CROSS-REFERENCE TO RELATED APPLICATIONSThis application is a continuation-in-part of application Ser. No. 08/832874, filed Apr. 4, 1997, which is a continuation of application Ser. No. 08/439,955, filed May 12, 1995, now abandoned.[0001]
BACKGROUND OF THE INVENTIONThis invention relates generally to aviation crash sensors and, more particularly, to a crash sensor which senses acceleration along three orthogonal axes and processes acceleration vector data to detect an omnidirectional crash.[0002]
Mechanical acceleration threshold detection devices have been used in the automotive industry to lock seat belt retractors to restrain occupants in their seats in the event of a sensed threshold acceleration along the vehicle longitudinal axis to indicate a frontal crash. These devices are normally mechanical devices utilizing a pendulum or a ball-and-ramp arrangement to sense acceleration in one or two planes. Recently, TRW has developed a seat belt tensioning retractor for Mercedes-Benz that is activated by the automobile on-board computer when it senses a 0.7 G frontal impact to pretension the passenger seat belts.[0003]
With the advent of air bags, electronic accelerometers have been devised to actuate air bags. Such electronic accelerometers are illustrated in U.S. Pat. No. 3,762,495—Usui et al and U.S. Pat. No. 4,984,464—Thomas et al. However, none of these automotive crash sensing devices or systems is useful for detecting crashes which do not occur in the horizontal plane of vehicle operation, such as rollover crashes.[0004]
Mechanical accelerometers have also been used in the aircraft industry to activate a safety device, such as to lock an aircraft occupant's shoulder harness retractor or to tighten the harness when a threshold acceleration is sensed. A crash sensor for an airplane was previously developed to cut out the electrical circuit, cut off fuel and operate fire extinguishers when a crash was detected, as shown in U.S. Pat. No. 2,573,335. However, these accelerometers are mechanical and react relatively slowly to a crash, thus slowing activation of the safety devices.[0005]
An impact indicator was previously developed to detect when aircraft landing gear has been stressed beyond predetermined critical limits. U.S. Pat. No. 3,389607—Kishel discloses such a system, which utilizes a complex mechanical triaxial acceleration sensor.[0006]
Many aircraft crashes or impacts are not necessarily catastrophic, in that they could be survivable by the aircrew if movement of the aircraft occupants during the crash is restrained. For example, helicopters may suffer engine or rotor failures as a result of combat damage or other malfunctions, which will cause a relatively low-speed crash. These crashes could be survivable by the aircrew if the aircraft crewmen were quickly secured in their seats in a manner to limit their so-called “flail envelope”.[0007]
It would be desirable to provide a crash sensor having three-axis sensing which compares aircraft accelerations to a crash algorithm for each of a variety of different aircraft.[0008]
It would also be desirable to provide a crash sensor which automatically identifies the aircraft mounting orientation and automatically converts sensed accelerations into vehicle axis equivalents.[0009]
It would further be desirable to provide a method of and apparatus for evaluating vehicle acceleration data for a plurality of different vehicles having axes which are different from the measurement axes to identify a predetermined event.[0010]
SUMMARY OF THE INVENTIONIt is an object of this invention to provide a crash sensor having three-axis sensing which compares aircraft accelerations to a crash algorithm for each of a variety of different aircraft.[0011]
It is another object of this invention to provide a crash sensor which automatically identifies the aircraft mounting orientation and automatically converts sensed accelerations into vehicle axis equivalents.[0012]
It is a further object of this invention to provide a method of, and apparatus for, evaluating vehicle acceleration data for a plurality of different vehicles having axes which are different from the measurement axes to identify a predetermined event.[0013]
An electronic crash sensor according to this invention utilizes solid-state electronic accelerometers to provide 3-axis, mutually orthogonal aircraft acceleration data to a microprocessor-based controller. The crash sensor may have a mounted orientation in which sensor axes differ from aircraft X, Y and Z axes and is programmed to convert measured data to equivalent vehicle axis data. The sensor periodically samples the acceleration signals from the accelerometers and internal signals, converts them to digital format, converts them to vehicle equivalent accelerations, and processes these signals under control of a crash-detection algorithm to detect a crash threshold. By modifying key processing parameters from an external computer, the controlling programs may be tailored to a variety of different vehicles and physical mounting orientations.[0014]
These and further objects and features of this invention will become more readily apparent upon reference to the following detailed description of a preferred embodiment, as illustrated in the accompanying drawings, in which:[0015]
BRIEF DESCRIPTION OF THE DRAWINGSFIG. 1 is a perspective view of a helicopter shown in flight, which incorporates a crash sensor according to this invention;[0016]
FIG. 2 is a partial perspective view of an aircrewman wearing a safety harness that incorporates a webbing retractor that is alternatively manually operated and operated by a crash sensor according to this invention;[0017]
FIG. 3 is an enlarged plan view of the retractor of FIG. 2, partially broken away to illustrate details of construction;[0018]
FIG. 4 is a vector diagram showing the geometric relationship of the crash sensor axes to the resident helicopter orthogonal axes;[0019]
FIGS. 5[0020]aand5bare diagrams plotting the vertical and horizontal fire/no fire criteria used in evaluating helicopter accelerations to determine existence of a crash threshold and output a signal to fire a squib;
FIG. 6 is a schematic diagram of the crash sensor logic circuitry; and[0021]
FIG. 7 is a schematic diagram of the crash sensor power circuitry.[0022]
DETAILED DESCRIPTION OF A PREFERRED EMBODIMENTFIG. 1 of the drawings shows a[0023]helicopter10 having amain lift rotor12 and atail rotor14 driven by a pair ofturbine engines16 and18 via a transmission (not illustrated). Helicopter10 is illustrated as a Black Hawk or Sea Hawk helicopter, but could be any helicopter or other aircraft or vehicle operating in three dimensions.Helicopter10 includes acabin20 housing a pilot and copilot or other personnel, only one of whichoccupant22 is shown in FIG. 2. A pair of side-mounted weapons pods24 and26 extend outwardly ofcabin20 on mountingarms28 and30.
Occupant[0024]22 is fitted with aprotective helmet34 and aharness36 to restrain historso38 in his seat (not shown) in a well-known manner. Harness36 is a conventional, available harness such as a Model MIL-S-58095 type five-way restraint system, made by H. Koch & Sons Co. It is modified to include dual lead-instraps40 and42 which attach to theharness36 and extend rearwardly through anopening44 in the seat and downwardly into a webbing reel orretractor46.Retractor46 is lockable by manipulation of amanual actuator48, via acable50.
In the event of a crash of[0025]helicopter10,retractor46 is commanded by an electronic crash sensor unit (ECSU)52 via anelectric cable54 to retractwebbing strips40 and42 to secureoccupant22 in his seat, as will be described below. ECSU52 is preferably mounted on the floor rearwardly of the seat, although the mounting and orientation will vary from vehicle to vehicle.
In FIG. 3[0026]retractor46 is illustrated as a modification of a Model MA-8 Inertia Reel currently produced by H. Koch & Sons, Inc., Anaheim, Calif.Retractor46 includes ahousing56 mounting arotatable shaft adapter58 which connects the retractor to the inertia reel. Aclutch60 is operably connected to aretraction piston62 which is driven within adrive cylinder64 by apower cylinder66. When pyrotechnic material in the form of asquib68 withinpower cylinder66 is ignited, it drives a blockingmember70 upwardly to open access of high pressure-gas inreservoir72 to afeed channel74. This high-pressure gas drivespiston62 downwardly incylinder64 to engageclutch60 which drivesreel58 to retractwebbing strips40 and42 to tightenharness36 aboutoccupant22, securing him in his seat.
A[0027]connector74 operably connects thesquib igniter76 withelectric cable54 which transmits output signals from ECSU52. Alternatively,ECSU output cable54 can be connected to squibs which operate air bags or other safety devices. As shown in FIGS. 6 and 7,ECSU52 comprises a microcontroller processing unit (MPU)80, such as a Motorola Model MC68332 microcontroller, which has a power monitor81 and is powered by apower supply82 throughinterface connectors84 and86. As shown in FIG. 7, the source of power is normally 28 VDC aircraft power supplied by a vehicle-mountedconnector87 through a crash sensorpower supply connector88, which is then converted to 5 VDC for use byECSU52. Alternatively, an emergency 6-cell 7.2-VDC batterybackup power pack90 supplies power to enable operation when the main power supply fails, such as during a crash.
Vehicle[0028]power supply connector87 contains a six-pin arrangement unique to the vehicle type. This provides64 unique combinations of binary code to identify the specific vehicle toECSU52 through the interface withconnector88 so thatECSU52 can identify the specific vehicle in which it is mounted.
Three electronic accelerometers, such as I C Sensors Model ICS 3255[0029]accelerometers92,94,96 are mounted to provide analog acceleration inputs for each of three orthogonal axes toECSU52. These accelerometers are arranged orthogonally to sense accelerations along three mutually perpendicular axes (X, Y and Z) and output acceleration signals for each axis through band-pass (BP) filters98,100 and102 toMPU80. Each filter's low frequency corner is suitably low to pass along acceleration pulses while blocking undesirable drift and offset characteristics of the transducers. The high frequency corner provides antialiasing and noise reduction. The acceleration signals, along with various crash sensor self-test voltages andreference voltage103, enter a multi-channel analog-to-digital (A/D)converter104 and are converted into binary format for use byMPU80. Alternatively, the accelerometers could be digital, eliminating the need for A/D converter104.
[0030]ECSU52 operates under control of its firmware program that is resident in a 2-megabyte, non-volatile,programmable flash RAM105, which contains a vehicle-identification axis conversion program and a crash identification program, as will be later described.ECSU sensor52 also includes a 2 megabyte volatile, temporary CMOS RAM106, an external debugging connector108, adecoding chip selector110, and a serial port112 which connects toMPU80 through abuffer114.
[0031]MPU80 incorporates a 32-bit CPU with a special time processor unit and queued serial module for integrated timing and serial data features, providing simplified, autonomous peripheral control through its high-speed serial data bus. Under program control,MPU80 can erase and reprogram portions offlash RAM105, allowing crash data to be collected and stored for subsequent analysis. In addition, new operating parameters as well as entire programs can be entered through serial port112 to replace previous non-volatile information. This provides operational flexibility without any physical modifications toECSU52.
Connector[0032]108 is used to initially load the programs into memory and enables debugging new program versions.Interface86 is used for communication and control of various internal and external subsystems during operation ofECSU52. Serial port112 provides standard R-232 serial communications with external equipment, and enables external data collection and ECSU reconfiguration without physical entrance intoECSU52.
In the power circuitry shown in FIG. 7, 28-VDC vehicle power enters through[0033]connectors87 and88, anEMI filter120, and feeds a DC/DC buck converter122 and a NiCAD battery charger124.Converter122 steps the aircraft voltage down to 7.5 VDC. Battery charger124 cycles off and on to keepbattery pack90 fully charged. Avoltage regulator126 steps the voltage down to 5 VDC for use by the rest of theECSU52 circuitry. A push-button128 is provided for self-testingECSU52.
Data registers[0034]130 and132 provide serial data toMPU80 throughinterfaces84,86. Data register134 receives data fromMPU80 and controlspilot squib drivers136 andcopilot squib drivers138, which control their respective pilot and copilot restraints or other safety devices viainterfaces140 and142. Filtered 28-VDC power is supplied to pilot bus enable144 and discharge146 circuitry, and copilot enable148 and discharge150 circuitry. Open-collector transistors152 and154 provide for added control of external devices, such as annunciators, not illustrated.
Upon application of vehicle power through[0035]connectors87 and88,ECSU52 is operated by a program (detailed below) which executes a self-test routine to insure system operability. Failure of critical, functional circuit blocks causesECSU52 to cease operation and activate a maintenance alert. If the necessary circuit blocks are functioning properly, the vehicle is identified to memory via the pin configuration ofconnector87 as detected byconnector88, and the vehicle-specific activation criteria are loaded into memory.
After the specific vehicle is identified,[0036]ECSU52 begins repeatedly sampling acceleration measurements taken byaccelerometers92,94 and96 and converting them to accelerations along vehicle X, Y and Z axes.MPU80 evaluates likely helicopter crash scenarios by sampling the accelerometers every 1000 microseconds, converting their analog voltage outputs into accelerations in Gs. Of course a higher or lower sampling rate (shorter or longer evaluation time) can be used, although the highest rate commensurate with system performance is desirable.MPU80 then operates according to the above program, converting sensed acceleration data to vehicle acceleration data, and utilizing the algorithm to determine if a crash threshold has occurred. If a crash is determined, it outputs a signal throughcable54 to fire squib(s)68 to operatecylinder64 and retractwebbing strips40 and42. If no crash threshold is determined,MPU80 performs routine system monitoring and diagnostics functions detailed above.
FIG. 4 illustrates the accelerometer axis rotation which converts accelerations measured along accelerometer axes X[0037]3, Y3 and Z3 to accelerations along vehicle axes X, Y and Z. This enablesECSU52 to be mounted in available space in a vehicle without accurate orientation along actual vehicle X, Y and Z axes.
The conversion of the crash sensor axes to the ECSU axes, as mounted, for each vehicle type involves successively rotating the crash sensor in pitch, yaw and roll about the following rotation angles:[0038]
P: +pitch rotation about Y-axis (X-Z plane)[0039]
Y: +yaw rotation about Z-axis (X[0040]1-Y1 plane)
R: +roll rotation about X-axis (Y[0041]2-Z2 plane).
Working backward from the final, as-mounted crash sensor accelerometer coordinates X[0042]3, Y3, Z3 to the actual vehicle coordinates X, Y and Z yields:
X=X[0043]3 (cosY cosP)+ Y3 ((cosR sinY cosP)+ (sinR sinP)) + Z3 ((sinR sinY cosP)−(cosR sinP))
Y=−X[0044]3(sinY)+ Y3 (cosR cosY)+ Z3 (sinR cosY)
Z= X[0045]3 (cosY sinP)+ Y3 ((cosR sinY sinP)−sinR)+ Z3 ((cosR cosP)+ (sinR sinY sinP)).
In this manner, all acceleration data received from[0046]accelerometers92,94 and96 are converted into accelerations along the vehicle's X, Y and Z axes. After the acceleration data is converted, the crash detection algorithm for the host vehicle is operative to apply the data to the crash threshold criteria specific to that vehicle.
Many different algorithms can be used, utilizing acceleration and change of velocity data in many different ways. These algorithms may use predetermined acceleration thresholds, rate of velocity changes, and/or magnitude of velocity changes to determine existence of a crash threshold.[0047]
One exemplary algorithm comprises the following steps:[0048]
1. Sample accelerations and convert to vehicle orthogonal accelerations.[0049]
2. If integrator is “active” (i.e. INTEGRATION THRESHOLD reached), go to step 6.[0050]
3. Normalize converted orthogonal accelerations by dividing sensed accelerations by normalization coefficients (i.e. acceleration thresholds).[0051]
4. Square and sum normalized accelerations.[0052]
5. If resultant<1.0, NO INTEGRATION THRESHOLD; return to step 1.[0053]
6. If resultant≧1.0, INTEGRATION THRESHOLD; engage recorder and integrator (for next sample); repeat sampling cycle to obtain next sample.[0054]
7. Integrate current sample orthogonal accelerations to obtain orthogonal changes in velocity and add to cumulative changes in velocity.[0055]
8. Normalize cumulative orthogonal changes in velocity by dividing by normalizing coefficient (i.e. VELOCITY THRESHOLDS).[0056]
9. Raise normalized changes in velocity to a programmable power and sum.[0057]
10. If resultant<1.0, NO CRASH; return to step 1.[0058]
11. If resultant≧1.0, POSSIBLE CRASH THRESHOLD:[0059]
a. If integrator active<0.005 sec., assume NONCRASH THRESHOLD, deactivate integrator, return to step 1.[0060]
b. If integrator active≧0.100 sec., event too slow; deactivate integrator; return to step 1.[0061]
c. If integrator active between 0.005−0.100 sec., CRASH THRESHOLD; actuate safety devices and start CRASH THRESHOLD data recorder.[0062]
This rapid evaluation and response assures that, in the event of a crash, harness[0063]36 is instantaneously retracted to reduce the amount of movement byoccupant22, which significantly reduces the “flail envelope” and the incidence of occupant injury. This data is stored in 60-second increments, 40 seconds before a sensed crash threshold and 20 seconds following.Backup power supply90 assures operation ofECSU52 in the event of a power failure caused by a crash or other vehicle damage. Another exemplary algorithm uses a plurality of different sized moving windows of integrated velocity changes to determine existence of a crash threshold.
One exemplary operational program for operating[0064]ECSU52 is:
INTERRUPT SERVICE ROUTINE: 28V Power Fail (NMI)[0065]
connect the battery[0066]
power fail timer= power fail delay[0067]
exit
[0068] | |
| |
| INTERRUPT SERVICE ROUTINE: Timer |
| |
| increment ECSU timer |
| decrement sample timer |
| if( sample timer = 0 and OK to start QSM ) |
| restart QSM to initiate all I/O |
| reset timer = sample interval |
| if( receive character timeout ) |
| handle incoming message exception |
| if( transmit character timeout ) |
| handle outgoing message exception |
| if( power fail timer > 0 ) |
| decrement power fail timer |
| if( power fail timer = 0 ) |
| power fail timer = −3 |
| if( 28V ≧ 28V low limit ) |
| if( capacitor discharge time > 0 ) |
| decrement discharge timer |
| if( discharge timer = 0 ) |
| decrement pilot squib timer |
| if( pilot squib timer = 0 ) |
| pilot squib timer = −3 |
| turn off pilot squib fire command |
| if ( firing copilot squib ) |
| decrement copilot squib timer |
| if( copilot squib timer = 0 ) |
| copilot squib timer = −3 |
| turn off copilot squib fire command |
[0069] |
|
| MAIN PROGRAM: |
|
| initialize ECSU hardware and software |
| enable specific MPU interrupts |
| increment startup count |
| perform ECSU self-test |
| enable comm port interrupts |
| enable TPU interrupts for press-to-display |
| if( self-test status is not halt ) |
| initialize power board control |
| get aircraft ID |
| clear comm port and check for host |
| if( event data is in flash RAM and there isn't a host |
| computer connected ) |
| copy flash data to CMOS RAM |
| erase flash RAM |
| increment power startup count |
| clear data available flag |
| while( not halted i.e., passed self-tests ) |
| while( no data available ) |
| if( no crash and no event and no sample and no power failure ) |
| while( no data available or crash data already in flash ) |
| if( no interrupts enabled ) |
| if( no host computer connected ) |
| clear comm port and check for host |
| if( host computer connected ) |
| check for message and process as |
| required |
| if( press-to-display switch active ) |
| activate all display indicators |
| deactivate all display indicators |
| display failure code using LEDs |
| extinguish LEDs |
| set status to halt |
| set data available flag |
| clear data available flag |
| clear data available flag |
| point to new data |
| if( not halted i.e., don't already have SE/CE ) |
| get raw acceleration data |
| convert to Gs |
| perform coordinate frame conversion |
| if( no crash has occurred yet ) |
| if( acceleration threshold exceeded ) |
| reset integrator to begin integration |
| disable host comm and press-to- |
| record event time |
| reset power startup counter |
| set event flag |
| set sample flag |
| set amount of additional SE data to |
| set SE threshold bit in status |
| record event time |
| if( event has been detected) |
| turn on integrator |
| if( neither pilot nor copilot bags have fired) |
| calculate ΔV |
| if( velocity threshold exceeded ) |
| increment velocity index |
| if( velocity index > max. window) |
| set sliding integrator window |
| if( time > minimum event duration ) |
| record crash time |
| set amount of additional CE |
| set crash flag |
| increment crash index |
| if( outside exclusionary cones) |
| if( pilot override not active) |
| if( copilot override not active) |
| if( either pilot or copilot squib fired) |
| set squib fired flag |
| increment fire count |
| reset integrator and ignore accel. spike |
| check window and slide if necessary |
| switch ring buffer if necessary |
| if( no sample flag i.e., no SE/CE in progress ) |
| set power fail bit in status word |
| turn off LEDs except 7 |
| allow QSM to continue |
| turn off pilot power bus |
| turn off copilot power bus |
| discharge pilot caps |
| discharge copilot caps |
| save any SE/CE data into flash RAM |
| wait for remaining capacitor discharge time |
| disconnect battery |
| if( no event and 28V power > 28V low limit) |
Each helicopter or other vehicle will have different acceleration and velocity change criteria for determining occurrence of a crash threshold. FIG. 5[0070]aplots vertical accelerations vs. time for the helicopter of FIG. 1. The area below a first curve A illustrates vertical Z-axis acceleration conditions under which ECSU52 must issue a “no fire” signal, while the area above a second curve B provides vertical Z-axis acceleration conditions under which ECSU must issue a “fire” signal. Similarly, in FIG. 5b,the area below a curve C shows horizontal (X-axis and Y-axis) acceleration conditions under which no output or “no fire” signal is commanded, while a second curve D provides horizontal acceleration conditions under which an output or “fire” signal is commanded. The area between the curves provides system tolerances, i.e. conditions under which an output signal may be commanded, depending on a sequence or accumulation of acceleration and velocity change data which is defined by the crash criteria in the particular algorithm utilized.
Additional power cylinders, such as shown at[0071]66′ in FIG. 3, may be provided to give the system multi-shot capability to enable multiple retractions ofharness36. The output signal fromECSU52 may also be utilized to initiate inflation of air bags or an IBAHRS (Inflatable Body and Head Restraint System) restraint system supplement. Asingle ECSU52 may provide output signals for all aircrew harness retractors or a separate sensor may be provided for each. The crash sensor of this invention is applicable to any type of helicopter, to fixed wing aircraft, and to any vehicle which is subject to crashes in any of a multiplicity of directions.
Thus, this invention provides an ECSU for a vehicle which provides an output signal to activate a vehicle occupant safety device upon sensing a crash in any direction. The ECSU functions to sense a crash along any vector by simultaneously sensing accelerations along all three ECSU orthogonal axes. These acceleration signals are input to an MPU which converts them into accelerations on the vehicle's axes and analyzes them with a crash algorithm programmed into memory to determine when a crash has occurred. If so determined, an output signal is provided to an occupant safety device which secures an occupant in his seat to reduce injuries.[0072]
While only a preferred embodiment has been illustrated and described, obvious modifications thereof are contemplated within the scope of this invention and the following claims.[0073]