise indicated, the embodiments presented in the detailed description should not be interpreted as limiting the order of the steps.

[0296] The present invention is applicable to civil aviation.

Claims

1. An inertial reference unit (URI) for providing and monitoring flight parameters of an aircraft, comprising: - A first measurement channel (V1) comprising: a first high-performance inertial measurement unit (UMI1) comprising a first measurement unit for measuring specific force and a first measurement unit for measuring angular velocity, and a first computing unit (CPU1) coupled to said first high-performance inertial measurement unit (UMI1) and comprising a first inertial processing function (IP1) capable of calculating pure inertial data based on the measurements of said first high-performance inertial measurement unit; - A second measurement channel (V2) comprising: a second inertial measurement unit (UMI2) having a performance lower than that of said first high-performance inertial measurement unit (UMI1) and comprising a second measurement unit for measuring specific force and a second measurement unit for measuring angular velocity, and - a second computing unit (CPU2) coupled to the second inertial measurement unit (UMI2) and comprising a second inertial processing module (IP2) capable of calculating pure inertial data based on the measurements of the second inertial measurement unit; an integrity checking function (CTR) capable of implementing a method for checking the integrity of the data of the first measurement channel (V1) based on the data provided by the second measurement channel (V2); and a synchronization unit for synchronizing the measurement values ​​of the first high-performance inertial measurement unit with the measurement values ​​of the second inertial measurement unit; The first high-performance inertial measurement unit and the second inertial measurement unit are mechanically fixed to each other in the inertial reference unit (URI).

2. The inertial reference unit of claim 1 , further comprising: A supply unit for providing vertical information to the integrity check function (CTR), the integrity check function (CTR) being able to implement a method for checking the integrity of the data of the first measurement channel (V1) based on the data provided by the second measurement channel (V2) and based on the vertical information.

3. An inertial reference unit according to claim 2, wherein the vertical information provided is a vertical position, a vertical velocity or a vertical acceleration.

4. An inertial reference unit according to one of claims 1 to 3, the second inertial measurement unit (UMI2) having medium performance or low performance. 5 . The inertial reference unit according to claim 1 , the first and second measurement units for measuring specific forces comprising accelerometers.

6. An inertial reference unit as claimed in claim 5, the accelerometers comprising one accelerometer per axis.

7. The inertial reference unit according to one of claims 1 to 3, the first measuring unit and the second measuring unit for measuring angular velocity comprising gyrometers.

8. An inertial reference unit as claimed in claim 7, the gyrometers comprising one gyrometer per axis.

9. The inertial reference unit according to one of claims 1 to 3, the first measurement channel (V1) further comprising a first power supply unit (PSU1) and the second measurement channel (V2) further comprising a second power supply unit (PSU2).

10. A method for verifying the integrity of a selected first measurement channel (V1) of an inertial reference unit (URI) according to one of claims 1 to 9, said method being implemented in said integrity verification function (CTR) to verify the integrity of said inertial reference unit and comprising the following steps: - a first step of providing consolidated inertial data items originating from said second measurement channel (V2); - a second step of determining a first comparison value between an inertial data item originating from said first measurement channel (V1) and a reinforced inertial data item originating from said second measurement channel (V2); as well as - A third step of comparing said first comparison value with a first threshold value (S1), a value greater than said first threshold value enabling detection of a lack of integrity.

11. The method according to claim 10, further comprising: The step of synchronizing measurements between the first high performance inertial measurement unit and the second inertial measurement unit of the inertial reference unit.

12. The method according to one of claims 10 and 11, further comprising: A preliminary self-monitoring step in a static alignment mode of the first high performance inertial measurement unit and / or the second inertial measurement unit.

13. The method according to one of claims 10 and 11, the first step comprising: A step of correcting the inertial data items originating from said second measurement channel (V2) in order to obtain reinforced inertial data items.

14. Method according to claim 13, the correction step being carried out using inertial data items originating from the first measurement channel (V1), the correction step being offset in time with respect to the second step.

15. Method according to claim 14, the correction step being performed by applying a first filter (FT1) to the difference between the inertial data items originating from the second measurement channel (V2) and the inertial data items originating from the first measurement channel (V1). The method according to claim 14 , wherein the correcting step precedes the second step.

17. The method according to claim 13, wherein the correction step comprises: A step of removing a bias from an inertial data item originating from said second measurement channel (V2), said bias being constant within a given bias time (Tb), said second step being performed within said bias time (Tb).

18. The method according to claim 17, wherein the first comparison value is obtained by applying a second filter (FT2) to the difference between the corrected inertial data item originating from the second measurement channel (V2) and the inertial data item originating from the first measurement channel (V1), the period (τ) of the second filter being smaller than the deviation time (Tb); and The third step consists in comparing the result of the second filter (FT2) with the first threshold (S1).

19. The method of claim 11, wherein the compared inertial data items are attitude, angular velocity, specific force and / or acceleration data.

20. The method according to claim 11, comprising: - a fourth step of determining a second comparison value between: the vertical acceleration calculated based on inertial data originating from said first measurement channel (V1) and the vertical information supplied to said integrity check function (CTR); as well as - A fifth step of comparing said second comparison value with a second threshold value (S2), a value greater than said second threshold value enabling detection of a lack of integrity.

21. The method according to claim 20, wherein: The vertical information is a measured vertical position or a measured vertical velocity, the vertical information being converted into a vertical acceleration in advance; or The vertical information is the measured vertical acceleration.

22. The method according to claim 21, wherein the second comparison value is obtained by applying a third filter (FT3) to the difference between the calculated vertical acceleration and the vertical acceleration derived from the vertical information; - and said fifth step consists in comparing the result of said third filter (FT3) with said second threshold (S2).

23. An avionics system for assisting the piloting and / or navigation of an aircraft, comprising: At least two selected inertial reference units (URI1, URI2) according to one of claims 1 to 9 and at least one comparison computer (CC) capable of comparing inertial data items delivered by the first inertial reference unit with inertial data items delivered by the second inertial reference unit.

24. The avionics system of claim 23, comprising: Three selected inertial reference units (URI1, URI2, URI3) according to one of claims 1 to 9.

25. The avionics system of claim 23, comprising: Two selected inertial reference units (URI1, URI2) according to one of claims 1 to 9 and two further inertial reference units (URI4, URI5).

26. An avionics system according to one of claims 23 to 25, comprising: The unit of measurement used to measure vertical information.

27. The avionics system of claim 26, wherein the measuring unit comprises a barometric altimeter, a radio altimeter, a vertical accelerometer, or a vertical velocity probe.

28. A method for verifying the integrity of an avionics system according to one of claims 23 to 27, comprising: a first step of comparing an inertial data item delivered by a first inertial reference unit with an inertial data item delivered by a second inertial reference unit in order to determine a malfunction of the inertial reference unit; and, if said first step does not allow for the identification of a malfunctioning inertial reference unit, performing the following operations: - implementing the second step of the method according to one of claims 10 to 22 for at least one inertial reference unit according to one of claims 1 to 9.

Images