Autonomous Flight Safety System

Abstract

An autonomous flight safety system (AFSS) is described that incorporates an autonomous flight termination unit (AFTU) that enables AFSS monitoring of various termination conditions, for example, used to activate a flight termination system if a termination condition is detected. Such termination conditions include boundary limit detection (e.g., whether the vehicle position is outside or protruding outside of a planned flight envelope), as well as body instability detection (e.g., whether pitch and yaw rates exceed some threshold indicating vehicle instability). For example, the AFTU may incorporate a three-axis gyroscope sensor and implement an instability detection process based on information obtained via the sensor. The instability detection process may include, for example, a BID algorithm that may be implemented by the AFTU to monitor the vehicle's angular velocity, to determine if the vehicle is no longer under stability control, and to issue a termination command when a termination condition is detected.

Description

Technical Field

[0001] The present invention generally relates to flight safety, and more specifically to the end of autonomous flight.

Background Art

[0002] In the field of flight safety, various systems and processes are known.

[0003] Object tracking is a process that uses sensors in combination with known reference points to determine the desired position fixation, and in some cases dynamic fixation, of an object of interest. The degree of desired fixation is specifically determined by collecting and correlating information on parameters such as time, space, and position information. Additionally, by integrating the product of these parameters, additional descriptive indicators such as speed, acceleration, jerk, twist motion, and trajectory are readily accessible.

[0004] Radar-based architectures for tracking rockets and similar airframes preceded the modern basic concepts of aircraft tracking. The integration and use of these radar assets have enabled the field of rocketry to develop synergistically into advanced systems such as space shuttles. Such launch vehicles require the use of precise altitude tracking radars, mainly for safety reasons. Specifically, orbit trajectory monitoring managers use accurate real-time position and velocity data to determine whether a launch vehicle is deviating from its course during the ascent phase. The manager then has the option to safely destroy the airframe before it can pose a danger to life or property.

[0005] It has also been proposed to move some of the real-time orbit sensing and tracking functions from conventional ground / air-based radar systems to systems installed on the aircraft itself. However, these systems still include a monitoring manager for interpreting orbit information and determining the end of flight based on the orbit information transmitted from the aircraft.

Summary of the Invention

[0006] There is a need for a flight safety system that can quickly determine when to end an aircraft's flight. One such need relates to methods and devices for determining an aircraft's flight characteristics and autonomously determining the end of a flight more so than currently proposed human-in-the-loop systems.

[0007] The present disclosure describes an autonomous flight safety system (AFSS) that incorporates an autonomous flight termination unit (AFTU) capable of performing AFSS monitoring of various end conditions used to activate a flight termination system (e.g., when an end condition is detected). Such end conditions include boundary limit detection (e.g., whether the aircraft's position is outside the planned flight envelope), and likewise, body instability detection (BID) (e.g., whether pitch rate and yaw rate exceed some threshold indicating aircraft instability). For example, the AFTU may incorporate a three-axis gyroscope sensor and implement an instability detection process based on information obtained via the sensor. The instability detection process may include a BID algorithm that can be implemented by the AFTU, for example, to monitor the angular velocity of the aircraft, to determine whether the aircraft is no longer under stable control, and to issue an end command when an end condition is detected.

[0008] An apparatus, system, and method for terminating autonomous flight are described. One or more embodiments of the apparatus, system, and method include a position sensing system, a three-axis gyro, a processor, and a yield system. The processor is adapted to repeatedly receive a location signal indicative of the position of the launch vehicle in three-dimensional space, to repeatedly compare the position indicated by the location signal with a planned flight envelope, to repeatedly receive a gyro signal indicative of the pitch rate and yaw rate of the launch vehicle, and to repeatedly compare the pitch rate and yaw rate indicated by the gyro signal with maximum specified pitch and yaw rates. The processor may be further adapted to activate a flight termination system when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions consisting of the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum specified pitch and yaw rates, and combinations thereof. The termination system may be configured to initiate termination of the launch vehicle in response to activation of the flight termination system.

[0009] A method, apparatus, non-transitory computer-readable medium, and system for terminating autonomous flight are described. One or more embodiments of the method, apparatus, non-transitory computer-readable medium, and system include repeatedly receiving a location signal indicative of the position of the launch vehicle in three-dimensional space, repeatedly comparing the position indicated by the location signal with a planned flight envelope, repeatedly receiving a gyro signal indicative of the pitch rate and yaw rate of the launch vehicle, and repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with maximum specified pitch and yaw rates. The method may further include activating a flight termination system when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions consisting of the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum specified pitch and yaw rates, and combinations thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0010]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Mode for Carrying Out the Invention

[0011] The following description is for illustrative purposes only and does not limit the general principles of exemplary embodiments. The scope of the present invention is to be determined with reference to the claims.

[0012] Throughout this specification, the terms "one embodiment", "an embodiment", or similar language means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases "in one embodiment", "in an embodiment", and similar language throughout this specification may, but do not necessarily, all refer to the same embodiment.

[0013] Furthermore, the features, structures, or characteristics described herein may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided, such as examples of programming, software modules, user selections, network transactions, database queries, database structures, hardware modules, hardware circuits, hardware chips, etc., to thoroughly understand the embodiments of the present invention. However, one of ordinary skill in the art will understand that the present invention may be practiced without one or more of these specific details, or in combination with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the present invention.

[0014] Some autonomous flight safety systems (AFSS) can monitor the position of an aircraft relative to set boundary limits (e.g., set boundary limits defined by a flight or mission, such as in a mission data load (MDL) file). Such systems can determine whether the aircraft has crossed the safe operating limits of its flight path. However, some systems may not provide a means to determine whether the aircraft is stable within such safe operating limits. Thus, an AFSS may lack in scenarios where the aircraft is unstable (e.g., uncontrollable tumbling) while maintaining a position within the defined boundary limits of the MDL file. In other words, some AFSS may not be able to determine or detect concerns about aircraft instability safety when the aircraft maintains a position within the defined boundary limits of the MDL file (e.g., when the aircraft uncontrollably tumbles within the mission-defined boundary limits). Since an AFSS may lack an inherent ability to detect instability or tumbling, such an AFSS may not be able to generate an end comment (e.g., a mission end command such as a command for the launch vehicle to end) based on aircraft instability, resulting in a lack of a safety system.

[0015] The present disclosure describes an AFSS incorporating an autonomous flight termination unit (AFTU) that enables additional modes of monitoring for impairments (e.g., aircraft instability that may raise concerns about mission safety) in the AFSS. Generally, a processor (e.g., the processor of the AFTU) can monitor various termination conditions and, when a termination condition is detected, activate a flight termination system. According to the techniques described herein, termination conditions that can be monitored and detected include boundary limit detection (e.g., whether the aircraft position is outside the planned flight envelope), and likewise, body instability detection (BID) (e.g., whether pitch rate and yaw rate exceed some threshold indicating aircraft instability).

[0016] For example, AFTU can incorporate an independent sensor such as a three-axis gyroscope (e.g., and / or receive signals from an independent sensor), and based on the information obtained via the sensor, implement an instability detection process. The instability detection process can be implemented by AFTU (e.g., or the BID hardware of AFTU) to, for example, monitor the angular velocity of the aircraft, determine whether the aircraft is no longer under stable control, and issue an end command when an end condition is detected, and may include a BID algorithm. The output of the instability detection process can be provided to the core autonomous safety software (CASS) provided by CASS (e.g., via a user-definable feature). According to some aspect of the present disclosure, the end condition can be defined as a function of the output parameters from the instability detection process within the MDL file (e.g., similar to other sensors). In some examples, the use of an internal or external three-axis gyro and associated processing within AFTU (e.g., such as the instability detection process) can enable the completion of a fully integrated, robust, autonomous flight safety solution.

[0017] The AFTU described in this specification can be included as a flyaway component of an AFSS that executes a mission (e.g., an MDL file described by a planned flight envelope, a mission planning team, etc.). The AFTU can provide on-board range safety by independently monitoring aircraft dynamics to detonate the missile system when a specific failure situation is observed. In some examples, the position of the aircraft is monitored and compared to a mission (e.g., an MDL file) to verify that the aircraft is within a limited range. Further, in accordance with the present disclosure, additional modes of failure can be monitored by the AFTU. For example, each AFTU can provide an independent sensor (e.g., an independent MEMS-based 3-axis gyro, etc.) to monitor the airframe body speed to enhance monitoring through the planned flight envelope of the missile system. The body speed can be supplied to some instability detection process (e.g., a body instability detector (BID) algorithm developed by General Atomics Electromagnetic Systems (GA-EMS) for execution within each AFTU). The AFTU (e.g., a GA-EMS AFTU) can provide enhanced functionality (e.g., instability detection monitoring, booster end, etc.) to detect and respond decisively to failure scenarios that occur too quickly for the response time of typical end-of-flight system techniques.

[0018] FIG. 1 shows an example of a flight safety system in accordance with an aspect of the present disclosure. The example shown includes an aircraft 100, an on-board sensor 105, an INS 110, a GPS receiver 115, a radar system 120, a telemetry antenna 125, an MFCO 130, and a command antenna 135.

[0019] Figure 1 shows an example of a flight safety system. The airframe 100 (e.g., launch vehicle 100, aircraft 100, etc.) may include onboard sensors 105 such as INS 110 and GPS receiver 115. The airframe 100 position or sensor data may be downlinked (telemetered) to the telemetry antenna 125 at the ground station. The airframe 100 may include a communication device (e.g., E-band transponder and antenna) for transmitting the integrity data of the flight termination system provided to the airframe's telemetry system to the Missile Flight Control Officer (MFCO 130). The independent radar system 120 may track the airframe 100 to determine its flight trajectory.

[0020] MFCO 130 may use information from the radar system 120 and the telemetry antenna 125 to determine whether the airframe 100 has violated flight safety criteria (which may include, for example, a human decision process). If a violation exists, MFCO 130 may activate a signal as a command transmitted from the command antenna 135 to the airframe 100. The signal may be received by the airframe 100 and may cause the airframe 100 to terminate its flight. This process may rely on highly reliable hardware that is fully certified and tested and implemented with redundancy across various subsystems of the flight safety system, as well as, similarly, highly trained personnel (e.g., human personnel certified for the role of MFCO 130).

[0021] The command antenna, telemetry antenna, and other antennas described herein may include a single antenna or multiple antennas that can transmit or receive multiple transmissions (e.g., wireless transmissions) simultaneously. In some cases, the antenna may include or refer to an antenna array.

[0022] As described above, the transceiver can communicate bidirectionally via an antenna, wired, or wireless link. For example, the transceiver can represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. The transceiver can further include or be connected to a modem to modulate packets, provide the modulated packets for transmission, and demodulate received packets. In some examples, the transceiver can be tuned to operate at a specified frequency. For example, the modem can configure the transceiver to operate at a specified frequency and power level based on the communication protocol used by the modem.

[0023] Aircraft 100 includes examples of corresponding elements or aspects of corresponding elements, which will be described with reference to FIG. 2. INS 110 includes examples of corresponding elements or aspects of corresponding elements, which will be described with reference to FIG. 7. GPS receiver 115 includes examples of corresponding elements or aspects of corresponding elements, which will be described with reference to FIGS. 5 through 8.

[0024] FIG. 2 shows an example of an aircraft launch profile in accordance with aspects of the present disclosure. The example shown includes a launch site 200, an aircraft 205, a nominal launch profile 210, a debris exclusion zone 215, a ground station 220, a mission control center 225, telemetry data 230, quasi-real-time telemetry data 235, and a debris collision area 240.

[0025] FIG. 2 shows an example of an aircraft 205 launch profile. The aircraft 205 (e.g., a launch vehicle 205, an airplane 205, etc.) can be launched from the launch site 200. The nominal launch profile 210 indicates where the aircraft 205 should stay within the nominal launch. The debris exclusion zone 215 indicates areas that could pose safety concerns if the aircraft 205 were to collide with the Earth within these areas.

[0026] In some safety systems, telemetry data 230 can be transmitted to a ground station 220. This telemetry data 230 can be non-real-time information about the aircraft 205, such as the health of the aircraft 205 and the status of internal systems. Quasi-real-time telemetry data 235 can be transmitted to the ground station and can include information about the flight trajectory (or aircraft 205 trajectory) of the aircraft 205 for analysis by a flight control manager (not shown) at the mission control center 225. The flight control manager (e.g., MFCO) uses the flight trajectory information to determine whether the flight should be terminated. If the aircraft 205 is still within the nominal launch profile 210, the flight control manager is less likely to terminate the flight. In some examples, there may be other reasons to terminate the flight that may relate to the non-real-time telemetry data 230.

[0027] The aircraft 205 is shown outside the nominal launch profile 210, and if the flight is terminated at this point, the aircraft 205 will return to Earth within the debris collision area 240. In this course, the debris collision area 240 does not violate one of the debris exclusion zones 215. Thus, since the aircraft 205 and / or the flight do not threaten the debris exclusion zone 215, the flight control manager may continue the flight. In embodiments of the present disclosure, the decision process regarding terminating the flight of the aircraft 205 is executed autonomously on the aircraft 205 if the debris collision area 240 violates one or more of the debris exclusion zones 215.

[0028] The aircraft 205 is an example of a corresponding element described with reference to FIG. 1 or includes an aspect of the corresponding element. The telemetry data 230 is an example of a corresponding element described with reference to FIG. 4 or includes an aspect of the corresponding element.

[0029] FIG. 3 shows an example of an aircraft termination diagram according to an aspect of the present disclosure. The example shown includes a launch pad 300, a nominal aircraft track 305, a collision limit line 310, a protection area 315, a non-nominal flight path 320, a current blast line 325, an end point 330, and an AFSS blast line 335.

[0030] Figure 3 shows an improvement in end-of-flight determination using one or more embodiments of the present disclosure. An airframe (e.g., a launch vehicle, an aircraft, etc.) can be launched from a launch pad 300. The nominal airframe track 305 indicates a track that the airframe can follow (e.g., for a nominal flight, for a path according to a planned flight envelope, etc.). Two areas to be protected (e.g., protected area 315) are shown as ground areas to be protected from off-course or end-of-flight.

[0031] The collision limit line 310 indicates a line extending from the launch site that debris must not cross in order to ensure that debris from the airframe does not land within the protected area 315. Thus, as long as the flight path of the airframe remains within the collision limit line 310 (e.g., or as long as the airframe does not deviate from the planned flight envelope by more than some acceptable margin threshold), the airframe and the flight can be considered to be within the safety zone (e.g., furthermore, there can be no predicted danger to the protected area 315). This area within the collision limit line 310 can be referred to herein as the safety window, and the area outside the collision limit line 310 can be referred to herein as the area to be protected.

[0032] The dashed line in Figure 3 can indicate a non-nominal flight path 320 that the airframe can follow. Along this non-nominal flight path 320, the protruding flight path proceeds beyond the collision limit line 310. As a result, the flight is to be terminated. In a conventional end-of-flight system, a current break line can be defined such that if the airframe flies beyond the current break line, it becomes a danger to the protected area 315. Thus, the flight control manager decides that the flight must be terminated at the end point 330 where the non-nominal flight path 320 intersects the current break line 325.

[0033] Embodiments of the present disclosure include an apparatus and a method for determining the flight characteristics of an airframe and for making an autonomous flight end determination of the airframe carrying the apparatus. The AFSS eliminates human - participation decisions and executes an autonomous process for making a flight end determination and for ending the flight. The AFSS can continuously calculate the instantaneous collision point of the airframe using inputs from its onboard navigation system. As a result, the margin for the blast line is not so conservative and can thus be made more flexible in the path planned within the reference area. The AFSS blast line 335 can delay the decision to end the flight made by the AFSS itself until the subsequent end point 340 where the non - nominal flight path 320 intersects the AFSS blast line 335.

[0034] When the AFSS is installed, the blast decision is transferred to the launch vehicle using telemetry transmission to the ground, which is only necessary to provide information for post - flight processing in the event of an airframe blast. The AFSS is responsible for destroying the flying airframe or causing it to lose propulsion when the onboard logic determines that the airframe is flying outside of a predetermined safety limit based on predetermined flight rules for a particular airframe and mission.

[0035] The average response for such a human - participation system can be approximately 2 to 3 seconds, but the AFSS can respond much faster (e.g., less than about 500 milliseconds). Further, the 500 - millisecond decision time can be based on the number of passes through the decision cycle executed by the AFSS to sanity - check dangerous situations prior to making an end decision and the amount of data necessary to telemeter for post - flight analysis prior to executing the end decision. Assuming a typical decision cycle of 100 milliseconds through the instantaneous collision point calculation process (processing rules, boundary points, etc.), the number of sensors, and adjustment of the telemetry output stream, a faster decision cycle can be achieved to match the in - situ application needs for even faster response times (e.g., projectiles with gun - fired guides that can leave the gun barrel at several kilometers per second).

[0036] In addition to being faster until an end decision is made and enabling longer flight times, the AFSS is more cost-effective than human-in-the-loop solutions and can be more comprehensive for many different types of airframes, and thus can be easily configured to meet the needs of future flight tests in the airframe application area and configurations without significant modification.

[0037] FIG. 4 shows an example of a flight safety system diagram in accordance with aspects of the present disclosure. The example shown includes an AFSS 400, an external sensor 405, a GPS receiver 410, a power source 415, an AFSA 420, a first sensor 425, a second sensor 430, a processor 435, a launch controller 440, a firearm initiator 445, telemetry data 450, and a common disable signal 455.

[0038] FIG. 4 shows a high-level functional block diagram of a flight safety system (e.g., AFSS 400). The autonomous flight safety system may include two autonomous flight safety assemblies (AFSA 420) that operate substantially independently. Each AFSA 420 includes a first sensor, a second sensor 430, a processor 435, and a launch controller 440.

[0039] The GPS receiver 410 may feed both autonomous flight safety assemblies and may be coupled to one or more of the first sensor and the second sensor 430. The common disable signal 455 may be supplied to both flight safety assemblies. The telemetry data 450 may be provided between the flight safety assembly and other electronics mounted on the airframe (e.g., with reference to FIG. 2 and as described in more detail herein). In some embodiments, each AFSA 420 may be coupled to a separate power source 415.

[0040] An external sensor 405 may be included and may provide sensor information regarding the flight of the aircraft to each of the flight safety assemblies. Additionally or alternatively, the first sensor from each AFSA 420 may be cross-strapped to the other AFSA 420. Thus, the processor 435 may access flight information from at least two independent sources and at most four independent sources. In one embodiment, the processor 435 may access its own first sensor, its own second sensor 430, and the first sensor from the other flight safety assembly.

[0041] Software may be configured to evaluate mission rules for each active sensor input (e.g., three sensors) to determine whether the rules require the generation of an action (e.g., safety or termination). The decision logic may evaluate each sensor source independently and may include an incremental step function. When the step function reaches a predetermined threshold, the onboard flight termination indicator may be asserted for each active sensor that has reached the threshold. If half or more of the active sensors indicate an end condition, the launch controller 440 will generate an onboard flight termination signal to the firearm initiator 445. After transmitting the onboard flight termination signal (e.g., FireEnable command), the flight safety assembly will re-evaluate the sensor inputs to verify the termination majority vote. If the verification is successful, the flight safety assembly will complete the termination sequence by transmitting a launch command.

[0042] As a non-limiting example, any flight safety assembly unit may be capable of terminating the flight based on indicating three independent instantaneous collision points, each calculated from its associated sensor input. This approach increases the certainty of the mission and ensures that the loss of either the first sensor data or the second sensor 430 data does not result in an automatic termination decision.

[0043] The interface with the airframe control and guidance system is optional and makes the embodiments more generally applicable. If integration of airframe guidance is desired, it is possible either to provide a navigation solution and / or to include airframe motion status signals from the guidance computer. However, it should be noted that decisions made based on tracking source inputs, or other signals interfaced with the airframe, may need to be carefully evaluated and appropriately weighted against similar inputs from very independent sources.

[0044] Additional sensors can be added for mission certainty. Thus, the architecture is scalable to allow for more redundancy to increase reliability and safety for manned missions. The decision architecture is shown as being configured with one processor 435 within a redundant set of units each independent of the others. The architecture can also be extended to include redundant processor(s) 435 to increase mission certainty and to enable the double fault tolerance requirements for manned space missions. The device can be configured to accept external inputs as additional pieces of information to provide a function for detecting events from the launch system.

[0045] Processor 435 is an intelligent hardware device (e.g., a general-purpose processing component, a digital signal processor 435 (DSP), a central processing unit (CPU), a graphics processing unit (GPU), a microcontroller, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a programmable logic device (PLD), discrete gate or transistor logic components, discrete hardware components, or any combination thereof). In some cases, processor 435 is configured to operate a memory array using a memory controller. In other cases, the memory controller is integrated into processor 435. In some cases, processor 435 is configured to execute computer-readable instructions stored in memory to perform various functions. In some embodiments, processor 435 includes application-specific components for modem processing, baseband processing, digital signal processing, or transmission processing.

[0046] Examples of memory devices include random access memory (RAM), read-only memory (ROM), or a hard disk. Examples of memory devices include solid state memory and hard disk drives. In some examples, the memory is used to store computer-readable, computer-executable software that, when executed, causes processor 435 to perform the various functions described herein. In some cases, the memory includes, among other things, a basic input / output system (BIOS) that controls basic hardware or software operations, such as interactions with peripheral components or devices. In some cases, a memory controller operates the memory cells. For example, the memory controller can include a row decoder, a column decoder, or both. In some cases, the memory cells in the memory store information in the form of logical states.

[0047] The external sensor 405 is an example of a corresponding element to be described with reference to FIG. 5, or includes an aspect of the corresponding element. The GPS receiver 410 is an example of a corresponding element to be described with reference to FIGS. 1 and 5 through 8, or includes an aspect of the corresponding element. The AFSA 420 is an example of a corresponding element to be described with reference to FIG. 5, or includes an aspect of the corresponding element. The second sensor 430 is an example of a corresponding element to be described with reference to FIG. 5, or includes an aspect of the corresponding element. The telemetry data 450 is an example of a corresponding element to be described with reference to FIG. 2, or includes an aspect of the corresponding element.

[0048] FIG. 5 shows an example of a flight safety system diagram according to an aspect of the present disclosure. The example shown includes an AFSA 500, a decision module 505, a flight decision processor 510, an analog-to-digital interface 515, a launch control processor 520, an end output circuit 525, a first sensor 530, a second sensor 535, a GPS receiver 540, an external sensor 545, a power module 550, an external interface 555, a telemetry interface 560, an airframe interface 565, a safe arm module 570, and a sensor input 575.

[0049] FIG. 5 shows a detailed functional block diagram of the AFSA 500. The power module 550 supplies power to various devices of the AFSA 500, such as the decision module 505, the first sensor 530, the second sensor 535, and the safe arm module 570. The power module 550 can also be configured to monitor the power state within the AFSA 500. During flight, the power module 550 can receive power from a flight battery. The external interface 555 can be configured to supply power to the AFSA 500 prior to the flight of the airframe and include a sensor for indicating whether external power is connected (e.g., via an umbilical connection), and when the umbilical is disconnected, it can be possible to indicate that the AFSA 500 was in flight mode.

[0050] Power transfer between the flight battery and the external interface 555 can be controlled by a ground command from the external interface 555, the airframe interface 565, or the telemetry interface 560. Power transfer between the flight battery and the external interface 555 can be achieved by switches and diodes or gates that enable the application of battery power but are not used until ground power (i.e., power from the external interface 555) is removed. This capability provides a convenient way to transfer power without interruption during transfer. The circuit also provides protection against reverse polarity, preventing ground power from damaging the battery by blocking ground current from entering the battery's circuit. The reverse is also true, i.e., blocking battery current from flowing into the ground power system.

[0051] The power module 550 then regulates and distributes power to other devices within the AFSA 500. An airframe interface 565 may be included to supply signals to the AFSA 500 while the airframe is still on the ground. By way of non-limiting example, the airframe interface 565 may include four analog channels to an analog-digital interface and a digital channel to a decision processor. Accordingly, the airframe interface 565 can be used to monitor the functions of various sensors and the operation of other devices on the AFSA 500.

[0052] The telemetry interface 560 may be included to transfer data between the on-board telemetry system and the AFSA 500. Thus, information regarding the aircraft's health and flight situation may be available to the AFSA 500 for processing. Further, in some embodiments, the telemetry interface 560 may include additional flight sensor data such as position, velocity, and time (PVT) from other on-board sensors. As a non-limiting example, the telemetry interface 560 may be a serial interface such as an Ethernet or RS-422 interface. In one embodiment, three independent sensors are interfaceable with the determination module 505, each of which may take the form of a GPS receiver 540, an IMU sensor, or a combination thereof. These sensors provide redundancy and are interfaceable with the determination module 505 for tracking the flight position. As a non-limiting example, the sensor data may provide PVT type information to the determination module 505.

[0053] In other embodiments, the information from the sensors may be in a more raw format, and the raw information may be processed by the flight decision processor 510 to determine PVT type information (the position sensor 3 is an example of an external sensor 545 outside the AFSA 500). In some embodiments, the external sensor 545 is coupled to the sensor input 575. Further, in some embodiments, the external sensor 545 may be coupled to a stand-alone type sensor. In other embodiments, the external sensor 545 may be a sensor that is part of the aircraft but has an output capable of supplying PVT type information to the AFSA 500 via the sensor input 575. In other embodiments, the sensor input 575 may be connected to the sensor output of another on-board AFSA 500. As a non-limiting example, the sensor input 575 and the sensor output may be configured as an RS-232, RS-485 / 422 interface.

[0054] The GPS receiver 540 can be configured for reception within the L1 and L2 bands and may include a signal amplifier for supplying GPS information to the first sensor 530 and the second sensor 535. The first sensor 530 (which may also be referred to herein as position sensor 1) is included within the AFSA 500 and is coupled to the flight decision processor 510 on the decision module 505. As a non-limiting example shown in FIG. 5, the first sensor 530 may be configured to include GPS elements for determining and providing substantially real-time position information of the AFSA 500 (and the airframe when the AFSA 500 is attached to the airframe) using the GPS satellite system. The first sensor 530 may also include an IMU for providing another sensor path capable of sensing inertial parameters in response to the movement of the airframe. In some embodiments, a processor may be included within the first sensor 530 to collect and condition sensor information from the GPS sensor and the IMU sensor prior to transmitting the information (e.g., PVT type information) to the flight decision processor 510. The processor within the first sensor 530 may perform functions such as, for example, self-test, software timeline management, filtering (e.g., Kalman filtering), position solution processing, GPS assistance, and communication. In some embodiments, the processor within the first sensor 530 may include test inputs and may be reprogrammable via the test inputs.

[0055] The second sensor 535 (which may also be referred to herein as position sensor 2) is included within the AFSA 500 and is coupled to the flight decision processor 510. As a non-limiting example shown in FIG. 5, the second sensor 535 may be configured to include GPS elements for determining and providing substantially real-time position information of the AFSA 500 (and the airframe when the AFSA 500 is attached to the airframe) using the GPS satellite system.

[0056] As a non-limiting example, each of the GPS elements in the first sensor 530 and the second sensor 535 may be configured to include self-test, security and anti-spoofing module (SASM) anti-jamming functions, dual-band receiver control, a 10 Hz update rate, satellite acquisition function, satellite tracking function, and communication function. In some embodiments, the GPS element may be reprogrammable.

[0057] As a non-limiting example, the IMU sensor may be configured to include delta V information (i.e., displacement information) and delta theta information (i.e., rotational information) on three independent axes for providing six degrees of freedom type information. The IMU sensor may include analog-to-digital conversion, timestamping function, reset function, telemetry interface 560, and test interface.

[0058] The decision module 505 tracks the position of the aircraft on the earth and determines whether the aircraft indicates a safety hazard by comparison with the "flight / flying without" rule. If the aircraft is considered dangerous, the decision module 505 may initiate flight termination. The flight decision processor 510 receives regulated power from the power module 550, receives ground position data via the GPS and INS ports (i.e., the first sensor 530, the second sensor 535, and the sensor input 575), monitors the performance data from the launch control processor 520, outputs the flight situation, and receives the uploaded ground commands when connected to the external interface 555. The flight decision processor 510 may also be configured to make a flight termination decision based on the information uploaded prior to the mission and may continuously report the system situation to the ground via the telemetry interface 560.

[0059] The flight decision processor 510 may include self-test and system integration test functions for performing internal tests on the flight decision processor 510, the launch control processor 520, a memory (not shown), and the status of other hardware within the system. The self-test may include functions such as inspecting the processor and executable software, for example, by performing operations to verify correct operation. These operations may include calculating a cyclic redundancy check (CRC) of the executable image and performing arithmetic operations while verifying that correct values are returned for each operation. Additionally, status requests may be sent to the launch control processor 520 to verify its status and proper communication.

[0060] The flight decision processor 510 may include system performance monitoring for continuously monitoring the system power and the functional performance of the hardware during flight. This monitoring may include functions for monitoring the voltage level of the power system and other functional measurements that may be important for the proper operation of the AFSA 500. The mission data management function may receive and act on mission data downloaded for a particular mission to be executed. The reprogramming function can reprogram new mission rules and, similarly, new software with future enhancements during development. The computing function calculates the real-time instantaneous collision point based on data collected during flight. The rule monitoring function applies rules when instructed by a mission data load (MDL) and discriminates any violations. The centralized communication function handles data inputs from all system interfaces such as the launch control processor 520, the first sensor 530, the second sensor 535, and the external (ground) interface.

[0061] The telemetry function can output a telemetry data stream to an aircraft telemetry module (not shown) via a telemetry interface 560, and may include embedded test information, flight and termination status, and information to be transmitted to the ground prior to termination if the termination is initiated by a termination rule. The flight termination system (FTS) function can control commands for arming, safing, and firing an external termination mechanism in combination with a launch control processor 520. When a rule violation indicates that the aircraft flight has become dangerous to the public, the termination decision function initiates an aircraft flight termination.

[0062] The launch control processor 520 controls the safety of the system, including arming, monitoring the flight environment, initiating flight termination, and / or safing the system under the command of the flight decision processor 510. The launch control processor 520 includes safety inhibition for arm and fire signals. The self-test function may be included for internal testing of other hardware such as the launch control processor 520 and an end-of-output circuit for correct functionality similar to the self-test of the decision module 505. The system performance monitoring function includes continuous monitoring of all system power and the arm and fire status of the launch control processor 520.

[0063] The end-of-output circuit can control the generation of one or more end signals in response to inputs from the flight decision processor 510 and the launch control processor 520. For example, one output can be a ~7.5 amp output with ~200 milliseconds asserted to a safe arm device. Two other outputs can be configured as ~200 milliamperes that can be asserted at different times to trigger different events. For example, one output can provide a signal to shut down the rocket motor or to control an enable switch to the safe arm device. These outputs can be programmed for various uses depending on the type of aircraft on which the AFSA 500 is installed.

[0064] The embodiment of FIG. 5 shows a launch control processor 520 and a flight determination processor 510. These processors can be of any suitable type of microprocessor, microcontroller, custom logic, or combinations thereof. Additionally, some embodiments can be configured to use a single processor to perform the launch control process and the flight determination process.

[0065] In the example of FIG. 5, the flight determination processor 510 can include or implement self-test and system BIT, system performance monitoring, mission data management, reprogramming, impact point (I / P) calculation, rule monitoring, centralized communication, telemetry, FTS control, end determination, etc. The analog-to-digital interface 515 can include or implement voltage / current monitoring, battery status monitoring, arming and launch status monitoring, airframe inputs. The launch control processor 520 can include or implement self-test, system safety, command arming, launch indicator processing, communication, launch signal output connection, etc. The end output circuit 525 can include or implement safety monitoring, arming control, 2 - 200 mA output signal, 1 - 7.5 A output signal, etc.

[0066] In the example of FIG. 5, the airframe interface 565 can include or implement airframe electronics (which can include or process, for example, discrete digital data, discrete analog data, etc.). The power module 550 can include or implement power distribution, power monitoring signals, and external interfaces. The second sensor 535 can include or implement, for example, a GPS receiver, etc.

[0067] The AFSA 500 is an example of a corresponding element or includes aspects of a corresponding element as described with reference to FIG. 4. The second sensor 535 is an example of a corresponding element or includes aspects of a corresponding element as described with reference to FIG. 4. The GPS receiver 540 is an example of a corresponding element or includes aspects of a corresponding element as described with reference to FIGS. 1, 4, and 6 to 8. The external sensor 545 is an example of a corresponding element or includes aspects of a corresponding element as described with reference to FIG. 4.

[0068] FIG. 6 shows an example of a flight safety system diagram according to an aspect of the present disclosure. The example shown includes a flight termination system 600, a GPS receiver 605, a termination unit 610, a logic gate 615, a system controller 620, a connection 625, a fail-safe controller 630, an avionics box 635, an explosive 665, a valve 670, a fuel supply line 675, an engine 680, a source 682, a telemetry connection 684, and a line 686.

[0069] FIG. 6 shows a schematic diagram of an exemplary autonomous flight termination system 600. In some examples, the flight termination system 600 (e.g., the autonomous flight termination system 600) may terminate the flight of the airframe after the airframe is launched (e.g., from an aircraft). The flight termination system 600 may include a GPS receiver 605, an airframe flight termination unit 610, a system controller 620, and a fail-safe controller 630. In some examples, the flight termination system 600 may be attached to the carrying airframe.

[0070] The GPS receiver 605 may be configured to determine the position of the airframe with respect to the earth during flight of the airframe. The GPS receiver 605 may continuously provide position data to the system controller 620 during flight of the airframe, and the system controller 620 may use it to calculate the actual airframe flight trajectory. In one embodiment, the system may include a second GPS receiver 605 that may be mounted on a circuit card within the avionics box 635, and the second GPS receiver 605 may also provide position data to the system controller 620. The GPS receiver 605 is an example of, or includes aspects of, a corresponding element described with reference to FIGS. 1, 4, 5, 7, and 8.

[0071] In one embodiment, the system controller 620 can be connected via a hardline isolation switch or link 660, which can take the form of a MIL-STD interface as part of the umbilical. The system controller 620 can be configured to receive a signal indicating position data from the GPS receiver 605 to calculate the actual aircraft orbit relative to the Earth, and may also include a stored predetermined mission-planned flight trajectory (e.g., planned flight envelope) having a predetermined safety limit or safety margin for the aircraft.

[0072] Optionally, the system can include a redundant or second termination unit 610 in addition to the first termination unit 610. The termination unit 610 can be connected to receive a termination signal from the system controller 620 via a signal path or connection 625. In some examples, each of the termination units 610 can include, or consist of, a normally open cutoff switch connected to terminate aircraft flight when actuated, and / or a normally open switch connected to detonate an explosive mounted on the aircraft, or can be selected to destroy all or a part of the aircraft or the first stage booster essential to continue the flight. The system controller 620 can be connected to the termination unit 610 to send a third signal to activate the termination unit 610 to terminate the flight of the aircraft when the actual aircraft orbit is determined by the system controller 620 to be outside the safety margin of the mission-planned flight trajectory for the aircraft.

[0073] In an embodiment, the cutoff switch of the end unit 610 can take the form of a relay that is normally open, such that a loss of power to the system from the end-of-flight power source causes the relay to open, creating an end condition. In one embodiment, the cutoff switch of the end unit 610 can be connected to valves 670 that are normally closed and are each serially mounted on a fuel supply line 675 and connected to a powerplant or engine 680 of the airframe. In one embodiment, the engine 680 can take the form of a booster for the first stage of the airframe. In one embodiment, since the system controller 620 can be connected to the cutoff switch of the end unit 610, actuation of the end unit 610 by a third signal can include powering off the cutoff switch to its normal open state, and then closing the valve 670 to block the fuel flow through the fuel line to the engine 680.

[0074] The end unit 610, which can receive power from an end-of-flight battery or other power source on the airframe, can be energized to close its normally open cutoff switch, and the airframe battery or other power source can energize the valve 670 to its open configuration, which begins at airframe launch. The valve 670 remains energized, such that the airframe battery remains continuously open during flight of the airframe or, in an embodiment, during combustion of the first stage booster. In one embodiment, the valve 670 can receive power from the airframe battery via a power line 686 and via the end unit 610, energize and maintain the valve 670 in its open position, thereby enabling fuel flow through the supply to the engine 680 continuously during flight of the airframe along a mission-planned trajectory or during combustion of the first stage booster.

[0075] If power from source 682 is lacking or intentionally removed, or if one or both of the termination units 610 are powered off by the system controller 620 or the failsafe controller 630 and the cutoff switch of the termination unit 610 is opened, the current to valve 670 is cut off, closing the valve. This shuts off the fuel flow to engine 680 via the fuel line, ending the flight of the aircraft or the first stage. The system controller 620 may activate (i.e., open) the cutoff switch of the termination unit 610 to cut off power to valve 670 respectively when the system controller 620 determines that the actual flight path is outside the safety margin of the aircraft's pre-planned mission flight path. When either or both of valves 670 are closed, they stop the fuel flow via the fuel supply line 675, thereby depleting the fuel of engine 680 and causing the aircraft to descend and crash into a predetermined safe area such as an uninhabited ground area or an unoccupied ocean.

[0076] The failsafe controller 630 of the system may be connected to the system controller 620 to receive the operating data of the system controller 620. The failsafe controller 630 may be connected to the termination unit 610 by a signal path or connection, and in an embodiment, to the redundant termination unit 610 by a signal path or connection. In one embodiment, the signal paths or connections 625 from the system controller 620 and the failsafe controller 630 may be connected to the inputs of an OR logic gate 615 that is connected to or incorporated into the normally open cutoff switch and / or the switch of the normally open termination unit 610 respectively. Similarly, the signal paths or connections 625 from the system controller 620 and the failsafe controller 630 may be connected to the inputs of an OR logic gate 615 that is connected to or incorporated into the normally open cutoff switch of the termination unit 610.

[0077] The fail-safe controller 630 can send a signal to the termination unit 610 to actuate (i.e., cut off power) each cutoff switch of the termination unit 610 to its normally open position, thereby cutting off power to the valve 670, closing the valve 670 to cut off fuel flow to the engine 680, and ending aircraft flight when the operation data received from the system controller 620 indicates that the system controller 620 is in an error state. The termination unit 610 can be connected to the system controller 620 and the fail-safe controller 630 via an OR logic gate 615 to receive an end signal from either the system controller 620 or an add-on. The termination unit 610 can be connected to the arm / firing blast device by a signal path or connection 625, and the termination unit 610 can be connected to an optional arm / firing blast device 665 by a signal path or connection. The switch of the termination unit 610 can be a normally open switch that is connected to or incorporated into the OR logic gate 615. The system can abruptly end the flight of the aircraft or the booster stage by actuating the switch(es) included in one or both of the termination units 610 to interrupt the current from line 686, which detonates one or both of the explosives 665 mounted on the aircraft that destroy all or part of the aircraft essential for flight, such as a booster stage.

[0078] In an embodiment, the error state detected by the fail-safe controller 630 can include one or more of a clock failure in the system controller 620, a loss of power to the system and thus to the system controller 620, a system controller 620 hardware failure, and a system controller 620 software failure. In other embodiments, the error state can include one of the foregoing, all of the foregoing, or a subset of one or more of the foregoing.

[0079] In yet other embodiments, the fail-safe controller 630 may consist of, or include, a "watchdog" function that may take the form of a software watchdog timer. That is, the fail-safe controller 630 may include a timeout clock that must be periodically reset by a signal from the system controller 620. If the system controller 620 does not reset the timeout clock of the fail-safe controller 630, the fail-safe controller 630 will send an end signal to the end unit 610, thereby activating the end unit 610 to end the flight of the aircraft by closing the valve 670 and / or detonating the explosive. In an embodiment, the watchdog function of the fail-safe controller 630 is the watchdog function of a software watchdog timer.

[0080] FIG. 7 shows an example of a top-level block diagram of an AFTU in accordance with aspects of the present disclosure. The example shown includes a GPS receiver 700, an INS 705, and an AFTU 710.

[0081] In some examples, FIG. 7 shows an example of a top-level block diagram of an AFTU 710 in accordance with one or more aspects of the present disclosure. In some examples, the AFTU 710 may be included as a flyaway component of an AFSS that executes a mission (e.g., an MDL file may describe a planned flight envelope set, for example, by a mission planning team). The AFTU 710 may provide onboard range safety by independently monitoring the aircraft dynamics to destroy the missile system if certain end conditions are observed. In some examples, the position of the aircraft is monitored and compared to a mission profile (e.g., an MDL file) to verify that the aircraft is within a defined boundary.

[0082] Additional modes of failure may also be monitored by the AFTU 710 as described herein. For example, each AFTU 710 may provide an independent sensor (e.g., an independent Microelectromechanical Systems (MEMS)-based 3-axis gyro, etc.) to monitor vehicle body rate, enhancing missile system monitoring through the planned flight envelope. Body rate may be fed into some instability detection processing (e.g., the BID algorithm developed by GA-EMS for execution within each AFTU 710, etc.). The AFTU 710 described herein may provide enhanced capabilities (e.g., instability detection monitoring, launch vehicle termination, etc.) to detect and decisively respond to failure scenarios that occur too quickly for the response times of typical flight termination system approaches.

[0083] For example, in the case of boundary limit detection, AFTU 710 may monitor the PVT status of the vehicle with respect to criteria (e.g., boundaries, protected areas, etc.) described in rules included in the MDL file. Devices external to AFTU 710 (e.g., GPS receiver 700, INS 705, IMU, or other devices or sensors, etc.) provide raw status data to AFTU 710. This raw data is received by vendor-provided wrapper software 720 (e.g., position sensing system interface software), which then provides the data to CASS 725. In some examples, CASS 725 may be developed and certified (e.g., by a range safety expert engaged by a governing body), and then CASS 725 may be integrated by the AFTU 710 vendor. Rules governing the predicted host vehicle behavior in response to data from these external devices may be encapsulated within the MDL file embedded within AFTU 710 for a particular mission engagement.

[0084] The GPS receiver 700 is an example of a corresponding element to be described with reference to FIGS. 1, 4 to 6, and 8, or includes an aspect of a corresponding element. The INS 705 is an example of a corresponding element to be described with reference to FIG. 1, or includes an aspect of a corresponding element. The AFTU 710 is an example of a corresponding element to be described with reference to FIG. 8, or includes an aspect of a corresponding element. In one embodiment, the AFTU 710 includes an AFTU processor 715, wrapper software 720, CASS 725, a mission data load file 730, and termination logic 735. The AFTU processor 715 is an example of a corresponding element to be described with reference to FIG. 8, or includes an aspect of a corresponding element. The position sensing system interface software 720 is an example of a corresponding element to be described with reference to FIGS. 8 and 9, or includes an aspect of a corresponding element.

[0085] According to some embodiments, the AFTU 710 is adapted to repeatedly receive a location signal indicating the position of the launch vehicle in three-dimensional space, repeatedly compare the position indicated by the location signal with a planned flight envelope, repeatedly receive a gyro signal indicating the pitch rate and yaw rate of the launch vehicle, repeatedly compare the pitch rate and yaw rate indicated by the gyro signal with maximum defined pitch and yaw rates, and activate the flight termination system 600 when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions consisting of the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum defined pitch and yaw rates, and combinations thereof.

[0086] In some examples, the location signal is repeatedly received at a first sampling rate, the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is higher than the first sampling rate. In some examples, the location signal is repeatedly received at a first sampling rate, the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is lower than the first sampling rate. In some examples, the location signal is repeatedly received at a first sampling rate, the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is equal to the first sampling rate. In some examples, the pitch rate and yaw rate indicated by the gyro signal include separate pitch values and separate yaw values, and the maximum defined pitch rate and yaw rate include separate maximum pitch values and separate maximum yaw values.

[0087] In some examples, repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum defined pitch rate and yaw rate includes comparing a separate pitch value with a separate maximum pitch value and comparing a separate yaw value with a separate maximum yaw value. In some examples, the pitch rate and yaw rate indicated by the gyro signal include combined pitch rate and yaw rate values, and the maximum defined pitch rate and yaw rate include combined maximum pitch rate and yaw rate values. In some examples, repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum defined pitch rate and yaw rate includes comparing the combined pitch rate and yaw rate values with the combined maximum pitch rate and yaw rate values. In some examples, the AFTU 710 comprises a first circuit card assembly including a processor.

[0088] In some examples, AFTU710 includes a second circuit card assembly that includes input and output interface circuits. In some examples, AFTU710 includes a third circuit card assembly that includes a power regulation circuit. In some examples, AFTU710 includes a fourth circuit card assembly that includes a connector and connector circuits. In some examples, AFTU710 includes a first circuit card assembly that includes a processor and a position sensing system. In some examples, AFTU710 includes a second circuit card assembly that includes input and output interface circuits. In some examples, AFTU710 includes a third circuit card assembly that includes a power regulation circuit. In some examples, AFTU710 includes a fourth circuit card assembly that includes a connector and connector circuits.

[0089] AFTU710 is an example of corresponding elements or includes aspects of corresponding elements, which will be described with reference to FIGS. 7 and 8.

[0090] According to some embodiments, CASS725 repeatedly receives a location signal indicating a position in the three-dimensional space of the launch vehicle. In some examples, CASS725 repeatedly compares the position indicated by the location signal with a planned flight envelope. In some examples, CASS725 repeatedly compares the pitch rate and yaw indicated by a gyro signal with maximum defined pitch and yaw rates. In some examples, the location signal is repeatedly received at a first sampling rate and the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is higher than the first sampling rate. In some examples, the location signal is repeatedly received at a first sampling rate and the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is lower than the first sampling rate. In some examples, the location signal is repeatedly received at a first sampling rate and the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is equal to the first sampling rate.

[0091] According to some embodiments, the position sensing system includes a GPS receiver 700, the AFTU 710 is coupled to the GPS receiver 700, the GPS receiver 700 generates a location signal, and the position sensing system receives the location signal.

[0092] The CASS 725 is an example of a corresponding element or includes an aspect of a corresponding element described with reference to FIGS. 8 and 9. The mission data load file 730 is an example of a corresponding element or includes an aspect of a corresponding element described with reference to FIGS. 8 and 9.

[0093] According to some embodiments, the termination logic 735 activates the flight termination system when at least one termination condition selected from a group of termination conditions is detected, and the group of termination conditions consists of the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum specified pitch rate and yaw rate, and combinations thereof.

[0094] The termination logic 735 is an example of a corresponding element or includes an aspect of a corresponding element described with reference to FIG. 8.

[0095] FIG. 8 shows an example of a top-level block diagram of an AFTU according to an aspect of the present disclosure. FIG. 8 shows an example of a top-level block diagram of an AFTU 800 according to one or more aspects of the present disclosure. In some examples, the AFTU 800 may include an optional integration of a GPS receiver 835 (e.g., a third-party GPS receiver 835) within the AFTU 800 in addition to any external devices. By doing so, it may be possible to determine the PVT state of the aircraft without external GPS support. Rules for managing a safe trajectory according to location information data (e.g., PVT state, etc.) are embedded within an MDL file, and the raw location information data itself is provided to the CASS 820. This PVT state information is sufficient to determine whether the aircraft has crossed a safety operating boundary for its planned flight path, but such data may not necessarily be conclusive in determining whether the aircraft is stable (e.g., controlled).

[0096] For example, the aircraft may become unstable and move erratically while still maintaining its orbit (e.g., and PVT state) within the defined boundary limits described in the MDL file. This may potentially result in a catastrophic failure scenario where the aircraft becomes rotationally unstable without leaving its nominal flight path boundary volume and triggering a timely termination. The present disclosure provides an AFTU 800 that can address such scenarios through body instability detection as described herein. One or more aspects of the present disclosure may be implemented to detect aircraft instability (e.g., the erratic movement of a launch vehicle) and then issue an end command upon detection of such end conditions. The AFTU 800 may provide enhanced performance by increasing the capabilities inherent to the AFTU 800 itself within a rapid response timeline without relying on any external sensors.

[0097] The AFTU800 integrates an independent three-axis gyro 840 and instability detection processing 810 (e.g., a custom BID algorithm) to monitor the angular velocity of the aircraft (e.g., by repeatedly receiving gyro 840 signals indicating the pitch rate and yaw rate of a launch vehicle), to determine whether the aircraft is no longer under stable control, and to issue an automatic termination under such conditions. The AFTU800 can perform such operations while faithfully adhering to the structure of the CASS820 framework. The output of the instability detection processing 810 can be provided to the CASS820 as a sensor input (e.g., via a user-definable mechanism provided by the CASS820). End condition (e.g., BID) output parameters corresponding to the instability detection processing 810 can be defined in the MDL file (e.g., together with other sensors). The CASS820 can issue any termination decision based on the MDL file. The integrated three-axis gyro 840 and the associated processing within the AFTU800 itself can provide a fully integrated, robust, and truly autonomous safety solution.

[0098] For a single integrated system, beyond including the sensing device within the reduced size, weight, and volume of the AFTU800, one or more aspects of the present disclosure also enable the possibility for the instability detection processing 810 (e.g., a set of BID algorithms) to capture a gyro 840 sampling rate higher than the CASS820 update rate. One or more aspects of the present disclosure also provide filtering, threshold detection, and verification that rely on the implementation of the AFSS. Further, the present disclosure enables the description and execution of one or more reliable and robust stability or instability indications as outputs for use within the MDL.

[0099] The AFTU800 includes examples of corresponding elements or aspects of corresponding elements, which will be described with reference to FIG. 7. In one embodiment, the AFTU800 includes an AFTU processor 805, wrapper software 815, CASS 820, mission data load file 825, termination logic 830, GPS receiver 835, and gyro 840. The AFTU processor 805 includes examples of corresponding elements or aspects of corresponding elements, which will be described with reference to FIG. 7. In one embodiment, the AFTU processor 805 includes an instability detection process 810.

[0100] According to some embodiments, the instability detection process 810 repeatedly receives gyro 840 signals indicative of the pitch rate and yaw rate of the launch vehicle. In some examples, the pitch rate and yaw rate indicated by the gyro 840 signals include separate pitch values and separate yaw values, and the maximum defined pitch rate and yaw rate include separate maximum pitch values and separate maximum yaw values. In some examples, repeatedly comparing the pitch rate and yaw rate indicated by the gyro 840 signals with the maximum defined pitch rate and yaw rate includes comparing a separate pitch value with a separate maximum pitch value and comparing a separate yaw value with a separate maximum yaw value. In some examples, the pitch rate and yaw rate indicated by the gyro 840 signals include combined pitch rate and yaw rate values, and the maximum defined pitch rate and yaw rate include combined maximum pitch rate and yaw rate values. In some examples, repeatedly comparing the pitch rate and yaw rate indicated by the gyro 840 signals with the maximum defined pitch rate and yaw rate includes comparing the combined pitch rate and yaw rate values with the combined maximum pitch rate and yaw rate values.

[0101] The instability detection process 810 includes an example of a corresponding element or an aspect of a corresponding element, which will be described with reference to FIG. 9. The position sensing system interface software 815 includes an example of a corresponding element or an aspect of a corresponding element, which will be described with reference to FIGS. 7 and 9. The CASS 820 includes an example of a corresponding element or an aspect of a corresponding element, which will be described with reference to FIGS. 7 and 9. The mission data load file 825 includes an example of a corresponding element or an aspect of a corresponding element, which will be described with reference to FIGS. 7 and 9. The termination logic 830 includes an example of a corresponding element or an aspect of a corresponding element, which will be described with reference to FIG. 7. The GPS receiver 835 includes an example of a corresponding element or an aspect of a corresponding element, which will be described with reference to FIGS. 1 and 4 through 7. The gyro 840 includes an example of a corresponding element or an aspect of a corresponding element, which will be described with reference to FIG. 9.

[0102] FIG. 9 shows an example of an instability detection process diagram according to an aspect of the present disclosure. The example shown includes a gyro 900, an instability detection process 905, wrapper software 910, and CASS 915.

[0103] FIG. 9 shows an exemplary block diagram of an instability detection process 905 (e.g., including or implemented via a BID algorithm, a GA-EMS BID algorithm, instability detection process 905 hardware, etc.) according to one or more aspects of the present disclosure. A gyro 900 that provides angular velocity for each of three rotation axes is sampled (e.g., via the instability detection process 905) at a rate that may be significantly higher than the rate adapted by the CASS 915 for its sensor input. This raw sensor is sampled at the raw input rate and may all include subsequent bandwidth and rate reduction to eliminate false detections. The instability detection process 905 can be either per axis or a single composite value. Finally, the instability detection process 905 (e.g., may include or be called a BID algorithm) generates one or more output indicators that are received by the CASS 915. This can enable rapid detection of the stability or instability of the airframe and, in some cases, can enable automatic termination of one or more airframe operations (e.g., termination of the launch vehicle by the AFTU). Thus, an unstable airframe, an unsafe airframe, an airframe tumbling dangerously, etc. may have operations terminated according to the criteria set by the MDL file, even if the PVT state of the airframe is still within a safe orbit boundary.

[0104] The gyro 900 is an example of or includes aspects of the corresponding element described with reference to FIG. 8. The instability detection process 905 is an example of or includes aspects of the corresponding element described with reference to FIG. 8. The position sensing system interface software 910 is an example of or includes aspects of the corresponding element described with reference to FIGS. 7 and 8. The CASS 915 is an example of or includes aspects of the corresponding element described with reference to FIGS. 7 and 8.

[0105] Figure 10 shows an example of a process for ending autonomous flight according to an aspect of the present disclosure. In some examples, these operations are performed by a system including a processor that executes a set of code to control the functional elements of the device. Additionally or alternatively, certain processes are performed using application-specific hardware. Generally, these operations are performed according to the methods and processes described in aspects of the present disclosure. In some cases, the operations described herein are composed of various sub-steps or are performed in conjunction with other operations.

[0106] In operation 1000, the system repeatedly receives a location signal indicating the position of the launch vehicle in three-dimensional space. In some cases, the operation of this step may refer to or be performed by CASS as described with reference to FIGS. 7 to 9.

[0107] In operation 1005, the system repeatedly compares the position indicated by the position signal with the planned flight envelope. In some cases, the operation of this step may refer to or be performed by CASS as described with reference to FIGS. 7 to 9.

[0108] In operation 1010, the system repeatedly receives a gyro signal indicating the pitch rate and yaw rate of the launch vehicle. In some cases, the operation of this step may refer to or be performed by the instability detection process as described with reference to FIGS. 8 and 9.

[0109] In operation 1015, the system repeatedly compares the pitch rate and yaw rate indicated by the gyro signal with the maximum specified pitch rate and yaw rate. In some cases, the operation of this step may refer to or be performed by CASS as described with reference to FIGS. 7 to 9.

[0110] In operation 1020, the system activates the flight termination system if at least one selected condition from a group of termination conditions is detected, where the group of termination conditions consists of the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum specified pitch rate and yaw rate, and combinations thereof. Optionally, the operation of this step may refer to or be performed by termination logic, as described with reference to FIGS. 7 and 8.

[0111] Accordingly, the present disclosure includes the following embodiments.

[0112] An apparatus for autonomous flight termination is described. One or more embodiments of the apparatus include a position sensing system, a three-axis gyroscope, and a processor adapted to repeatedly receive a location signal indicating the position of the launch vehicle in three-dimensional space, repeatedly compare the position indicated by the location signal with the planned flight envelope, repeatedly receive gyro signals indicating the pitch rate and yaw rate of the launch vehicle, repeatedly compare the pitch rate and yaw rate indicated by the gyro signals with the maximum specified pitch rate and yaw rate, and activate the flight termination system if at least one termination condition selected from a group of termination conditions is detected, where the group of termination conditions consists of the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum specified pitch rate and yaw rate, and combinations thereof, and a termination system configured to initiate termination of the launch vehicle in response to activation of the flight termination system.

[0113] A system for terminating autonomous flight, the system comprising: a position sensing system; a three-axis gyroscope; a processor adapted to repeatedly receive a location signal indicating the position of the launch vehicle in three-dimensional space, repeatedly compare the position indicated by the location signal with a planned flight envelope, repeatedly receive gyroscope signals indicating the pitch rate and yaw rate of the launch vehicle, repeatedly compare the pitch rate and yaw rate indicated by the gyroscope signals with maximum defined pitch and yaw rates, and activate a flight termination system when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions including the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum defined pitch and yaw rates, and combinations thereof; and a termination system configured to initiate termination of the launch vehicle in response to activation of the flight termination system.

[0114] A method of manufacturing an apparatus for terminating autonomous flight is described. The method includes manufacturing a processor adapted to repeatedly receive a location signal indicating the position of the launch vehicle in three-dimensional space, repeatedly compare the position indicated by the location signal with a planned flight envelope, repeatedly receive gyroscope signals indicating the pitch rate and yaw rate of the launch vehicle, repeatedly compare the pitch rate and yaw rate indicated by the gyroscope signals with maximum defined pitch and yaw rates, and activate a flight termination system when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions including the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum defined pitch and yaw rates, and combinations thereof; and a termination system configured to initiate termination of the launch vehicle in response to activation of the flight termination system.

[0115] In some examples, the position sensing system includes a global positioning system (GPS) receiver. In some examples, the position sensing system further includes an inertial navigation system. Some examples of the apparatus, system, and method described above further include a GPS receiver, the autonomous flight termination unit is coupled to the GPS receiver, the GPS receiver generates a location signal, and the position sensing system receives the location signal.

[0116] In some examples, the location signal is repeatedly received at a first sampling rate, the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is higher than the first sampling rate. In some examples, the location signal is repeatedly received at a first sampling rate, the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is lower than the first sampling rate.

[0117] In some examples, the location signal is repeatedly received at a first sampling rate, the gyro signal is repeatedly received at a second sampling rate, and the second sampling rate is equal to the first sampling rate. In some examples, the pitch rate and yaw rate indicated by the gyro signal include separate pitch values and separate yaw values, and the maximum defined pitch rate and yaw rate include separate maximum pitch values and separate maximum yaw values.

[0118] In some examples, repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum defined pitch rate and yaw rate includes comparing a separate pitch value with a separate maximum pitch value and comparing a separate yaw value with a separate maximum yaw value. In some examples, the pitch rate and yaw rate indicated by the gyro signal include combined pitch rate and yaw rate values, and the maximum defined pitch rate and yaw rate include combined maximum pitch rate and yaw rate values.

[0119] In some examples, repeatedly comparing the pitch rate and yaw rate indicated by gyro signals with maximum defined pitch and yaw rates includes comparing combined pitch rate and yaw rate values with combined maximum pitch rate and yaw rate values. Some examples of the apparatus, system, and method described above further include a first circuit card assembly that includes a processor. Some examples further include a second circuit card assembly that includes input and output interface circuits. Some examples further include a third circuit card assembly that includes a power regulation circuit.

[0120] Some examples of the apparatus, system, and method described above further include a fourth circuit card assembly that includes a connector and connector circuits. Some examples of the apparatus, system, and method described above further include a first circuit card assembly that includes a processor and a position sensing system. The apparatus, system, and method described above further include a second circuit card assembly that includes input and output interface circuits. Some examples further include a third circuit card assembly that includes a power regulation circuit. Some examples of the apparatus, system, and method described above further include a fourth circuit card assembly that includes a connector and connector circuits.

[0121] Some examples of the apparatus, system, and method described above further include a processor-readable memory that includes software. In some examples, the software includes a mission data load file that includes rules regarding the position, velocity, and time of the vehicle, as well as termination logic, and the termination logic is configured to execute activation of a flight termination system when at least one termination condition selected from a group of termination conditions is detected.

[0122] In some examples, the software further comprises core autonomous safety software and position sensing system interface software (e.g., wrapper software) coupled to the core autonomous safety software. Some examples of the apparatus, system, and method described above further include a second circuit card assembly including input and output interface circuits. Some examples further include a third circuit card assembly including a power regulation circuit. Some examples of the apparatus, system, and method described above further include a fourth circuit card assembly including a connector and connector circuits.

[0123] A method for terminating autonomous flight is described. One or more embodiments of the method include repeatedly receiving a location signal indicative of the position of a launch vehicle in three-dimensional space, repeatedly comparing the position indicated by the location signal with a planned flight envelope, repeatedly receiving gyro signals indicative of the pitch rate and yaw rate of the launch vehicle, repeatedly comparing the pitch rate and yaw rate indicated by the gyro signals with maximum defined pitch and yaw rates, and activating a flight termination system when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions including the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum defined pitch and yaw rates, and combinations thereof.

[0124] An apparatus for terminating autonomous flight is described. The apparatus includes a processor, a memory in electronic communication with the processor, and instructions stored in the memory. The instructions cause the processor to repeatedly receive a location signal indicating the position of the launch vehicle in three-dimensional space, repeatedly compare the position indicated by the location signal with a planned flight envelope, repeatedly receive gyro signals indicating the pitch rate and yaw rate of the launch vehicle, repeatedly compare the pitch rate and yaw rate indicated by the gyro signals with maximum specified pitch and yaw rates, and activate a flight termination system when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions including the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum specified pitch and yaw rates, and combinations thereof.

[0125] A non-transitory computer-readable medium storing code for terminating autonomous flight is described. In some examples, the code causes the processor to repeatedly receive a location signal indicating the position of the launch vehicle in three-dimensional space, repeatedly compare the position indicated by the location signal with a planned flight envelope, repeatedly receive gyro signals indicating the pitch rate and yaw rate of the launch vehicle, repeatedly compare the pitch rate and yaw rate indicated by the gyro signals with maximum specified pitch and yaw rates, and activate a flight termination system when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions including the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum specified pitch and yaw rates, and combinations thereof, and comprises instructions executable by a processor to perform the steps.

[0126] A system for terminating autonomous flight is described. One or more embodiments of the system include repeatedly receiving a location signal indicating the position of the launch vehicle in three-dimensional space, repeatedly comparing the position indicated by the location signal with a planned flight envelope, repeatedly receiving a gyro signal indicating the pitch rate and yaw rate of the launch vehicle, repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with maximum defined pitch and yaw rates, and activating a flight termination system when at least one termination condition selected from a group of termination conditions is detected, the group of termination conditions including the position being outside the planned flight envelope, the pitch rate and yaw rate exceeding the maximum defined pitch and yaw rates, and combinations thereof.

[0127] In some examples, the location signal is repeatedly received at a first sampling rate and the gyro signal is repeatedly received at a second sampling rate, the second sampling rate being higher than the first sampling rate. In some examples, the location signal is repeatedly received at a first sampling rate and the gyro signal is repeatedly received at a second sampling rate, the second sampling rate being lower than the first sampling rate. In some examples, the location signal is repeatedly received at a first sampling rate and the gyro signal is repeatedly received at a second sampling rate, the second sampling rate being equal to the first sampling rate.

[0128] In some examples, the pitch rate and yaw rate indicated by the gyro signal include separate pitch and yaw values, and the maximum defined pitch and yaw rates include separate maximum pitch and yaw values. In some examples, repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum defined pitch and yaw rates includes comparing the separate pitch value with the separate maximum pitch value and comparing the separate yaw value with the separate maximum yaw value.

[0129] In some examples, the pitch rate and yaw rate indicated by the gyro signal include combined pitch rate and yaw rate values, and the maximum defined pitch rate and yaw rate include combined maximum pitch rate and yaw rate values. In some examples, repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum defined pitch rate and yaw rate includes comparing the combined pitch rate and yaw rate values with the combined maximum pitch rate and yaw rate values.

[0130] Some of the functional units described herein are labeled as modules or components in order to particularly emphasize their implementation independence. For example, a module can be implemented as a hardware circuit comprising off-the-shelf semiconductors such as custom very large scale integration (VLSI) circuits or gate arrays, logic chips, transistors, or other discrete components. A module can also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, and the like.

[0131] A module can also be implemented in software for execution by various types of processors. An identifying module of executable code can comprise, for example, one or more physical or logical blocks of computer instructions, which can be compiled, for example, as an object, procedure, or function. Nevertheless, the executable files of the identifying module are not necessarily physically located together, and when logically joined together, can comprise instructions of different types stored in different locations that together comprise a module and achieve the stated purpose of the module.

[0132] In fact, a module of executable code can be a single instruction or many instructions and can still be distributed among different programs and across several memory devices via several different code segments. Similarly, the operational data can be identified and exemplified within a module herein, can be embodied in any suitable form, and can be organized within any suitable type of data structure. The operational data can be grouped as a single data set or can be distributed across different locations including across different storage devices and can exist at least partially simply as electronic signals on a system or network.

[0133] Although the invention disclosed herein has been described with reference to specific embodiments, examples, and applications thereof, numerous modifications and variations can be made by those skilled in the art without departing from the scope of the invention as set forth in the claims.

Claims

A self - flying safety system comprising an autonomous flight termination unit, wherein the autonomous flight termination unit has a position sensing system, a three - axis gyroscope, a processor, and a flight termination system; the flight termination system is configured to initiate the termination of the launcher in response to the activation of the flight termination system; the processor repeatedly receives a location signal indicating the position of the launcher in three - dimensional space; repeatedly compares the position indicated by the location signal with a planned flight envelope; repeatedly receives a gyro signal indicating the pitch rate and yaw rate of the launcher; repeatedly determines whether the launcher is in an unstable state using at least the gyro signal as an input to an algorithm including a predetermined mission rule for managing predicted launcher behavior, wherein the unstable state includes tumbling of the launcher, and the algorithm includes comparing the pitch rate and yaw rate indicated by the gyro signal with maximum defined pitch and yaw rates; activates the flight termination system when the launcher is determined to be in an unstable state, whereby the launcher is terminated in response to the activation; A self - flying safety system adapted to perform the above.

2. The self - flying safety system according to claim 1, comprising the position sensing system having a global positioning system receiver.

3. The self - flying safety system according to claim 2, further comprising the position sensing system having an inertial navigation system.

4. A global positioning system receiver; the autonomous flight termination unit coupled to the global positioning system receiver, the global positioning system receiver generating the location signal and the position sensing system receiving the location signal; The self - flying safety system according to claim 1, further comprising the above.

5. further comprising the processor, wherein the processor repeatedly receives the location signal at a first sampling rate; repeatedly receives the gyro signal at a second sampling rate; is adapted to perform the above, The autonomous flight safety system according to claim 1, wherein the second sampling rate is higher than the first sampling rate.

6. Further comprising the processor, The processor is The step of repeatedly receiving the location signal at a first sampling rate, The step of repeatedly receiving the gyro signal at a second sampling rate, Adapted to execute, The autonomous flight safety system according to claim 1, wherein the second sampling rate is lower than the first sampling rate.

7. Further comprising the processor, The processor is The step of repeatedly receiving the location signal at a first sampling rate, The step of repeatedly receiving the gyro signal at a second sampling rate, Adapted to execute, The autonomous flight safety system according to claim 1, wherein the second sampling rate is equal to the first sampling rate.

8. The step of repeatedly receiving the gyro signal indicating the pitch rate and yaw rate of the launcher, The step of repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum specified pitch rate and yaw rate, wherein the pitch rate and yaw rate indicated by the gyro signal include separate pitch values and separate yaw values, and the maximum specified pitch rate and yaw rate include separate maximum pitch values and separate maximum yaw values, and the step of repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum specified pitch rate and yaw rate includes comparing the separate pitch value with the separate maximum pitch value and comparing the separate yaw value with the separate maximum yaw value, The autonomous flight safety system according to claim 1, further comprising the processor adapted to execute.

9. The step of repeatedly receiving the gyro signal indicating the pitch rate and yaw rate of the launcher, The step of repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum defined pitch rate and yaw rate, wherein the pitch rate and yaw rate indicated by the gyro signal include combined pitch rate and yaw rate values, the maximum defined pitch rate and yaw rate include combined maximum pitch rate and yaw rate values, and the step of repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum defined pitch rate and yaw rate includes comparing the combined pitch rate and yaw rate values with the combined maximum pitch rate and yaw rate values. The autonomous flight safety system according to claim 1, further comprising the processor adapted to execute the same.

10. A first circuit card assembly including the processor; A second circuit card assembly including an input and output interface circuit; A third circuit card assembly including a power regulation circuit; The autonomous flight safety system according to claim 1, further comprising the same.

11. The autonomous flight safety system according to claim 10, further comprising a fourth circuit card assembly including a connector and a connector circuit.

12. The autonomous flight safety system according to claim 1, further comprising a first circuit card assembly including the processor and the position sensing system.

13. A second circuit card assembly including an input and output interface circuit; A third circuit card assembly including a power regulation circuit; The autonomous flight safety system according to claim 12, further comprising the same.

14. The autonomous flight safety system according to claim 12, further comprising a fourth circuit card assembly including a connector and a connector circuit.

15. The autonomous flight safety system according to claim 12, further comprising a processor-readable memory having software.

16. The software has a mission data load file having rules regarding the position, speed, and time of the aircraft, and an end logic; The end logic is configured to execute the activation of the flight termination system when it is determined that the launch vehicle is in an unstable state. The autonomous flight safety system according to claim 15.

17. The software is Core autonomous safety software; The position sensing system interface software coupled to the core autonomous safety software, The autonomous flight safety system according to claim 16, further comprising.

18. A second circuit card assembly including an input and output interface circuit, A third circuit card assembly including a power regulation circuit, The autonomous flight safety system according to claim 16, further comprising.

19. The autonomous flight safety system according to claim 18, further comprising a fourth circuit card assembly including a connector and a connector circuit.

20. An autonomous flight safety method, Repeatedly receiving a location signal indicating the position of the launch vehicle in three-dimensional space, Repeatedly comparing the position indicated by the location signal with a planned flight envelope, Repeatedly receiving a gyro signal indicating the pitch rate and yaw rate of the launch vehicle, Using at least the gyro signal as an input to an algorithm including a predetermined mission rule for managing the predicted behavior of the launch vehicle, repeatedly determining whether the launch vehicle is in an unstable state, the unstable state including tumbling of the launch vehicle, and the algorithm comparing the pitch rate and yaw rate indicated by the gyro signal with a maximum specified pitch rate and yaw rate, Activating a flight termination system communicatively coupled to a processor and configured to terminate the launch vehicle upon its activation when the launch vehicle is determined to be in an unstable state, whereby the launch vehicle is terminated in response to the activation, A method including.

21. Repeatedly receiving the location signal, repeated at a first sampling rate, Repeatedly receiving the gyro signal, repeated at a second sampling rate, and further comprising, The autonomous flight safety method according to claim 20, wherein the second sampling rate is higher than the first sampling rate.

22. Repeatedly receiving the location signal, repeated at a first sampling rate, Repeatedly receiving the gyro signal, repeated at a second sampling rate, and further comprising, The self - piloted flight safety method according to claim 20, wherein the second sampling rate is lower than the first sampling rate.

23. Repeatedly receiving the location signal at a first sampling rate; Further comprising repeatedly receiving the gyro signal at a second sampling rate, The self - piloted flight safety method according to claim 20, wherein the second sampling rate is equal to the first sampling rate.

24. Repeatedly receiving the gyro signal indicating the pitch rate and yaw rate of the launch vehicle; Repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum specified pitch rate and yaw rate, wherein the pitch rate and yaw rate indicated by the gyro signal include separate pitch values and separate yaw values, the maximum specified pitch rate and yaw rate include separate maximum pitch values and separate maximum yaw values, and repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum specified pitch rate and yaw rate includes comparing the separate pitch value with the separate maximum pitch value and comparing the separate yaw value with the separate maximum yaw value. The self - piloted flight safety method according to claim 20, further comprising the above.

25. Repeatedly receiving the gyro signal indicating the pitch rate and yaw rate of the launch vehicle; Repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum specified pitch rate and yaw rate, wherein the pitch rate and yaw rate indicated by the gyro signal include combined pitch rate and yaw rate values, the maximum specified pitch rate and yaw rate include combined maximum pitch rate and yaw rate values, and repeatedly comparing the pitch rate and yaw rate indicated by the gyro signal with the maximum specified pitch rate and yaw rate includes comparing the combined pitch rate and yaw rate values with the combined maximum pitch rate and yaw rate values. The self - piloted flight safety method according to claim 20, further comprising the above.

Images