Fault tolerant aircraft electric propulsion system

Abstract

An aircraft electric propulsion system comprises at least one electric motor (10) whose setpoint is calculated through a first channel (18A) comprising a first control unit (20A) and a second channel (20B) comprising a second control unit (20B). The at least one electric motor comprises a rotor (12) and two star-connected stators (14A, 14B), a first control unit of a first channel being connected to one of the star-connected stators by a first power converter (22A) and a second control unit of a second channel being connected to the other star-connected stator by a second power converter (22B), the power of the first channel and the power of the second channel are both designed to be half of the total power of the motor.

Description

Technical Field

[0001] The present invention relates to the field of electric or hybrid propulsion of aircraft, and more particularly to an electric propulsion system architecture. Background Art

[0002] As is well known, aviation control requires that the aircraft propulsion system have a high level of reliability to meet safety specifications. These reliability levels are typically manifested as redundancy of certain components to mitigate the impact of their main failures. This is especially true for the so-called ECS (Electronic Control System) electronics that provide thrust control functions. Aviation standards only allow a single failure of such electronics if it does not result in a performance loss of more than 15%.

[0003] Therefore, in the context of a thermal propulsion architecture, the heat engine is associated with a control system called FADEC (Full Authority Digital Engine Control), which interfaces with the pilot's thrust control and controls the thrust of the engine based on parameters transmitted to it by a series of sensors. In the so-called dual FADEC architecture, this critical function of engine control is fully redundant to allow fault tolerance for a single failure of any component of the FADEC.

[0004] Similarly, in the context of the new electric propulsion architecture, the electrical part not only includes the digital control part, but also includes a power converter of the inverter type and the electrical part of the motor formed by its stator windings. To allow fault tolerance for a single failure of any part of the ECS like the heat engine, the ECS is also fully redundant.

[0005] However, this redundancy is not without drawbacks, as it involves doubling the components of the power converter and the stator windings of the engine motor, which is bulky and heavy.

[0006] In addition, in order to ensure the takeover of control by the second ECS channel (redundant channel) when the first ECS channel fails, a motor switching system of the contactor type must be provided. If this system is set at the outlet of the power converter, it must therefore be sized for the high current of the motor, rather than just for the control signal as may sometimes be possible in a thermal architecture of the dual FADEC type.

[0007] Therefore, compared with a single line, this architecture choice still has an impact on mass and volume to ensure the required redundancy level. In addition, this architecture choice with redundancy and a potentially additional switching system complicates the system and reduces the product availability due to a higher failure rate. Summary of the Invention

[0008] Accordingly, a main object of the present invention is to mitigate the above drawbacks by providing an architecture that ensures an optimal trade-off between availability and reliability and enables the achievement of safety objectives while avoiding the redundancy of bulky or heavy components.

[0009] These objectives are achieved by an aircraft electric propulsion system comprising at least one electric motor, the setpoint of which is calculated by a first channel comprising a first control unit and a second channel comprising a second control unit, characterized in that the at least one electric motor comprises a rotor and two star-connected stators, and the first control unit of the first channel is connected to one of the two star-connected stators by a first power converter, the second control unit of the second channel is connected to the other of the two star-connected stators by a second power converter, and the capacity of each of the first and second channels is designed to be half of the total power of the at least one electric motor.

[0010] Thus, without doubling the power components, redundancy is limited to low-level electronic components with little impact on the on-board weight and volume, while allowing a good trade-off in terms of safety and availability. By exploiting the inherent transient capabilities, the architecture enables the compensation of all or part of the power lost during a single fault within a limited time.

[0011] Preferably, the first and second power converters are powered by two high-voltage DC power supplies independent of each other, and the capacity of each power supply is designed to be half of the total power.

[0012] Advantageously, the first and second control units are powered by a first and a second low-voltage DC power supply.

[0013] The aircraft propulsion system may further comprise diodes or logic to power the first and second control units from one or the other of the first and second low-voltage DC power supplies.

[0014] Preferably, the wound stator comprises more than three phases on the same star winding or is wound on a plurality of three-phase star windings with independent neutral points, and the number of channels is equal to or greater than two, typically four or six.

[0015] The invention also relates to a control and monitoring system for an aircraft electric motor, comprising a control system configured to control at least one electric motor, the control system including: a first channel including a first control unit configured to calculate a setpoint of the at least one electric motor based on measurement information from a measurement system; a second channel including a second control unit configured to calculate a setpoint of the at least one electric motor based on measurement information from the measurement system, characterized in that the at least one electric motor includes a rotor and two star-connected stators, and the first control unit of the first channel is connected to one of the two star-connected stators through a first power converter, the second control unit of the second channel is connected to the other of the two star-connected stators through a second power converter, and the capacity of each of the first and second channels is designed to be half of the total power of the electric motor.

[0016] Preferably, the control units have different designs to avoid any common failures.

[0017] According to the envisaged embodiment, the first power converter is connected to a first monitoring unit, the second power converter is connected to a second monitoring unit, or the first and second power converters are connected to a common monitoring unit.

[0018] Preferably, each of the monitoring units includes a reset in the case of a functional failure of these monitoring units.

[0019] Advantageously, the measurement system transmits the same data to the control unit and the monitoring unit of the same channel.

[0020] Preferably, the monitoring unit is capable of shutting down the power converter when a fault is detected in these data.

[0021] Brief Description of the Drawings

[0022] Other features and advantages of the invention will become apparent from the description given below, with reference to the accompanying drawings, which illustrate, in a non-limiting manner, exemplary embodiments thereof, in which:

[0023] FIG. 1 shows the architecture of an aircraft electric propulsion system according to the invention;

[0024] FIG. 2 shows a first example of the distribution of control and monitoring functions applied to the architecture of FIG. 1; and

[0025] FIG. 3 shows a second example of the distribution of control and monitoring functions applied to the architecture of FIG. 1.

[0026] Description of Embodiments

[0027] The principle of the present invention is based on the possibility of constructing an electric motor by dividing the stator into two star windings, each star winding supplying half of the power to a single rotor. Thus, the advantage of designing the capacity as half of the electric power lies not only in always maintaining half of the power after a single failure in one or the other of the two channels, but also in allowing the use of the remaining channel to provide a higher transient power by taking advantage of the transient load-carrying capacity of the electrical components, which transient power can compensate for all or part of the power provided during a failure.

[0028] The architecture of the electric propulsion system is organized around an electric motor 10, which includes a rotor 12 and two star-connected stators 14A, 14B, powered by an electronic control system (ECS 16) that defines two independent channels 18A, 18B, each channel being designed with a capacity of half of the total power of the electric motor. The first channel 18A includes a first control unit 20A connected to one of the two star-connected stators 14A through a first power converter 22A, and the second channel 18B includes a second control unit 20B connected to the other of the two star-connected stators 14B through a second power converter 22B. The two power converters (usually inverters) are each independently powered by a high-voltage direct current power supply (24A, 24B), each power supply providing half of the total power, and the two control units are each powered by a low-voltage direct current power supply 26A, 26B.

[0029] This particular configuration allows significant savings in mass and volume because the power level of the power converters is divided by two. In addition, it allows for partial single-fault tolerance with high performance because not only is half of the total power of the electric motor still available at continuous rating in the event of an internal failure in the electrical components of the propulsion line (the stator of the electric motor or the stator of the ECS), but also due to the inherent ability of the permanent magnet synchronous motor, it can have a transient power equal to all or part of the total maximum power of the electric motor on a single channel (when the two channels are powered together) without over-sizing and be able to operate in overspeed in a transient manner.

[0030] This partial fault tolerance also applies to a single failure of the high-voltage power supply of the aircraft because both channels 18A, 18B are powered by two independent power supplies 24A, 24B with a high-voltage direct current power supply (HVDC) at half power. Thus, a failure of the power supply or the wire harness again only results in the loss of half of the power of the electric motor.

[0031] Furthermore, since the ECS interfaces with these control units and the low-voltage direct current power supplies through two independent inputs, the present invention enables full fault tolerance for external failures of the low-voltage direct current power supplies 26A, 26B and the control signals from the FADEC 28 of the aircraft.

[0032] Thus, each interface receives the same information from the aircraft, enabling independence from failures of aircraft components, such as thrust levers or control panels, or electrical connection harnesses. Inside the ECS, isolation management enables ensuring that each channel of the ECS receives redundant control signals (digital and / or wired).

[0033] Finally, the OR-gate type diode logic circuit 30 enables interfacing with the low-voltage DC power supply, ensuring fault tolerance against failures of one of these two power supplies. Note that the redundancy of these signals and these interfaces has little impact from the perspectives of quality and volume.

[0034] Figures 2 and 3 very schematically show two examples of a device for regulating and monitoring an aircraft engine, which device includes a control system, an actuation system including at least one electric motor, and a measurement system (e.g.: temperature, speed, torque, etc.)

[0035] The control system enables driving the electric motor 10 according to measurement information from the measurement system according to a predetermined setpoint. This setpoint can be a position, speed, or torque setpoint according to the parameters of the motor being controlled. It includes two channels 18A, 18B, each channel being configured to calculate the setpoint and control the motor according to this setpoint. More generally, the different channels of the control system are thus configured to determine one or more setpoints (according to the number of motors involved).

[0036] In Figure 2, the first channel and the second channel each include a control unit COMA, COMB, which control unit is on the one hand configured to calculate the setpoint in a first manner and on the other hand configured to drive the motor according to this setpoint through power converters 22A, 22B.

[0037] Associated with one and the other of the first channel and the second channel, monitoring units MONA, MONB are for example configured to calculate the setpoint of the motor in a second manner different from the first manner in which the control units COMA, COMB calculate. In particular, the monitoring units MONA, MONB (at both the hardware architecture and functional algorithm levels) adopt a setpoint calculation method differentiated from that of the control units COMA, COMB. The monitoring units MONA, MONB in particular enable checking whether the control units COMA, COMB are operating within their operating envelope (e.g. a predetermined speed interval). Specifically, this monitoring unit monitors the normal operation of the control unit based on the same data and, when detecting a failure (overspeed or too high temperature) typically considered in normal operation, has the right to shut down the channel by shutting down (STOPA, STOPB) the power converter.

[0038] Typically, the monitoring unit needs to have a disconnecting device independent of the control unit to guard against dreaded events (catastrophic or hazardous) in the sense of aviation certification. Thus, it is the ultimate safety barrier in case of a control unit failure.

[0039] Similarly, the two control units COMA and COMB can have a heterogeneous design, i.e., their components and / or their on-board technologies are different, and the two stators can either share the same magnetic circuit (laminated core) with an isolated geometric distribution, or have two different magnetic circuits, or not have any ferromagnetic core. This makes it possible to eliminate the risk of common failures related to the design that could lead to the simultaneous loss of the two power channels. This different architecture is particularly reasonable on aviation platforms that include a large number of electric motors, such as new aircraft with distributed propulsion or vertical take-off and landing aircraft (VTOL).

[0040] Note that in the proposed architecture, there is an exchange (not shown) between the two control units COMA and COMB, and this is necessary for their correct operation. On the other hand, the communication between the control unit and the monitoring unit can be optional, and the loss of data will not have any adverse effect on performance.

[0041] In Figure 3, the architecture is optimized by combining the two monitoring units into a single common unit MON, while being compatible with availability and safety objectives, in particular by using a reset (RESET) to restart the monitoring unit in case of a functional failure. It should be noted that the loss of this common unit MON does not result in any performance loss, but only in a loss of safety level, which is acceptable, for example, until the end of the mission.

[0042] The measurement system transmits information from the sensors to the control units COMA, COMB and the monitoring units MONA, MONB of the control system. The measurement resources can be common (shared) or isolated (similar or different), and may be spatially separated between the different control units and monitoring units of the control system.

[0043] Note that although the present invention has been described with respect to an architecture shared between two channels managing half of the power, the number of channels is by no means restrictive and can, for example, be greater than two (typically four to six). It is also conceivable to share into a larger number of n channels such that a power capacity of n - 1 / n can be retained during an electrical fault. For example, assuming a power of 50 kW per channel, it is conceivable to control a 1 MW electric motor with 20 channels arranged in parallel.

[0044] In addition, each channel of the electric motor and its control can have more than 3 phases (the minimum number for the stator) on the same star winding. Thus, the stator can be multi-phase (typically 5, 6 or 7 phases) and / or include multiple three-phase star windings arranged in parallel (with independent neutral points). In this case, the power converter will include as many inverter arms as there are phases on the stator, and the number of control units and monitoring units will naturally be adjusted accordingly.

[0045] Similarly, another embodiment allows the power capacity of each channel to be designed to be greater than P 总 / n, at least during the transition. For example, for a desired total power of 100 kW, divided into two channels such that the capacity of each channel is designed to be 50 kW. Considering an additional transient power capacity of 50% for each channel, i.e., 75 kW, a single fault that causes one channel to be lost still allows the electric motor to transiently have a power of 75 kW, which is thus 75% of the initial power. This operating mode can allow safety objectives to be maintained in the event of a first fault during these transient operations, while limiting over-sizing.

[0046] Therefore, the present invention relates to an electric propulsion system architecture that provides an ideal compromise between availability and reliability while achieving the following safety objectives:

[0047] · Fault tolerance for external faults on low-level interfaces (power supply and digital communication); and

[0048] · Partial fault tolerance for internal electrical faults, while avoiding redundancy of large-size or large-mass components.

[0049] It both allows sufficient transient power to be provided to ensure the ascent of the aircraft, enabling it to reach a safe altitude, and allows sufficient DC power to be provided to allow the aircraft to maintain its altitude and to allow it to return to the landing area.

Claims

1. An electric propulsion system for an aircraft, comprising at least one electric motor (10), the setpoint of which is calculated via a first channel (18A) comprising a first control unit (20A) and a second channel (18B) comprising a second control unit (20B), characterized in that, The at least one electric motor includes a rotor (12) and two star-connected stators (14A, 14B), and a first control unit (20A) of the first channel (18A) is connected to one of the two star-connected stators through a first power converter (22A), and a second control unit (20B) of the second channel (18B) is connected to the other of the two star-connected stators through a second power converter (22B), and the capacity of each of the first and second channels is designed to be half of the total power of the at least one electric motor.

2. The aircraft electric propulsion system according to claim 1, wherein, The first and second power converters (22A, 22B) are powered by two high-voltage DC power supplies (24A, 24B) independent of each other, and the capacity of each high-voltage DC power supply is designed to be half of the total power.

3. The aircraft electric propulsion system according to claim 1 or 2, wherein, The first and second control units (20A, 20B) are powered by first and second low-voltage DC power supplies (26A, 26B).

4. The aircraft electric propulsion system according to claim 3, further comprising a diode OR logic circuit (30) to power the first and second control units from one or the other of the first and second low-voltage DC power supplies.

5. The aircraft electric propulsion system according to claim 1 or 2, wherein, The wound stator includes more than three phases on the same star winding, or is wound on a plurality of three-phase star windings with independent neutral points, and wherein the number of channels is equal to or greater than two, typically four or six.

6. A control and monitoring system for an aircraft electric motor, comprising a control system configured to control at least one electric motor (10), said control system comprising: A first channel (18A) including a first control unit (20A) configured to calculate a setpoint of the at least one electric motor according to measurement information from a measurement system; a second channel (18B) including a second control unit (20B) configured to calculate a setpoint of the at least one electric motor according to measurement information from a measurement system, characterized in that the at least one electric motor includes a rotor (12) and two star-connected stators (14A, 14B), and the first control unit (20A) of the first channel (18A) is connected to one of the two star-connected stators through a first power converter (22A), and the second control unit (20B) of the second channel (18B) is connected to the other of the two star-connected stators through a second power converter (22B), and the capacity of each of the first and second channels is designed to be half of the total power of the electric motor.

7. The control and monitoring system for an aircraft electric motor according to claim 6, wherein, The control units have different designs to avoid any common failures.

8. The control and monitoring system for an aircraft electric motor according to claim 6 or claim 7, wherein, The first power converter (INVERTERA) is connected to a first monitoring unit (MONA), and the second power converter (INVERTERB) is connected to a second monitoring unit (MONB).

9. The control and monitoring system for an aircraft electric motor according to claim 6 or 7, wherein, The first and second power converters (INVERTERA, INVERTERB) are connected to a common monitoring unit (MON).

10. The control and monitoring system for an aircraft electric motor according to claim 8 or 9, wherein, Each of the monitoring units (MONA, MONB, MON) includes a reset (RESET) in the case of a functional failure of these monitoring units.

11. A control and monitoring system for an aircraft electric motor according to any one of claims 6 to 10, wherein, The measurement system transmits the same data to the control unit and the monitoring unit of the same channel.

12. The control and monitoring system for an aircraft electric motor according to claim 11, wherein, The monitoring unit is able to switch off (STOPA, STOPB) the power converter when a fault in these data is detected.

Images