• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    An asymmetric electronic control system (100) of a gas turbine (50) configured to regulate a set of functions associated with input (60) logic or sensor input data and associated with outputs (70) especially for an actuator, said system (100) comprising: - a primary electronic control unit (120), configured to process the entire set of functions, - a secondary electronic control unit (140), partially redundant with the primary unit (120), configured to process only a narrow subset of functions sufficient to operate or start the gas turbine in an acceptable degraded mode when the primary unit (120) is in fault a main or redundant chain selection and switching module (160) for selecting one or the other of the primary and secondary units (120, 140) for regulating the turbine to gas (50) according to an operating state of said primary unit (120).
    公开号:FR3047274A1
    申请号:FR1650756
    申请日:2016-01-29
    公开日:2017-08-04
    发明作者:Jerome Priat；Vincent Guillaumin
    申请人:Safran Power Units SAS；
    IPC主号:
    专利说明:

    The invention relates to the field of gas turbine management, particularly for propulsion, such as a helicopter, aircraft, missile or drone engine, or for generating of energy, as an auxiliary power unit (APU in English, for "Auxiliary Power Unit").
    More specifically, the invention relates to full authority electronic control systems for gas turbine.
    These systems are known under the name FADEC for "Full Authority Digital Engine Control", and serve to control and regulate the gas turbine based eg data from sensors or instructions. More generally, these control systems belong to the field of electronic gas turbine control units, generally called EECU for "Electronic Engine Control Unit".
    STATE OF THE ART
    FADECs must comply with demanding operational reliability constraints. This is for example the MTBF, for "Mean Time Before Faiiure" to ensure that there are no incidents in operation or the reliability rate of an APU used for applications ETOPS (for "Extended-range Twin-engine Operation Performance Standards ", ie for flights operating more than one hour from an emergency airport) or for emergency operations, which must be greater than 10'6 / hour ( failure rate per hour of operation) with regard to "flight stop" or "no start" faults in flight.
    There is a special "dual channel" FADEC architecture that provides the required reliability. Documents EP2592253, GB2355081 and US2005217274 describe this architecture with some variants.
    With reference to FIG. 1, a dual-channel control system 10 comprises two redundant electronic control units 11, 12, with their respective inputs and outputs, as well as a switching device 13 between the two units 11, 12. These two units are identical in manufacturing, structure, architecture, component and functionality. In case of failure of one of them, the switching device 13 performs the switchover to the other, which ensures the continuity of data processing. To this end, the inputs that come from the sensors 14 are also split, just like the power supply 15. Each of the units 11, 12 comprises a separate control output 16, 17. Each unit 11, 12 comprises in particular an interface of electrical conversion.
    There is thus a total physical redundancy, units and the data processing chain. This means that the information can be processed in exactly the same way by the first and second units 11, 12.
    In practice, each unit 11, 12 can be composed of a control card and a surveillance card, the card monitoring one monitoring the card regulation of the other. When an anomaly is detected by a monitoring card, the latter monitors the switching device 13 to cause the switchover.
    In order to control the operation (dormant failure detection) and to distribute the use of the two units 11, 12, it is expected to change units at each start of the turbine.
    These dual-channel FADECs have greater operational reliability than single-channel FADECs with an unacceptable reliability rate of 10'5 / hour for the specific applications mentioned above.
    In contrast, dual channel FADECs are complex to develop and expensive compared to a single channel FADEC. In addition, there is a common risk of failure on a dual-channel FADEC, due to the fact that the two channels are identical in architecture and manufacturing.
    PRESENTATION OF THE INVENTION
    The present invention aims to simplify the development and manufacture of existing FADECs by proposing an asymmetric electronic control system of a gas turbine configured to regulate a set of functions associated with logic input or sensor input data and associated with output data in particular for an actuator, said system comprising: a primary electronic control unit, configured to process the entire set of functions, a secondary electronic control unit, partially redundant with the primary unit, configured to process only a narrow subset of functions sufficient to maintain or start the gas turbine in an acceptable degraded mode when the primary unit is in fault, - a selection and switching module for selection and switching of one or the other of the primary and secondary units for the regulation n of the gas turbine according to an operating state of said primary unit. The invention therefore proposes an asymmetric two-channel control system, adapted to process only a part of the functions when the primary unit has a malfunction. This particular architecture makes it possible to reduce the complexity of implementation compared to a dual channel FADEC while maintaining an equivalent reliability rate for the redundant functions. In addition, structural asymmetry, which is reflected in electronics, functionalities and components, eliminates common mode faults related to the similarity between the two units of a dual channel FADEC. The invention may comprise the following features, taken alone or in combination: - the strict subset of sufficient functions corresponds to the vital functions of the gas turbine, - the primary unit and the secondary unit are dissimilar in terms of architecture, but also of components and data processing, - the primary unit is implemented by a digital circuit and the secondary unit is implemented by an analog circuit, - the primary unit comprises a microcontroller controlled by a software solution and the secondary unit comprises a programmable logic circuit without software, - the secondary unit is configured to control the operating state of the primary unit and in which the switching device is included in the secondary unit, - the secondary unit includes fewer components than the primary unit, to achieve improved reliability, - the secondary unit does not process the following inputs (non-exhaustive list):
    Turbine inlet air temperature sensor,
    Gas outlet temperature sensor,
    Oil chip sensor,
    Oil filter clogging sensor,
    Oil level sensor,
    Oil pressure sensor,
    Oil temperature sensor,
    Fuel filter clogging sensor,
    Fuel temperature sensor,
    Ambient pressure sensor,
    Room temperature sensor,
    Logical information:
    SOL-VOL
    'WARNING' information of the equipment (ignition box, fuel pump, alternator controller, etc.), - the secondary unit processes only the following entries (non-exhaustive list):
    Speed sensor,
    Logic information: start / stop of the turbine, and control the following outputs:
    Launch engine,
    igniters,
    Oil drain valve,
    Indicators "On Gas Turbine" and "Off Gas Turbine", and regulates the fuel dispenser. each unit includes a power management interface configured to provide a voltage and an intensity adapted to the operation of their respective unit - the two units have distinct cycle / calculation times, to have distinct electromagnetic susceptibility points. The invention also relates to an assembly comprising a gas turbine and an asymmetric control system as described above.
    Finally, the invention also relates to an aircraft, a helicopter, a drone, a missile or a vehicle comprising an assembly as presented above.
    PRESENTATION OF THE FIGURES Other characteristics, objects and advantages of the invention will emerge from the description which follows, which is purely illustrative and nonlimiting, and which should be read with reference to the accompanying drawings, in which: FIG. 1 already presented schematically illustrates a dual channel FADEC comprising two identical units in parallel, allowing a total redundancy of the data processing, - Figure 2 schematically shows a control system according to the invention, with a secondary unit forming a partial redundancy of a primary unit. - Figure 3 shows a more detailed embodiment of the control system of Figure 2.
    DETAILED DESCRIPTION
    FIG. 2 schematizes an asymmetric electronic control system 100 of a gas turbine 50. The detailed description will be illustrated with an aircraft propelled by the gas turbine 50.
    The detailed description applies similarly to the GAP (Auxiliary Power Unit), more commonly known as APU (for "Auxiliary Power Unit" in English), or to any gas turbine 50 driven by a full authority system (helicopter, drone, missile, etc.)
    The asymmetric electronic control system 100 receives different types of data input 60 and, using these data, controls or regulates outputs 70 of different types. More generally speaking, "functions" will refer to both the input data and the output data related to a particular function of the gas turbine or the aircraft. A set of functions relating to the gas turbine and for which the control unit 100 has full authority in faultless operation is defined.
    The input data 60 may be either logic information 62 for ignition, start, stop, shutdown, etc. or measurements taken from sensors 64. FIG. 2 illustrates sensor data 64 present on the gas turbine 50, but it may be sensors relating to data relating to other elements of the aircraft.
    The output data 70 may be either control instructions for actuators, in particular for the gas turbine (fuel valve, lubrication valve, etc.), or indicative information (LEDs, etc.).
    The detail of the input and output data that can be considered as part of the description will be given later.
    The control system 100 comprises a primary electronic control unit 120, defining a primary data processing channel, and a secondary electronic control unit 140, defining a secondary data processing channel. The primary unit 120 is configured to handle all of the functions that a conventional control system must handle, which means that all of the input data 60 can pass through the primary channel and the primary unit 120 can regulate all the outputs 70. The secondary unit 140, for its part, is configured to process only a strict subset of the set of functions defined above, that is, say a subset of the functions relating to the inputs 60 and the outputs 70. In other words, the secondary unit 140 receives only a strict subset of the input data 60 and therefore only regulates a subset and a strict set of output data 70. For this purpose, the secondary unit 140 is designed in a dissimilar, i.e., non-similar, manner compared to the primary unit 120.
    The control system 100 thus has two electronic control units 120, 140 that are asymmetrical in terms of the processing of the functions, and therefore of the input 60 and output 70 data. More details will be given later.
    These strict subsets of input and output data mentioned above include the functions sufficient to maintain or start, in an acceptable degraded mode, the gas turbine 50. In other words, these subsets do not include the functions not necessary for the operation of the aircraft, or the gas turbine, in a degraded mode.
    A degraded mode is a mode in which the starting or regulating of the gas turbine provides a minimum of performance required for the vital operation of the aircraft.
    For example, in a degraded mode, the gas turbine starts without taking into account the altitude or the temperature of the air.
    A selection and switching module 160 is provided for selecting the secondary channel 140 as a function of the operating state of the primary unit 120. In the event of a fault or failure of the primary unit 120, the secondary unit will assume the hand on the control and regulation of the turbine 50. The case of a failure of the secondary unit will be explained later.
    By "in default", we mean "failing". In contrast to the dual channel FADECs, which redundant all the functions, and therefore their input data 60 and associated outputs 70, the control system 100 performs a redundancy only for these functions mentioned above, with the aid of the secondary unit 140, hence the name of "partial redundancy".
    This partial or simplified redundancy provides the functions to start the engine in degraded mode or to keep the engine running degraded, when the primary unit 120 is faulty.
    Indeed, it is possible to control an aircraft and its gas turbine 50 without having recourse to all the available information. The aircraft then does not operate in optimal mode but there are several other modes of operation of the aircraft, such as degraded mode, which requires only certain inputs to generate corresponding outputs. These inputs and outputs are associated with the strict subset of functions called "vital" or "essential" or "critical". The references 60v and 70v are associated for the so-called "vital" inputs and outputs and the references 60n and 70n for the so-called "non-vital" inputs and outputs. Minimal monitoring functions can be considered vital, as they ensure the security of the system.
    The control system 100 makes it possible to pass through the secondary channel the vital functions in the event of failure of the primary channel, that is to say that the secondary unit 140 must be able to process these functions when the primary unit 120 can not do it. For example, the secondary channel 40 regains control over the actuators identified as vital when a fault is observed on the primary channel 120.
    This switching must limit the transient state associated with switching from one channel to another.
    In order to verify the operation of the FADEC 100, each of the units 120, 140 comprises a respective monitoring module 170, 180 (see FIG. 3), also called "monitoring".
    Each monitoring module 170, 180 can monitor the state of its unit 120, 140 and establish an operability status.
    In addition, a selection and switching module 160 is provided to allow the first channel to switch to the second channel when the first channel is identified as being in fault. The module 160 is in communication with the monitoring module 170 of the primary unit 120.
    The module 160 comprises two sub-devices: a selection device 164, which receives information from the monitoring module 170 via a communication 162, and a switching device 166, controlled by the selection device 164.
    Thus, when the selection device 164 receives information relating to an anomaly at the primary unit 120, detected by the monitoring module 170, it drives the selection device 164 which causes switching between the two channels. The primary unit 120 is selected to regulate the turbine 50 until the primary unit 120 is in fault. As soon as a fault is detected on the primary unit 120, the secondary unit 140 is switched to control and regulate the gas turbine 50.
    As indicated above, the secondary unit 140 forms a dissimilar redundancy channel, compared to the primary unit 120. This lack of similarity can be manifested in different, cumulative forms: different functional blocks, different architectures, different components, etc.
    On the other hand, it is not simply a software reconfiguration of the secondary channel of a dual channel FADEC as presented in the introduction: the secondary unit 140 is also materially different from the primary unit 120.
    In one embodiment, the primary unit 120 is made in a known manner using a digital circuit, typically with a microcontroller 122 which executes software code and the secondary unit 140 is realized using an analog circuit or a programmable logic circuit without software 142, that is to say a component not executing lines of codes. The primary unit 120 is then essentially as existing in the dual channel FADECs.
    Dissimilarity can also manifest in cycle time and computation time. Due to the simplicity of the secondary unit 140 with respect to the primary unit 120, the secondary unit 140 advantageously has characteristic times shorter than those of the primary unit 120.This temporal or frequency desynchronization of the two channels, does not have the same points of susceptibility screw disruptors CEM (Magnetic Electromagnetic Compatibility): the two units will be dissimilar vis-à-vis EMC temporal or frequency disturbances. Indeed the circuits of the primary unit 120 and the secondary unit 140 operating at different frequencies, their behavior vis-à-vis the EMC disruptors will also be different. This temporal or frequency dissimilarity reinforces the resistance to EMC disrupters at the global FADEC level 100: if the primary unit is faulted by an EMC disrupter, the secondary unit 140 will take the hand and will not be affected by this same disrupter.
    The fact of using a dissimilar and simplified secondary unit 140 makes it possible to limit the risks of failures related to the common causes between the primary channel and the secondary channel, and also the breakdowns related to the number of components.
    By limiting the number of components and their complexity, the intrinsic reliability of the secondary unit 140 is improved. In particular, the secondary unit 140 has strictly fewer components than the primary unit 120 or more strictly reliable components because of their least complexities.
    The two units 120, 140 are developed and manufactured according to standardized methods aimed at preventing the occurrence and introduction of faults from the design stage. Unlike the dual channel FADEC, for which a common mode fault, ie a design and manufacturing defect, can affect both units 11, 12 (see Figure 1) and therefore the two channels, the dissimilarity of design and manufacturing, protects the control system 100 from this type of failures.
    The two units 120 and 140 can thus independently process the vital functions, which makes it possible to prevent the propagation of an erroneous state from the primary channel to the secondary channel, or vice versa. The electrical power supply is a major factor of failure in the FADEC, especially because of the voltage and current variations it may experience.
    It is in principle preferable to split the power supplies 130, 150 of the primary 120 and secondary 140 units to avoid a single point of failure associated with a fault of the power supply unit.
    As represented in FIG. 3, two power supply management interfaces 130, 150 receive the energy input from a source 55 and convert this energy into a voltage and an intensity adapted to its respective unit 120, 140. The interfaces 130, 150 are advantageously integrated with the units 120, 140.
    The source 55 is typically an on-board network, itself powered either by a main generator, or by an auxiliary generator driven by the gas turbine 50, or by a battery.
    In the primary unit 120, input conditioning modules 126 and outputs 128, respectively upstream and downstream of the microcontroller 122 along the primary channel are provided. The function of the input conditioning module 126 is to adapt the input data 60 and the output conditioning module 128 has the function of adapting the output data 70, so that they can then drive actuators for example. Figure 3 illustrates this embodiment.
    Typically, the conditioning module 126 of the primary unit 120 converts the signals 60n and 60v into digital data so that they can be processed by the controller 122.
    The conditioning module 128 of the primary unit 120 converts the signals from the module 122 into power signals 70v and 70n capable of controlling the actuators. The secondary unit 140 includes a secondary controller 142, as well as input conditioning modules 146 and output 148 respectively upstream and downstream of the controller 142 along the secondary channel.
    Typically, the conditioning module 146 of the secondary unit 140 converts the signals 60v into digital data in the case where the module 142 consists of a programmable logic circuit or adapts and formats the signals 60v in the case where the module 142 consists of analog functions.
    The conditioning module 148 of the secondary unit 140 converts the signals from the module 142 into 70v power signals capable of controlling the actuators.
    It is thus noted that the components between the two units 122 and 142 are different in nature.
    In the absence of failure within the control system 100, only the primary unit 120 controls and regulates the machine. Nevertheless, it is necessary to know when the secondary unit 140 is operational, so that the switching is done on a functional unit at the necessary time. Therefore, it is necessary that the secondary unit 140 be in operating condition and perform the calculations associated with the regulation or control of the machine as if it was she who was active to control the machine.
    In addition, the secondary unit 140 checks its operation through the monitoring module 180. The primary unit 120 has access to the state of the secondary unit 140. This information is then known, the secondary unit 140 faulty can be replaced during a maintenance operation before launching any mission requiring an operational reliability of 10'6 (ETOPS mission for an APU ...).
    The monitoring module 180 of the secondary channel makes it possible to analyze the operability state of the secondary channel and the secondary unit 140.
    A communication 172 of the secondary channel to the primary channel is provided: it is typically an information exchange between the monitoring module 180 and the monitoring module 170.
    Thus, when the primary channel is requested, the monitoring unit 170 still retrieves information relating to the status of the secondary unit 140 (ie the operability status) via the communication 172 and the monitoring unit. 180. This data is then transmitted by the primary unit 140, and typically by the monitoring unit 170, to an avionics or maintenance bus 200, conventionally known in itself. The information is then recoverable from this bus, to inform operators of the need to change the secondary unit 140 if it has been identified as faulty. In this regard, it is recalled that the primary unit 120 must be identified as faulty before switching to the secondary unit 140 is performed.
    On the other hand, the state of the secondary channel does not take into account the switching between the two channels: the primary channel is always active, except when a fault is detected, in which case the secondary channel takes over. In the event of a fault on the secondary channel, the information will be transmitted to the bus 200 by the primary channel but this will have no impact on the switches.
    The monitoring modules 170, 180 perform self-tests, that is to say tests on their own respective channel to establish their operability status: routine, watchdog, self-testable circuit, etc. If an anomaly is detected, the information is sent either to the selection and switching module 160 in the case of the primary channel or to the monitoring module 170 of the primary unit 120 in the case of the secondary channel.
    The switching module 166 of the selection and switching module 160 typically drives two switches 167 and 168 (see FIG. 3). The switch 167 connects the primary channel to an output of the system 100 and the switch 168 connects the secondary channel to the same output of the system 100. These two switches 167, 168 are never in the same state at the same time.
    The function of the selection device 164 is notably to determine the most relevant instant from which the secondary unit 140 takes over the primary unit 120. It is also necessary to avoid any major transition effect on the performance of the gas turbine.
    Alternatively, it is possible for the primary unit 120 to comprise two inputs and two outputs, respectively for the vital inputs 60v / non-vital 60n and the vital outputs 70c / non-vital 70n (see FIG. 3). In this way, only the vital output of the primary unit 120 can be deactivated with the switch 167, the non-vital output never being disconnected. As a failure regarding non-vital outputs 70n is not critical, such an architecture is quite conceivable.
    The communications between the two units are preferably limited to the strict minimum to have two units 120, 140 the most independent possible and thus contain the failures.
    Regulatory methods are associated with the asymmetrical control system 100. Definition of vital and non-vital parameters, or primary and secondary, or essential and non-essential parameters
    For the secondary unit 140 to be more reliable, its architecture is simplified and no longer receives all the input data 60 and no longer controls all the outputs 70. The secondary unit 140 is configured to receive only so-called "vital" data. The acquisition of aircraft speed and fuel control are parameters considered vital. Their relative data are redundant through the second channel. Generally speaking, it will be described as vital the parameters necessary to turn the turbine 50 in a manner at least degraded in case of failure of the main unit. The assignment to a parameter of vitality or not can be done in several ways.
    There are known and standardized methods of analysis for determining which functions are vital to the operation of the gas turbine. We can mention the FMEA (for "Failure Mode and Effects Analysis" in English, also called "Failure Modes"), the FMECA (for "Failure Mode and Effects, and Critical Analysis) translated into AM DEC (for" Analysis Modes of Failure, their Effects and Criticality), or the FMA (for "Failure Mode Avoidance").
    Parameters for which fallback values sufficient for operation of the gas turbine 50 over a full range but in degraded mode are available will be considered non-vital. These fallback values can be either the last measured value or a fixed value by default. For example, the most penalizing value is chosen, so that whatever the actual value, the regulation system 100 actually considers a less favorable value.
    Parameters that do not cause the machine to stop or not start in case of loss of the said parameter are not redundant either.
    The list of critical functions to be redundant, that is to say that must be able to be processed by the secondary unit 140 in the event of a failure of the primary unit 120, corresponds to all the functions which, in the event of a failure, lead to stopping or non-starting of the gas turbine 50. The other functions which have minor effects vis-à-vis the operation of the gas turbine 50, that is to say, which do not lead to stop or no start, are not redundant.
    Below is a list of essential, non-exhaustive parameters: - The inputs: o Speed sensor, o Logic information: start / stop of the turbine, - The outputs: o Launch engine, o Igniters, o Fuel dispenser, o Oil drain valve, o "On Gas Turbine" and "Off Gas Turbine" indicators. Below is a list of non-essential, non-exhaustive parameters: - Inputs: o Turbine air inlet temperature sensor, o Gas outlet temperature sensor, o Oil chip sensor, o Oil sensor. clogging oil filter, o Oil level sensor, o Oil pressure sensor, o Oil temperature sensor, o Fuel filter clogging sensor, o Fuel temperature sensor, o Ambient pressure sensor, o Air sensor ambient temperature, o Logical information:
    SOL-VOL
    'WARNING' information for the equipment (ignition box, fuel pump, alternator controller, etc.), - Outputs: o 'PRETE Gas Turbine' and 'START Gas Turbine' indicators, o Instrumentation connections.
    For example, if the data of the air intake temperature is not known, the control system 100 will consider a temperature of fallback (example temperature of 60 ° C, which is the most restrictive temperature for the machine) .
    权利要求:
    Claims (10)
    [1" id="c-fr-0001]
    claims
    An asymmetric electronic control system (100) of a gas turbine (50) configured to regulate a set of functions associated with input data (60) logic or from sensors and associated with output data (70). ) in particular for an actuator, said system (100) comprising: - a primary electronic control unit (120), configured to process the entire set of functions, characterized in that the electronic control system (100) comprises in furthermore: - a secondary electronic control unit (140), partially redundant with the primary unit (120), configured to process only a narrow subset of functions sufficient to keep the gas turbine running or running (50); ) in an acceptable degraded mode when the primary unit (120) is in fault, - a selection and switching module (160) for the selection and switching of one or the other of the units primary and secondary (120, 140) for regulating the gas turbine (50) according to a state of operation of said primary unit (120).
    [2" id="c-fr-0002]
    2. Control system according to claim 1, wherein the strict subset of sufficient functions corresponds to the vital functions of the gas turbine (50).
    [3" id="c-fr-0003]
    3. Control system according to any one of the preceding claims, wherein the primary unit (120) and the secondary unit (140) are dissimilar in architecture.
    [4" id="c-fr-0004]
    An electronic control system (100) according to any one of the preceding claims, wherein the primary unit (120) is implemented by a digital circuit and the secondary unit (140) is implemented by an analog circuit or a circuit programmable logic.
    [5" id="c-fr-0005]
    An electronic control system (100) according to any one of the preceding claims, wherein the primary unit (120) comprises a microcontroller controlled by a software solution and the secondary unit (140) comprises a programmable logic circuit without software.
    [6" id="c-fr-0006]
    The control system (100) according to any one of the preceding claims, wherein the primary unit (120) is configured to transmit to an avionics or maintenance bus (200) the operability status of the secondary unit. (140), said operability status being performed by the secondary unit itself, to allow replacement of the secondary unit (140) alone or the control system (100).
    [7" id="c-fr-0007]
    The control system (100) according to any one of the preceding claims, wherein the secondary unit (140) does not process the following inputs (60n): o Air turbine inlet temperature sensor, o Sensor Gas outlet temperature, o Oil chip sensor, o Oil filter clogging sensor, o Oil level sensor, o Oil pressure sensor, o Oil temperature sensor, o Fuel filter clogging sensor , o Fuel temperature sensor, o Ambient pressure sensor, o Ambient temperature sensor, o Logical information: SOL-VOL Information 'WARNING' of equipment (ignition box, fuel pump, alternator controller, etc.),
    [8" id="c-fr-0008]
    The control system (100) according to any one of the preceding claims, wherein the secondary unit (140) processes only the following inputs (60v): o Speed sensor, o Logic information: start / stop of the turbine , Controls the following outputs (70v): o Launch engine, o Igniters, o Oil drain valve, o "Gas Turbine On" and "Gas Turbine Off" LEDs. And regulates the fuel dispenser.
    [9" id="c-fr-0009]
    The control system (100) of any preceding claim, wherein the secondary unit (140) comprises fewer components than the primary unit (120) to provide improved reliability.
    [10" id="c-fr-0010]
    An assembly comprising a gas turbine (50) and a control system (100) according to any one of the preceding claims.
    类似技术:
    公开号 | 公开日 | 专利标题
    EP3408515B1|2019-09-18|Partially redundant electronic control system
    CA2796033C|2019-08-27|Full authority digital engine control system for aircraft
    EP2293429B1|2019-02-27|Secured surveillance and control device for an aircraft handling actuator
    CA2619143A1|2008-07-30|Aircraft engine monitoring process
    FR2922334A1|2009-04-17|DEVICE FOR VISUALIZING AN AIRCRAFT COCKPIT FOR MANAGING A VIDEO DATA NETWORK.
    EP2864201B1|2019-07-31|Electric circuit for cutting off an electric power supply comprising transistors and fuses having redundant logic
    EP2368162A1|2011-09-28|Method and device for controlling the adjustment of a switching state of an electric switching system in the field of guided vehicles
    FR2986398A1|2013-08-02|SAFETY DEVICE FOR CONTROLLING AN ENGINE COMPRISING A REDUNDANCY OF ACQUISITIONS OF A SENSOR MEASUREMENT
    FR2933512A1|2010-01-08|Diagnostic method for locating failure in complex system of aircraft i.e. helicopter, involves generating identification and location diagnostics of failure in complex system of aircraft
    CA2894374C|2016-04-26|Redundant electric circuit for cutting off the power supply to a piece of equipment
    EP2864196B1|2016-08-17|Electric circuit for cutting off an electric power supply having transistors and fuses
    FR2992122A1|2013-12-20|DEVICE FOR SECURE CONVERSION OF DIGITAL CONTROLS IN ANALOGUE POWER SIGNALS FOR AIRCRAFT
    FR2990192A1|2013-11-08|Avionics function testing method for aircraft, involves simulating behavior of real element of aircraft, where real element is applied by function, activating another real element that is applied by function, and testing function
    EP2912646B1|2016-10-05|Versatile sil2 detector having two outputs and one test input
    EP3601765B1|2021-02-17|Improved device for temporarily increasing turbomachine power
    EP0526350B1|1996-09-11|Compact security interface and majority voting circuit using the same
    FR2946018A1|2010-12-03|Automatic type thrust loss detecting device for engine of aircraft, has logic unit delivering information of increase of thrust in direction of engines for compensating loss of faulty engine when information is valid for one of engines
    FR3063349A1|2018-08-31|REDUNDANT MONITORING SYSTEM FOR THE STATUS OF CONTROLLERS FOR CONTROLLING A CONTROL HANDLE OF AN AIRCRAFT
    EP3844575A1|2021-07-07|High-availability electrical switch: control of a simplex actuation chain by redundant control
    FR2988481A1|2013-09-27|Electronic control unit for use in monitoring system in avionics field, has motherboard configured to identify sensor, which is concerned by short circuit in case of short circuit of drive circuit or link beams
    EP1465080A2|2004-10-06|Method for designing a fault tolerant system
    FR2946165A1|2010-12-03|Automatic engine control managing system for transport airplane, has warning unit emitting warning signal to inform operator about incompatibility between configuration information during receiving incompatibility information
    同族专利:
    公开号 | 公开日
    US20190032573A1|2019-01-31|
    FR3047274B1|2018-01-26|
    CN108603444B|2020-10-30|
    US10746103B2|2020-08-18|
    EP3408515B1|2019-09-18|
    CN108603444A|2018-09-28|
    WO2017129917A1|2017-08-03|
    EP3408515A1|2018-12-05|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US4248040A|1979-06-04|1981-02-03|General Electric Company|Integrated control system for a gas turbine engine|
    US20120101663A1|2009-03-11|2012-04-26|AIRBUS OPERATIONS |Distributed flight control system implemented according to an integrated modular avionics architecture|
    US20110276199A1|2010-05-10|2011-11-10|Airbus Operations |Flight control system and aircraft comprising it|
    EP2592253A1|2011-11-08|2013-05-15|Thales|FADEC for aeroengine|FR3088897A1|2018-11-26|2020-05-29|Airbus Operations |Flight control system of an aircraft.|GB0122956D0|2001-09-24|2001-11-14|Lucas Industries Ltd|Fire resistant electronic engine controller|
    US6868325B2|2003-03-07|2005-03-15|Honeywell International Inc.|Transient fault detection system and method using Hidden Markov Models|
    US7702447B2|2006-12-18|2010-04-20|United Technologies Corporation|Method and system for identifying gas turbine engine faults|
    CN100552580C|2007-07-31|2009-10-21|东北大学|Distributed type minisize gas turbine generation embedded type remote monitoring device and method based on DSP|
    US9650909B2|2009-05-07|2017-05-16|General Electric Company|Multi-stage compressor fault detection and protection|
    CN201526375U|2009-11-10|2010-07-14|南京航空航天大学|On-chip distributed aircraft engine electronic controller based on FPGA|
    US8489246B2|2010-02-26|2013-07-16|Pratt & Whitney Canada Corp.|Hybrid control system|
    CN102343983A|2011-07-07|2012-02-08|中国国际航空股份有限公司|Airplane APU performance detecting method|
    US9709448B2|2013-12-18|2017-07-18|Siemens Energy, Inc.|Active measurement of gas flow temperature, including in gas turbine combustors|
    US20150184549A1|2013-12-31|2015-07-02|General Electric Company|Methods and systems for enhancing control of power plant generating units|
    CA2958848A1|2014-08-28|2016-03-03|Pascal Chretien|Electromagnetic distributed direct drive for aircraft|US20200156805A1|2018-11-16|2020-05-21|Rolls-Royce Corporation|Secured backup feature for an embedded system|
    US11193428B2|2019-01-31|2021-12-07|Pratt & Whitney Canada Corp.|System and method for monitoring component integrity during engine operation|
    US11193810B2|2020-01-31|2021-12-07|Pratt & Whitney Canada Corp.|Validation of fluid level sensors|
    CN111734530B|2020-06-19|2021-04-06|上海尚实能源科技有限公司|Redundancy electric fuel system and control method|
    法律状态:
    2017-01-13| PLFP| Fee payment|Year of fee payment: 2 |
    2017-08-04| PLSC| Publication of the preliminary search report|Effective date: 20170804 |
    2017-12-21| PLFP| Fee payment|Year of fee payment: 3 |
    2018-06-15| CD| Change of name or company name|Owner name: SAFRAN POWER UNITS, FR Effective date: 20180515 |
    2019-12-19| PLFP| Fee payment|Year of fee payment: 5 |
    2021-10-08| ST| Notification of lapse|Effective date: 20210905 |
    优先权:
    申请号 | 申请日 | 专利标题
    FR1650756|2016-01-29|
    FR1650756A|FR3047274B1|2016-01-29|2016-01-29|PARTIALLY REDUNDANT ELECTRONIC CONTROL SYSTEM|FR1650756A| FR3047274B1|2016-01-29|2016-01-29|PARTIALLY REDUNDANT ELECTRONIC CONTROL SYSTEM|
    CN201780010843.1A| CN108603444B|2016-01-29|2017-01-27|Partially redundant electronic control system|
    EP17706848.3A| EP3408515B1|2016-01-29|2017-01-27|Partially redundant electronic control system|
    US16/073,400| US10746103B2|2016-01-29|2017-01-27|Partially redundant electronic control system|
    PCT/FR2017/050191| WO2017129917A1|2016-01-29|2017-01-27|Partially redundant electronic control system|
    [返回顶部]