METHOD FOR DETECTING MALFUNCTIONS IN INERTITAL MEASURING UNITS

Description

[0001] The invention relates to a method for detecting malfunctions in inertial measuring units according to claim 1. Background of the invention

[0002] Inertial measurement units (IMUs) are arrangements of accelerometers and gyroscopes used to measure the specific forces (accelerations) and rotational velocities of bodies in space. The term "Specific Forces" and the symbol "f" have also become established in German navigation literature for accelerometer signals (see reference 2). Gyroscope signals are referred to as "ω" in the following. The term "inertial measurement unit" is represented by the abbreviation "IMU" in the following. Inertial measurement units are used to determine the attitude, position, and speed of vehicles, particularly in automated driving. Examples of such applications of the IMU can be found in references (3) to (6), or also in US 9,753,144 B1 (DE 10 2017 102 269 A1).

[0003] In Figure 1The application of an inertial measurement unit 1 for motion estimation and navigation according to the prior art is shown as an example. The inertial measurement unit 1 transmits angular velocity signals from the gyroscopes and the specific force signals from the accelerometers. In a sensor fusion unit 2, motion variables, such as attitude angle α, velocity v, and / or position P, are calculated by integrating these variables and corrected with the aid of additional sensors 3, such as odometers, magnetometers, barometric altimeters, and / or GNSS receivers. A Kalman filter is used for sensor fusion in the prior art.

[0004] Inertial measurement units are available in various quality levels. The quality and price are primarily determined by the sensor technology used. For series applications in automobiles, inexpensive sensors based on MEMS technology (micro-electromechanical sensors) are particularly suitable. The accuracy of such inexpensive IMU sensors is limited by stochastic sensor noise and systematic errors, such as bias, sensitivity errors, nonlinearities, and alignment errors. Such errors are properties that the sensors exhibit during normal operation. Systematic errors must be determined and compensated using suitable methods in order to achieve a high quality of the calculated motion variables. Examples of compensation methods can be found in the specialist literature or in DE 10 2017 102 269 A1. The stochastic and systematic errors of an IMU sensor can be described by a model. For example,the value measured by the sensor . f in a specific force through the model f im = 1 + s fi ⋅ c i T f → i + b fi t + ν i describe, where fi is the vector of the actual specific force components at the measurement location. The size b fi ( t ) describes a constant or slowly time-varying bias, the size s fi is the sensitivity error of the sensor, the size vi denotes the sensor noise and the vector c i T Describes the orientation of the sensor axis in the reference coordinate system. The model parameters can be determined using estimation methods.

[0005] In contrast to stochastic and systematic errors, IMU sensors can also experience malfunctions (or faults). In this case, the sensor loses the specified (and thus predetermined by design) relationship between the physical measured variable and the output sensor signal, resulting in unspecified measurement behavior. This renders the affected IMU sensor unusable.

[0006] Malfunctions in the sensors that propagate undetected into the motion calculation or navigation can lead to significant errors or grossly incorrect values ​​in the useful signals and therefore represent a safety risk in safety-relevant applications.

[0007] For safety-critical applications such as automated driving, sensor malfunctions must be detected. The respective error must then be eliminated from the navigation solution, and a backup solution must be switched to ensure the system continues to function fully (fault-tolerant system).

[0008] This particularly applies to malfunctions of sensors in the inertial measurement unit.

[0009] The solution proposed according to the invention is described in Figure 2 shown: Other state-of-the-art solutions are discussed below. State of the art

[0010] US 9,568,321 B2 describes the detection of malfunctions in a single IMU without redundancy. The detection is integrated into a doubly redundant navigation system (Inertial Navigation System, INS) in the form of a health monitoring block. The estimation errors occurring during motion estimation are evaluated in the health monitoring block. This solution has the disadvantage that the effects on a navigation system caused by sensor malfunctions do not allow direct conclusions to be drawn about the defective sensor element. Furthermore, the integration of the IMU signals used in the INS leads to long error detection times. Furthermore, error detection is based on the use of additional sensors, such as GNSS, magnetometers, barometers, and odometers. These sensors are generally more susceptible to errors and have lower integrity than the IMU sensors.In the proposed setup, malfunctions of these additional sensors cannot be clearly distinguished from IMU malfunctions. In summary, it can be concluded that the described approach allows the detection of a malfunction but not the identification of the defective sensor. This would be a basic prerequisite for fault-tolerant system behavior.

[0011] The disadvantages of the approach described above have long been known. Further explanations can be found, for example, in (3), Chapter 17. There, the necessity of redundant hardware in safety-critical INS applications is explicitly emphasized.

[0012] The use of redundant inertial measurement units (IMUs) is state-of-the-art in aeronautical technology. High-performance inertial measurement units with identical characteristics are combined to form a redundant sensor configuration. For example, an Air Data Inertial Reference Unit (ADIRU) is known in this regard, in which six accelerometers and six angular velocity sensors are arranged in a non-orthogonal geometry, achieving maximum redundancy with a minimum number of sensors (see references 1, 2).

[0013] For example, for the six Specific Force signals of the accelerometer f 1 , ..., f 6 a regression equation is solved to obtain a resulting vector of the orthogonal components [ fx , fy , fz ] of the Specific Force: f 1 ⋮ f 6 = M ⋅ f x f y f z + ν where M is a matrix describing the sensor geometry and v is a vector of sensor noise.

[0014] Monitoring and averaging can be performed in parallel while the regression equation is being solved. Up to two accelerometers can fail in the system without causing a reduction in performance. For functional safety reasons, at least four sensors must be available.

[0015] Another solution using two INSs, whose respective inertial measurement units are rotated by 60° relative to each other, is proposed in US 5,184,304 A. In this solution, the output error statistics of the two systems are compared, thereby identifying the defective sensor.

[0016] Sensors qualified for aviation, especially in non-orthogonal arrangements, require a lot of installation space and are poorly suited for installation in automobiles due to their packaging.

[0017] In automotive applications, which are much more cost-sensitive, the use of such redundant, high-quality inertial sensors is also not economically feasible.

[0018] A proposal for the application of MEMS sensors in a multiple redundant arrangement can be found in US Pat. No. 8,825,436 B2. Here, the multiple arrangement serves only to reduce measurement noise and systematic sensor errors (run-to-run bias and temperature-dependent bias). A strategy for detecting and eliminating sensor malfunctions is not considered.

[0019] In (6), an inertial measurement unit for automotive applications with triple redundancy is described. However, this has the disadvantage that it is built into a single component and thus is not sufficiently protected against power supply problems and common-cause faults.

[0020] Also known from the literature (see Reference 2) are master-slave arrangements of inertial measurement units or navigation systems. The basic idea is to estimate parameters of the slave system, such as orientation angles, offsets, etc., based on the navigation data of the master system using a Kalman filter. The corresponding process is called transfer alignment. This method is typically used in weapon systems that incorporate low-cost navigation systems, while a guidance system or carrier incorporates a high-quality navigation system.

[0021] In A. Kohn et al.: "Fail-operational in safety-related automotive multi-core systems", 10th IEEE International Symposium on Industrial Embedded Systems (SIES), 2015, pp. 1-4, T. Ishigooka, S. Honda and H. Takada: "Cost-Effective Redundancy Approach for Fail Operational Autonomous Driving System", 2018 IEEE 21st International Symposium on Real-Time Distributed Computing (ISORC), 2018, pp. 107-115, M. Li and L. Eckstein: "Fail-Operational Steer-By-Wire System for Autonomous Vehicles", 2019 IEEE International Conference on Vehicular Electronics and Safety (ICVES), 2019, pp. 1-6, und T. Schmid et al.: "A Safety Argumentation for Fail-Operational Automotive Systems in Compliance with ISO 26262",2019 4th International Conference on System Reliability and Safety (ICSRS), 2019, pp. 484-493 werden verschiedene Konzepte für die Fehlertoleranz redundanter Inertialmesseinheiten beschrieben.

[0022] EP 3 006 901 A1 describes systems and methods for generating two independent different attitude solutions, two independent different inertial solutions or both from an improved navigation device.In one embodiment, an avionics system comprises: an inertial navigation device configured to generate a first set of attitude solutions; an attitude and reference unit configured to generate a primary set of attitude solutions and a secondary set of attitude solutions; and a display device configured to receive the first set of attitude solutions, the primary set of attitude solutions, and the secondary set of attitude solutions, wherein, if the first set of attitude solutions and the primary set of attitude solutions produce different results, the display device is configured to determine whether the first set of attitude solutions or the primary set of attitude solutions is correct by detecting differences between the attitude solutions and determining which difference is below a threshold.

[0023] CN 105 550 053 B describes a redundancy management method for improving the availability of a fault-tolerant system based on monitoring pairs. The method comprises the steps of intra-node tuning and monitoring and node-level tuning and monitoring. During intra-node tuning and monitoring, a controller A and a controller B are consistent through comparison, and data from controller A is selected to enter node-level tuning and monitoring. During node-level tuning and monitoring, an average value is selected from the values ​​of three signals from three nodes as a reference value for monitoring. If a difference between two other non-average signals and a mean signal is within a threshold range, then the non-average signals are normal; otherwise, the non-average signals are faulty.According to the redundancy management method, the redundancy management of a fault-tolerant computer based on monitoring pairs is realized with three or two nodes. The credibility of the system data of a fault-tolerant computer system can be ensured. Compared with fault-silent monitoring pair fault tolerance, the degradation of the system redundancy is slowed down. A backup controller can be reconfigured as the main controller through a software and hardware combination mode when a failure occurs in a node, ensuring that the system is not affected. Description of the invention

[0024] The invention is based on the object of providing an improved method for detecting malfunctions in inertial measurement units (IMU) used in a vehicle for measuring angular velocities and forces or accelerations.

[0025] The object is achieved according to the invention by a method having the features of claim 1.

[0026] Advantageous embodiments of the invention are the subject of the subclaims.

[0027] In a method according to the invention for detecting malfunctions in inertial measurement units used in a vehicle for measuring angular velocities and specific forces, at least three inertial measurement units, each with a plurality of sensors, including accelerometers and gyroscopic sensors, are used. According to the invention, a first inertial measurement unit is used as the master inertial measurement unit, while a second inertial measurement unit and a third inertial measurement unit, whose performance capabilities may be lower than those of the first inertial measurement unit, are used as slave inertial measurement units. Measurements from the master inertial measurement unit are used as reference values ​​to compensate for measurements from the slave inertial measurement units by estimating error model parameters (for example, according to equation (1)) relative to the master inertial measurement unit.to detect a malfunction in one of the three sensor signals on the basis of the three corresponding sensor signals by means of a 2-out-of-3 comparison, whereby the one of the three inertial measuring units is detected as faulty whose sensor signal has a distance from the median of the three sensor signals that exceeds a threshold value, whereby a malfunction of the master inertial measuring unit leads to a switchover to the signals of one of the still functional slave inertial measuring units, taking into account a previously calculated precompensation.

[0028] In general, this procedure can also be extended to more than three inertial measurement units in the sense of a majority decision.

[0029] In one embodiment, the error model parameters may be estimated using a Kalman filter or a recursive least squares method.

[0030] In one embodiment, error models comprising all model parameters of the slave inertial measurement units may be used to estimate the error model parameters, wherein at least time-varying relative sensor offsets with respect to the master inertial measurement unit are estimated online.

[0031] In one embodiment, the specific forces of the master inertial measurement unit can be transformed to the measurement locations of the slave inertial measurement units.

[0032] In one embodiment, the estimated parameters may be limited to allowable maximum values.

[0033] In one embodiment, covariances of the estimation errors estimated in the Kalman filters can be used to evaluate deviations of the sensor signals during detection to weight signal deviations.

[0034] In one embodiment, all sensors of all inertial measurement units can be filtered and synchronized in time using respective filter units.

[0035] In one embodiment, the online-estimated error model parameters can be applied to the measured values ​​of the slave inertial measurement units with a time delay.

[0036] According to the invention, the slave inertial measurement units are precompensated using a master-slave configuration, wherein time delays are applied to estimated sensor outputs, wherein if an error of the first inertial measurement unit is detected within the time delay, the estimated sensor errors of the slave inertial measurement units are frozen to the values ​​at the output of the time delay.

[0037] In one embodiment, detection logic is applied to the signals of the first inertial measurement unit and the precompensated signals of the slave inertial measurement units to detect the signal that deviates most from the mean or median of the three signals, wherein if a normalized signal difference from the mean or median exceeds the value 1, a sensor error is assumed.

[0038] The invention enables fault-tolerant determination of a vehicle's motion variables in the event of an IMU malfunction (fail operational) using 2-out-of-3 voting. This approach does not impose any specific requirements on geometric arrangement or sensor quality. Rather, the invention is also applicable to cost-effective, heterogeneous IMU hardware, some of which is already present in the vehicle.

[0039] The method according to the invention allows the signals of the master inertial measuring unit to be protected against sensor errors as a measure to ensure the functional reliability (fail-operational) of the estimation of the self-motion of a vehicle, taking into account increased safety requirements in automated driving.

[0040] The focus is on the use of heterogeneous (not identical) inertial measurement units (IMU) installed in different locations in the vehicle.

[0041] The inventive solution achieves fault tolerance (fail-operational) in the calculation of vehicle motion variables. This places only minimal demands on the components. The existing vehicle infrastructure (ESP sensors, chassis sensors) can be utilized, thus achieving a cost-effective solution.

[0042] Embodiments of the invention are explained in more detail below with reference to drawings.

[0043] Showing: Fig. 1 is a schematic view of a typical example of the application of an inertial measurement unit (IMU) for estimating the movement quantities of a vehicle, Fig. 2 is a schematic view of a monitoring system according to the invention in cooperation with a movement quantity estimator, Fig. 3 is a schematic view of data preprocessing (precompensation) for angular velocity sensors, Fig. 4 is a schematic view of data preprocessing (precompensation) for accelerometers, and Fig. 5 is a schematic view of error detection logic and decision logic.

[0044] Corresponding parts are provided with the same reference numerals in all figures.

[0045] In a method for detecting malfunctions in inertial measurement units used in a vehicle to measure angular velocities and specific forces, at least three inertial measurement units 4, 5, 6, each with several accelerometers and gyroscopic sensors are used according to Figure 2 .

[0046] According to the invention, a first inertial measuring unit 4 is used as the master inertial measuring unit, while a second inertial measuring unit 5 and a third inertial measuring unit 6, whose performance capabilities may be lower than that of the first inertial measuring unit 4, are used as slave inertial measuring units. Measurements from the master inertial measuring unit 4 are used in a detection unit 7 to estimate systematic error parameters in slave inertial measuring units 5, 6 relative to the master inertial measuring unit 4 in models and to detect malfunctions of individual sensors by a 2-out-of-3 comparison of the thus compensated signals. In the 2-out-of-3 comparison (two-out-of-three voting), the two signals with the smallest difference are evaluated as error-free, and the third signal is checked against them. If the difference between the third signal and the signals evaluated as error-free becomes too large, then a potential malfunction of the affected third signal is assumed.

[0047] In the figures, the three inertial measurement units 4, 5, 6 are also referred to as IMU A, IMU B, IMU C. Each of them represents a vector ω → ib b with three angular velocity signals and one vector f → ib b with three specific force signals. To simplify the representation of these signals, the superscripts and subscripts are omitted. We can then refer to the sensor signals as ω A, ω B, ω C or f A , f B , f C To refer to.

[0048] Details of the detection unit 7 are in the Figures 3 , 4 and 5 shown.

[0049] In Figure 3An embodiment of a precompensation for the angular velocity sensors is shown. Filter units 9, 10, and 11 are provided, through which the sensor signals of the master inertial measurement unit 4 and the two slave inertial measurement units 5 and 6 are corrected for known misalignment, time-synchronized, and filtered.

[0050] Time synchronization is necessary because, in a heterogeneous arrangement of inertial measurement units, time synchronization of the measured values ​​cannot be assumed. For example, differences in communication latencies may occur during signal transmission, or the pre-filtering of the signals may be different within inertial measurement units 4, 5, and 6.

[0051] The parameters of the error models of the two slave inertial measurement units 5, 6 are then determined relative to the master inertial measurement unit 4. This is done by calculating target values ​​or estimated sensor outputs ω Bestimated , ω Cestimated for the behavior of the slave IMU signals from the data of the master inertial measurement unit 4 using error models 13 and 14. The error models 13, 14 each include the orientation of an individual angular velocity sensor with respect to the angular velocity vector ω A of the master inertial measurement unit 4. This is determined, for example, during an end-of-line calibration. The deviations from the target behavior are then due to sensor errors in the slave inertial measurement units 5, 6 and are corrected by estimating the parameters of the error model. In the embodiment of Figure 3Only the sensor bias Bias_ω B , Bias_wc are determined in estimation blocks 15 and 16. However, other parameters can be estimated, e.g. bias drift, sensitivity deviations and misalignment. The parameter estimation in estimation blocks 15 and 16 can, as known from the literature, be carried out using recursive least squares methods or Kalman filters. For normally functioning inertial measurement units 4, 5, 6, these estimated parameters change only very slowly over time and therefore remain valid over a longer period of time. Therefore, the compensation of the slave inertial measurement units 5, 6 remains correct even when it is carried out with time-delayed error parameters. The corresponding time delay blocks are labeled 17 and 18, whereby the delay time must be greater than the error detection time of the detection unit 7 and is, for example, 100 ms.

[0052] The preprocessed signals 20 of the master inertial measurement unit 4 and the corrected signals 21, 22 of the two slave inertial measurement units 5 and 6 are then fed to the detection unit 7 for evaluation. If a malfunction occurs in the master inertial measurement unit 4, the estimated parameters for the slave inertial measurement units 5, 6 change significantly. However, if this malfunction of the master inertial measurement unit 4 is detected by the detection unit 7, the time delay blocks 17 and 18 prevent the parameter changes from affecting the detection. Instead, the error parameters of the slave inertial measurement units 5, 6 are frozen at the last valid value. In this way, a decoupling of compensation and detection can be achieved and failures of the master inertial measuring unit 4 can be reliably distinguished from failures of the slave inertial measuring units 5, 6.

[0053] Additionally or in another embodiment, the estimated values ​​of the parameters in estimation blocks 15 and 16 can be limited to their permissible maximum values, thereby improving the sensitivity of the detection. Additionally or in another embodiment, the reaching or exceeding of the permissible maximum values ​​by the estimated parameters can be used for fault detection for the respective sensor.

[0054] Additionally or in another embodiment, the weighted residuals of the precompensation can be calculated and evaluated in the estimator blocks 15, 16.

[0055] Additionally or in another embodiment, the covariances of the estimation errors calculated in the estimation blocks 15 and 16 can be used during detection to weight the signal deviations.

[0056] In Figure 4Equivalent to the rotational velocities ω A , ω B , ω C (also referred to as angular velocities), the precompensation of the accelerometer signals (specific forces f A , f B , f C ) is shown. If the three inertial measuring units 4, 5, 6 are spatially distributed over the vehicle, in contrast to the rotational velocities ω A , ω B , ω C, the spatial dependence of the specific forces f A , f B , f C must also be taken into account. This is realized when generating the setpoint from the signals of the master inertial measurement unit 4 in error models 23 and 24, by applying the specific forces f A , f B , fc to a measuring location using the rotational speeds ω A , ω B , ω C and rotational accelerations d / dt ω A , d / dt ω B , d / dt ω C r i of the respective slave inertial measuring unit 5, 6 are transformed according to the equation known from the literature f → i = f → A + ω → ˙ A × r → i + ω → A × ω → A × r → i = f → A + Ω ˙ A r → i + Ω A 2 r → i

[0057] In this way, estimated sensor outputs f B_estimated , f C_estimated are determined. In the embodiment of Figure 4 Only the sensor bias Bias_f B , Bias_fc are determined in estimation blocks 25 and 26. However, additional parameters can be estimated, such as bias drift, sensitivity deviations, and misalignment. Parameter estimation in estimation blocks 25 and 26 can be performed using recursive least squares methods or Kalman filters, as is known from the literature.

[0058] In Figure 5An embodiment of error detection based on the 2-out-of-3 voting principle is shown. The three preprocessed individual signals to be compared from the master inertial measurement unit 20 and the two slave inertial measurement units 21 and 22 are designated A, B, and C. A, B, and C can each be a rotational velocity ω A , ω B , ω C or a specific force f A , f B , f C . In total, one detection is used for each degree of freedom of the inertial measurement units 4, 5, and 6.

[0059] First, the median values ​​M and D of the signals and their derivatives are calculated in a block 27. Alternatively (and equivalently for three signals), the mean value of the two signals with the minimum distance between them can be used instead of the median value M, D.

[0060] The difference of each individual signal to the median value M, D is then calculated and compared against a threshold SThe threshold S is a combination of the variance σ of the signal-to-noise process and a component T representing the uncertainty of the time synchronization. M = median A , B , C D = median A ˙ , B ˙ , C ˙ S = 3 σ + D T ΔA = A − M S ΔB = B − M S ΔC = C − M S

[0061] As mentioned above, the standard deviations of the estimation errors of the estimator blocks 15, 16, 25 and 26 can also be included in the thresholding.

[0062] In a detection logic 28, it is checked whether the normalized signal difference ΔA, ΔB, ΔC to the median M, D exceeds the value 1. If this is the case, then a malfunction ERROR A, ERROR B, ERROR C is assumed for the affected sensor signal.

[0063] The occurrence of a malfunction ERROR A, ERROR B, ERROR C in the master inertial measurement unit 4 is communicated by a decision logic 29 via an error message to a switch 8, which then switches to one of the slave inertial measurement units 5, 6. In the Figure 5 In the embodiment shown, this is the slave inertial measuring unit 5.

[0064] Because the error model parameters of the respective slave inertial measuring unit 5 with respect to the master inertial measuring unit 4 have already been determined, the behavior of the compensated slave inertial measuring unit 5 with respect to bias, drift, sensitivity, etc. is identical to the master inertial measuring unit 4 and the subsequent movement calculation can continue without taking the switching process into account.

[0065] As already described above, the parameter estimation for the slave inertial measurement units 5, 6 must be decoupled in the event of a malfunction of the master inertial measurement unit 4. This is done using signal 19.

[0066] If a malfunction ERROR B, ERROR C is detected in one of the slave inertial measuring units 5, 6, it is reported as faulty.

[0067] The aim is to find the optimal compromise between sensitivity to sensor errors and robustness against false positive detection due to signal noise, road disturbance effects and other uncertainties. Quotes included in the description Cited patent literature

[0068] US 9,568,321 B2 Systems and Methods for Determining Inertial Navigation System Faults Bharadwaj et al. 02 / 2017 US 8,065,074 B1 Configurable Inertial Navigation System with Dual Extended Kalman Filter Modes Licardo, 11 / 2011 US 5,184,304 A Fault-Tolerant Inertial Navigation System Huddle 02 / 1993 US 8,825,436 B2 Inertial Sensing with Spatially Distributed Sensor Array and Two Dimensional Data Processing Zhang et al. 09 / 2014 US 9,753,144 B1 Bias and Misalignment Compensation for 6-DOF IMU Using GNSS / INS Data Jafari et al. 05 / 2017 Other publications

[0069] 1. M. L. Sheffels, "A Fault-Tolerant Air Data / Inertial Reference Unit", IEEE AES Systems Magazine, 8840 Evergreen Blvd, MN51-1355, Minneapolis, MN 5543, 1993.; M. D. Mclntyre and C. A. Gossett, "The Boeing 777 Fault Tolerant Air Data Inertial Reference System - A New Venture In Working Together", Seattle, WA 98124: Boeing Commercial Airplane Group, 1995 2. Jan Wendel, Integrierte Navigationssysteme, Oldenbourg 2007 3. Paul D. Groves, "Principles of GNSS, Inertial and Multisensor Integrated Navigation Systems", Artech House, Boston, London 2013 4. Willy Klier, Andreas Reim and Dietmar Stapel, Sae Technical Paper Series, No. 2008-01-0582, "Robust Estimation of Vehicle Sideslip Angle an Approach w / o Vehicle and Tire Models", Apr. 14-17, 2008, (7 pages). 5. Andreas Reim, Alexander Steinbach, Oliver Oettgen and Dietmar Stapel, 2009 SAE International, No. 2009-01-0430, "Central Sideslip Angle Estimation on a Software Integration Platform," 2009, (5 pages). 6. http: / / www.aceinna.com Triple redundant IMU targets autonomous vehicles, 09 / 2019 . List of reference symbols

[0070] 1Inertial measurement unit 2Sensor fusion unit 3Additional sensors 4Inertial measurement unit, IMU, Master inertial measurement unit, Master IMU 5Inertial measurement unit, IMU, Slave inertial measurement unit, Slave IMU 6Inertial measurement unit, IMU, Slave inertial measurement unit, Slave IMU 7Detection unit 8Switch 9Filter unit 10Filter unit 11Filter unit 13Error model 14Error model 15Estimator block 16Estimator block 17Time delay block 18Time delay block 19Signal 20Preprocessed signals 21Corrected signals 22Corrected signals 23Error model 24Error model 25Estimator block 26Estimator block 27Block 28Detection logic 29Decision logic A, B, C Preprocessed individual signals Bias_fB, Bias_fC Sensor bias Bias_ωB, Bias_ωC Sensor bias D Median value, Median ERROR A, ERROR B, ERROR C Error function d / dt ωA Rotational acceleration fA, fB, fC Specific force fB_estimated, fC_estimated Estimated sensor output IMU AInertial measurement unit, Master inertial measurement unit IMU BInertial measurement unit,Slave inertial measurement unit IMU CInertial measurement unit, Slave inertial measurement unit MMedian value, Median PPosition SSthreshold value TComponent vSpeed ​​αAttitude angle ΔA, ΔB, ΔCnormalized signal difference σVariance ωA, ωB, ωCRotational speed, Angular speed ωB¬estimated, ωC¬estimatedSetpoint,

Claims

1. Method for detecting malfunctions in inertial measurement units (4, 5, 6) used in a vehicle for measuring angular velocities (ωA, ωB, ωC) and specific forces (fA, fB, fC), wherein at least three inertial measurement units (4, 5, 6) are used, each having multiple sensors, comprising accelerometers and gyroscopic sensors, wherein a first inertial measurement unit (4) is used as the master inertial measurement unit, and wherein a second inertial measurement unit (5) and a third inertial measurement unit (6), the performance capabilities of which may be lower than those of the first inertial measurement unit (4), are used as slave inertial measurement units, wherein measurements of the master inertial measurement unit (4) are used as reference values in order to compensate measurements of the slave inertial measurement units (5, 6) by estimation of error model parameters compared with the master inertial measurement unit (4), in order to detect a malfunction in one of the three sensor signals on the basis of the respective three corresponding sensor signals by way of 2-out-of-3 comparison, wherein that one of the three inertial measurement units (4, 5, 6) whose sensor signal is at a distance from the median (M, D) of the three sensor signals that exceeds a threshold value is detected as faulty, wherein a malfunction of the master inertial measurement unit (4) leads to a changeover to the signals of one of the still functioning slave inertial measurement units (5, 6) in consideration of a previously calculated precompensation, wherein the slave inertial measurement units (5, 6) are precompensated using a master-slave configuration, wherein time delays are applied to estimated sensor outputs (fB_estimated, fC_estimated), wherein if an error of the first inertial measurement unit (4) is detected within the time delay, the estimated sensor errors of the slave inertial measurement units (5, 6) are frozen to the values at the output of the time delay.

2. Method according to Claim 1, characterized in that the error model parameters are estimated by means of a Kalman filter or a recursive least squares method.

3. Method according to either of Claims 1 and 2, characterized in that the error model parameters are estimated using error models (13, 14, 23, 24) that comprise all model parameters of the slave inertial measurement units (5, 6), wherein at least relative sensor offsets with respect to the master inertial measurement unit (4), which vary over time, are estimated online.

4. Method according to one of the preceding claims, characterized in that the specific forces (fA, fB, fC) of the master inertial measurement unit (4) are transformed to the measuring locations of the slave inertial measurement units (5, 6).

5. Method according to one of preceding Claims 1 to 3, characterized in that the estimated parameters are limited to maximum permissible values.

6. Method according to one of the preceding claims, characterized in that all sensors of all inertial measurement units (4, 5, 6) are filtered by means of respective filter units (9, 10, 11) and time-synchronized.

7. Method according to one of the preceding claims, characterized in that the online-estimated error model parameters are applied to the measured values of the slave inertial measurement units (5, 6) with a time delay.