AIRCRAFT WITH A HYDROGEN SUPPLY SYSTEM

Description

TECHNICAL FIELD

[0001] The present invention relates to an aircraft having a hydrogen fuel system which has improved safety. The present invention also relates to a purging method implemented with such a fuel system. STATE OF THE PRIOR ART

[0002] In order to reduce the pollution caused by the use of kerosene when operating an aircraft, aircraft are being developed whose engines are powered by dihydrogen, either to power a fuel cell to generate an electric current which in turn runs the aircraft engine or to directly power the combustion chamber of an aircraft thermal engine.

[0003] There Fig. 4 shows a state-of-the-art power supply system 400 which comprises a hydrogen tank 402 and at least one receiving device 404 which is designed to consume the hydrogen which it receives and which may be, for example, a fuel cell or a heat engine.

[0004] The supply system 400 also comprises, for each recipient device 404, a supply pipe 406 which extends between the hydrogen tank 402 and the recipient device 404. The supply pipe 406 is conventionally a double-skin pipe.

[0005] Upstream of the recipient device 404 and for each supply pipe 406, a heating system 414 is provided which comprises a heat exchanger 416 mounted on the supply pipe 406 upstream of the recipient device 404, and a flow control solenoid valve 418 which is here adjustable and which is mounted on the supply pipe 406 upstream of the heat exchanger 416.

[0006] The supply system 400 comprises a first shut-off solenoid valve 420 which is mounted on the supply pipe 406 upstream of the flow control solenoid valve 418.

[0007] When the dihydrogen arrives at the heating system 414, it is reheated before reaching the destination device 404.

[0008] Downstream of the reservoir 402 and for each supply pipe 406, a drive system 408 is provided which comprises a pump 410 mounted on the supply pipe 406 downstream of the reservoir 402.

[0009] The supply system 400 comprises a second shut-off solenoid valve 412 which is mounted on the supply pipe 406 downstream of the pump 410. The dihydrogen is thus captured in the tank 402 and driven towards the destination device 404 by the drive system 408.

[0010] To confine the hydrogen in the event of a leak at the various components of the heating system 414, the supply system 400 comprises, for each supply pipe 406, a first enclosure 422 which is traversed in a sealed manner by the supply pipe 406 and in which the heat exchanger 416, the flow control solenoid valve 418 and the first shut-off solenoid valve 420 are installed. Thus, in the event of a leak at the heating system 414, the hydrogen remains confined and can be evacuated to the outside by any appropriate evacuation systems, such as for example an evacuation pipe 424 which opens at one end into the first enclosure and at a second end to the outside of the aircraft.

[0011] To confine the dihydrogen in the event of a leak at the various components of the drive system 408, the supply system 400 comprises, for each supply pipe 406, a second enclosure 426 which is traversed in a sealed manner by the supply pipe 406 and in which the pump 410 and the second shut-off solenoid valve 412 are installed. Thus, in the event of a leak at the drive system 408, the dihydrogen remains confined and can be evacuated to the outside by any appropriate evacuation systems such as that described for the first enclosure 422.

[0012] Each supply pipe 406 has a free section 406a which extends outside the enclosures 422 and 426, between the first shut-off solenoid valve 420 and the second associated shut-off solenoid valve 412. To limit the risks of leaks at the level of the supply pipe 406, the latter takes the form of a double-skin pipe.

[0013] The safety of a supply system 400 can be further improved, in particular at the free section 406a of the supply pipe 406, which can be relatively long. Document US2022 / 146047 A1 discloses an aircraft comprising a state-of-the-art dihydrogen supply system. STATEMENT OF THE INVENTION

[0014] An object of the present invention is to provide an aircraft comprising a dihydrogen supply system which has improved safety in the event of a leak.

[0015] For this purpose, an aircraft is proposed comprising a power supply system comprising: a hydrogen tank, at least one receiving device intended to consume the hydrogen, for each receiving device, a double-skinned supply pipe which fluidically connects the hydrogen tank and the receiving device, for each supply pipe and upstream of the receiving device, a first enclosure crossed in a sealed manner by the supply pipe and in which are installed on the supply pipe, first means arranged to heat the hydrogen, for each supply pipe, a first shut-off solenoid valve mounted on the supply pipe upstream of the first means and installed in the first enclosure, for each supply pipe and downstream of the tank, a second enclosure crossed in a sealed manner by the supply pipe and in which are installed on the supply pipe,second means arranged to capture the dihydrogen in the tank and drive it towards the destination device, for each supply pipe, a second shut-off solenoid valve mounted on the supply pipe downstream of the second means and installed in the second enclosure, where a free section of said supply pipe extends outside the first enclosure and the second enclosure, between the first shut-off solenoid valve and the second shut-off solenoid valve, for each first enclosure, a complementary discharge pipe, a bypass pipe fluidically connected between the supply pipe and the complementary discharge pipe which opens outside the aircraft, and a third solenoid valve mounted on the bypass pipe, at least one safety tank which contains an inert fluid under pressure, for each free section,a purge pipe fluidly connected to the corresponding supply pipe downstream of the second shut-off solenoid valve, a distribution system fluidly connected between said at least one safety tank and each purge pipe, and comprising means for directing the inert fluid to one or other of the supply pipes from one or other of the safety tanks, for each purge pipe, a non-return valve mounted on said purge pipe to allow the passage of a fluid from the distribution system to the supply pipe and prevent the passage of a fluid from the supply pipe to the distribution system, for each free section, at least one sensor arranged to detect a leak of dihydrogen at said free section, a control unit designed to receive from each sensor information relating to the detection or not of a leak, for,when no information relating to a leak is received, controlling the start-up of the second means, the opening of each first shut-off solenoid valve and each second shut-off solenoid valve, the closing of each third solenoid valve and the distribution system so that the inert fluid does not flow, and for when information relating to a leak in a free section is received, controlling the stopping of the second means corresponding to the free section, the closing of the first shut-off solenoid valve and the second shut-off solenoid valve corresponding to the free section, the opening of the third solenoid valve and the distribution system so that the inert fluid flows towards the free section.

[0016] With such a supply system, the dihydrogen present in a free section is evacuated in the event of a leak.

[0017] Advantageously, the purge pipe is fluidically connected to the free section. Advantageously, the bypass pipe is fluidically connected to the free section. Advantageously, the supply system comprises, for each first enclosure, a discharge pipe which opens at one end into the first enclosure and at a second end to the outside and the associated complementary discharge pipe is fluidically connected to the discharge pipe.

[0018] The invention also relates to a purging method implemented in an aircraft according to one of the preceding variants, where the purging method comprises, from a situation where the control unit commands the start-up of the second means, the opening of each first shut-off solenoid valve and each second shut-off solenoid valve, the closing of each third solenoid valve and the distribution system so that the inert fluid does not flow:a waiting step during which the control unit waits for information from at least one of the sensors informing it of the detection of a leak at a free section, in the event of non-receipt of such information, a looping step during which the process loops back to the waiting step, in the event of reception of such information, a stopping step during which the control unit commands the stopping of the second means corresponding to the free section where a leak has been detected, a closing step during which the control unit commands the closing of the first shut-off solenoid valve and the second shut-off solenoid valve corresponding to the free section where a leak has been detected, an opening step during which the control unit commands the opening of the third solenoid valve corresponding to the free section where a leak has been detected,and a control step in which the control unit controls the distribution system so as to channel the inert fluid from a safety tank to the free section where a leak has been detected.

[0019] According to a particular embodiment, the purging method comprises between the stopping step and the control step: a first closing step during which the control unit commands the closing of the second shut-off solenoid valve corresponding to the free section where a leak has been detected, an opening step during which the control unit commands the opening of the third solenoid valve corresponding to the free section where a leak has been detected, and a second closing step during which the control unit commands the closing of the first shut-off solenoid valve corresponding to the free section where a leak has been detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above-mentioned and other features of the invention will become more clearly apparent from the following description of an exemplary embodiment, said description being made in relation to the accompanying drawings, among which: [ Fig. 1 ] is a top view of an aircraft according to the invention, [ Fig. 2 ] is a schematic representation of a hydrogen supply system according to the invention, [ Fig. 3 ] schematically illustrates a flowchart implemented with the hydrogen supply system according to the invention, and [ Fig. 4 ] is a schematic representation of a state-of-the-art hydrogen fuel supply system, and [ Fig. 5 ] schematically illustrates an example of hardware architecture of a control unit implemented in the invention. DETAILED PRESENTATION OF EMBODIMENT METHODS

[0021] There Fig. 1 shows an aircraft 100 which comprises a fuselage 102 on each side of which is fixed a wing 104 which carries at least one engine 106, which in the embodiment of the invention presented here is a propeller engine.

[0022] The aircraft 100 also comprises a supply system 200 according to the invention which comprises a hydrogen tank 202 and at least one receiving device 204 which is designed to consume the hydrogen which it receives. In the embodiment of the invention presented in Fig. 1 , the recipient device 204 is a fuel cell which supplies electric current to the propeller motor, but in another embodiment, the recipient device 204 may be the combustion chamber of a turbomachine.

[0023] For each recipient device 204, the supply system 200 comprises a supply pipe 206 which fluidically connects the hydrogen tank 202 and the recipient device 204. In the remainder of the description, the terms “upstream” and “downstream” relate to the direction of flow of the hydrogen in the supply pipe 206, i.e. from the hydrogen tank 202 to the recipient device 204.

[0024] There Fig. 2 shows the 200 power system.

[0025] The supply pipe 206 is a double-skinned pipe, that is to say that it comprises an inner skin in which the dihydrogen circulates and an outer skin fixed around the inner skin and which is filled with an inert gas or evacuated or filled with a thermally insulating material.

[0026] Upstream of the recipient device 204 and for each supply pipe 206, a heating system 214 is provided which comprises first means which are installed on the supply pipe 206 and arranged to heat the dihydrogen before sending it to the recipient device 204.

[0027] In the embodiment of the invention presented here, the first means comprise a heat exchanger 216 mounted on the supply pipe 206 upstream of the recipient device 204 and a flow control solenoid valve 218 which is here adjustable and which is mounted on the supply pipe 206 upstream of the heat exchanger 216.

[0028] The supply system 200 comprises a first shut-off solenoid valve 220 which is mounted on the supply pipe 206 upstream of the first means and here upstream of the flow control solenoid valve 218. The first shut-off solenoid valve 220 controls the entry or not of dihydrogen into the heating system 214 depending on whether it is open or closed.

[0029] When the dihydrogen arrives at the heating system 214, it is reheated before reaching the destination device 204.

[0030] The heat exchanger 216 ensures a transfer of calories to the dihydrogen from a heat transfer fluid which circulates in said heat exchanger 216.

[0031] Downstream of the reservoir 202 and for each supply pipe 206, a drive system 208 is provided which comprises second means which are arranged to capture the dihydrogen in the reservoir 202 and drive it towards the destination device 204 through the supply pipe 206. In the embodiment of the invention presented in Fig. 2 , the second means comprise a pump 210 mounted on the supply pipe 206 downstream of the reservoir 202.

[0032] The supply system 200 comprises a second shut-off solenoid valve 212 which is mounted on the supply pipe 206 downstream of the second means and here downstream of the pump 210. The second shut-off solenoid valve 212 controls the output or not of the dihydrogen from the drive system 208 depending on whether it is open or closed.

[0033] To confine the hydrogen in the event of a leak at the various components of the heating system 214, the supply system 200 comprises, for each supply pipe 206, a first enclosure 222 which is traversed in a sealed manner by the supply pipe 206 and in which the first means and the first shutoff solenoid valve 220 are installed. Thus, in the event of a leak at the heating system 214 or the first shutoff solenoid valve 220, the hydrogen remains confined and can be evacuated to the outside by any appropriate evacuation systems, such as for example an evacuation pipe 224 which opens at one end into the first enclosure 222 and at a second end to the outside of the aircraft 100.

[0034] To confine the dihydrogen in the event of a leak at the various components of the drive system 208, the supply system 200 comprises, for each supply pipe 206, a second enclosure 226 which is traversed in a sealed manner by the supply pipe 206 and in which the second means and the second shut-off solenoid valve 212 are installed. Thus, in the event of a leak at the drive system 208 or the second shut-off solenoid valve 212, the dihydrogen remains confined and can be evacuated to the outside by any appropriate evacuation systems such as that described for the first enclosure 222.

[0035] Each supply line 206 comprises a free section 206a which extends outside the first enclosure 222 and the second enclosure 226, between the first shutoff solenoid valve 220 and the associated second shutoff solenoid valve 212 and the dihydrogen flows from the second shutoff solenoid valve 212 to the first shutoff solenoid valve 220 which is downstream relative to the second shutoff solenoid valve 212.

[0036] For each first enclosure 222, the supply system 200 comprises a bypass pipe 250 which is fluidically connected, on the one hand, to the supply pipe 206 between the first shutoff solenoid valve 220 and the second shutoff solenoid valve 212 and, on the other hand, to a complementary discharge pipe 256 which opens at one end into the bypass pipe 250 and at a second end to the outside of the aircraft 100. According to a particular embodiment, the complementary discharge pipe 256 relating to the bypass pipe 250 and the discharge pipe 224 relating to the first enclosure 222 are fluidically connected as shown in dotted lines. Such an arrangement makes it possible to limit the openings to the outside.

[0037] The bypass pipe 250 is connected to the supply pipe 206 as close as possible to the first shut-off solenoid valve 220 and upstream of the latter to limit the volume that would not be purged and thus allow the evacuation of the greater part of the dihydrogen contained in the free section 206a as explained below. The connection of the bypass pipe 250 to the supply pipe 206 can be made inside or outside the first enclosure 222, that is to say in this case at the level of the free section 206a.

[0038] In the embodiment of the invention presented in the Fig. 2 , for reasons of redundancy, there are two branch pipes 250 which come together before joining the discharge pipe 256, 224.

[0039] Each bypass pipe 250 is equipped with a third solenoid valve 252 which authorizes or prevents the passage of dihydrogen in said bypass pipe 250.

[0040] The power supply system 200 also comprises at least one safety tank 258 which contains an inert fluid under pressure such as for example gaseous helium.

[0041] There are two 258 safety tanks here for redundancy and the amount of inert fluid needed in the event of an incident.

[0042] Each safety tank 258 is fluidically connected to a distribution system 260. For each free section 206a, the supply system 200 also comprises a purge pipe 262 which is fluidically connected between the distribution system 260 and the supply pipe 206 downstream of the associated second shut-off solenoid valve 212.

[0043] In the embodiment of the invention presented in the Fig. 2 , each purge pipe 262 is connected to the supply pipe 206 as close as possible to the second shut-off solenoid valve 212, to allow the flow of the inert fluid in the greater part of the free section 206a as explained below. The connection of the purge pipe 262 to the supply pipe 206 can be made inside or outside the second enclosure 226, that is to say in this case at the level of the free section 206a. The distribution system 260 comprises means which make it possible, depending on the case, to direct the inert fluid towards one or other of the supply pipes 206, and depending on the case one or other of the free sections 206a, from one or other of the safety tanks 258. These means are for example a network of pipes, solenoid valves and fluid distributors arranged to be able to direct the inert fluid according to the needs.

[0044] Each purge pipe 262 is equipped with a non-return valve 264 which allows the passage of a fluid in the purge pipe 262 of the distribution system 260 towards the associated supply pipe 206, and depending on the case the associated free section 206a, and prevents the passage of a fluid from the supply pipe 206, and depending on the case the free section 206a, towards the distribution system 260.

[0045] Each free section 206a is equipped with at least one sensor 266 arranged to detect a leak of dihydrogen at the free section 206a whether the leak occurs at the inner skin or at the outer skin. Each sensor 266 is for example a sensor housed between the two skins and capable of detecting dihydrogen or a pressure variation.

[0046] The power supply system 200 also comprises a control unit 268, one embodiment of which is shown in Fig. 5 .

[0047] The control unit 268 is designed to receive from each sensor 266 information relating to the detection or not of a leak. When no information relating to a leak is received, the control unit 268 controls the starting of the second means, the opening of each first shutoff solenoid valve 220 and each second shutoff solenoid valve 212, the closing of each third solenoid valve 252 and the distribution system 260 so that the inert fluid does not flow.When information relating to a leak in a free section 206a is received, the control unit 268 commands the stopping of the second means corresponding to the free section 206a where the leak was detected, the closing of the first shut-off solenoid valve 220 and the second shut-off solenoid valve 212 corresponding to the free section 206a where the leak was detected, the opening of the third solenoid valve 252 corresponding to the free section 206a where the leak was detected and the distribution system 260 so that the inert fluid flows towards the free section 206a where the leak was detected.The control unit 268 comprises, connected by a communication bus 500: a processor or CPU (Central Processing Unit) 501; a RAM (Random Access Memory) 502; a ROM (Read Only Memory) 503, for example a Flash memory; a data storage device, such as a hard disk HDD (Hard Disk Drive), or an information storage medium ISM (Information Storage Medium) reader 504, such as an SD (Secure Digital) card reader; at least one communication interface 505 allowing the control unit 268 to communicate with the sensors 266, the distribution system 260 and the various solenoid valves.

[0048] The processor 501 is capable of executing instructions loaded into the RAM 502 from the ROM 503, an external memory (not shown), a storage medium, such as an SD card, or a communications network (not shown). When the control unit 268 is powered on, the processor 501 is capable of reading instructions from the RAM 502 and executing them. These instructions form a computer program causing the processor 501 to implement the behaviors, steps, and algorithms described herein.All or part of the modular architecture, behaviors, steps and algorithms described herein may thus be implemented in software form by executing a set of instructions by a programmable machine, such as a DSP (Digital Signal Processor) or a microprocessor, or be implemented in hardware form by a machine or a dedicated component (chip) or a set of components (chipset), such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit). The control unit 268 therefore comprises electronic circuitry arranged and configured to implement the behaviors, steps and algorithms described herein.

[0049] There Fig. 3shows a flowchart of a purging method 300 implemented in the context of the use of the supply system 200 according to the invention. The purging method 300 comprises, from a situation where the control unit 268 commands the start-up of the second means, the opening of each first shut-off solenoid valve 220 and each second shut-off solenoid valve 212, the closing of each third solenoid valve 252 and the distribution system 260 so that the inert fluid does not flow: a waiting step 302 during which the control unit 268 waits for information from at least one of the sensors 266 informing it of the detection of a leak at a free section 106a, in the event of non-receipt of such information, a looping step during which the process loops back to the waiting step 302, in the event of reception of such information, a stopping step 304 during which the control unit 268 commands the stopping of the second means, here the pump 210, corresponding to the free section 106a where a leak has been detected, in order to stop supplying said free section 106a with dihydrogen, a closing step 306 during which the control unit 268 commands the closing of the first shutoff solenoid valve 220 and of the second shutoff solenoid valve 212 corresponding to the free section 106a where a leak has been detected, in order to isolate said free section 106a,an opening step 308 during which the control unit 268 commands the opening of the third solenoid valve 252 corresponding to the free section 106a where a leak has been detected in order to channel the dihydrogen still present in said free section 106a towards the outside, and a control step 310 during which the control unit 268 commands the distribution system 260 so as to channel the inert fluid from a safety tank 258 towards the free section 106a where a leak has been detected through the associated purge pipe 262, in order to purge said free section 106a of the dihydrogen which it contains towards the outside.

[0050] With such a method, the dihydrogen is purged from the free section 106a as soon as a leak is detected there and it is replaced by an inert fluid.

[0051] According to an alternative embodiment, the method comprises, as a replacement for the closing step 306 and the opening step 308, i.e. between the stopping step 304 and the control step 310: a first closing step during which the control unit 268 commands the closing of the second shut-off solenoid valve 212 corresponding to the free section 106a where a leak has been detected, an opening step during which the control unit 268 commands the opening of the third solenoid valve 252 corresponding to the free section 106a where a leak has been detected, and a second closing step during which the control unit 268 commands the closing of the first shut-off solenoid valve 220 corresponding to the free section 106a where a leak has been detected.

[0052] With such a method, the free section 206a is not entirely isolated before the opening of the bypass pipe 250, thus avoiding the risks of overpressure.

Claims

1. Aircraft (100) comprising a supply system (200), comprising: - a hydrogen gas tank (202), - at least one recipient device (204) designed to consume hydrogen gas, - for each recipient device (204), a double-walled feed line (206) which fluidly connects the hydrogen gas tank (202) and the recipient device (204), - for each feed line (206) and upstream of the recipient device (204), a first enclosure (222), through which the feed line (206) passes in a sealed manner, and in which first means, arranged to heat the hydrogen gas, are installed on the feed line (206), - for each feed line (206), a first solenoid shut off valve (220) mounted on the feed line (206) upstream of the first means and installed in the first enclosure (222), - for each feed line (206) and downstream of the tank (202), a second enclosure (226), through which the feed line (206) passes in a sealed manner, and in which second means, arranged to capture the hydrogen gas in the tank (202) and drive it towards the recipient device (204), are installed on the feed line (206), - for each feed line (206), a second solenoid shut off valve (212), mounted on the feed line (206) downstream of the second means and installed in the second enclosure (226), where a free section (206a) of said feed line (206) extends outside the first enclosure (222) and the second enclosure (226), between the first solenoid shut off valve (220) and the second solenoid shut off valve (212), - for each first enclosure (222), a supplementary evacuation pipe (256), a branch line (250) fluidly connected between the feed line (206) and the supplementary evacuation pipe (256) which opens to the outside of the aircraft (100), and a third solenoid valve (252) mounted on the branch line (250), - at least one safety tank (258) containing a pressurized inert fluid, - for each free section (206a), a purge line (262) fluidly connected to the corresponding feed line (206) downstream of the second solenoid shut off valve (212), - a distribution system (260) fluidly connected between said at least one safety tank (258) and each purge line (262), and comprising means for directing the inert fluid towards one or other of the feed lines (206) from one or other of the safety tanks (258), - for each purge line (262), a non-return valve (264) mounted on said purge line (262), to allow the passage of a fluid from the distribution system (260) towards the feed line (206) and to prevent the passage of a fluid from the feed line (206) towards the distribution system (260), - for each free section (206a), at least one sensor (266) arranged to detect a leak of hydrogen gas in said free section (206a), - a control unit (268) designed to receive information from each sensor (266) relating to the detection or non-detection of a leak, so that, when no information relating to a leak is received, it causes the activation of the second means, the opening of each first solenoid shut off valve (220) and each second solenoid shut off valve (212), and the closure of each third solenoid valve (252) and the distribution system (260) so that the inert fluid does not flow, and so that, when information relating to a leak in a free section (206a) is received, it causes the stopping of the second means corresponding to the free section (206a), the closure of the first solenoid shut off valve (220) and of the second solenoid shut off valve (212) corresponding to the free section (206a), and the opening of the third solenoid valve (252) and the distribution system (260), so that the inert fluid flows towards the free section (206a).

2. Aircraft (100) according to Claim 1, characterized in that the purge line (262) is fluidly connected to the free section (206a).

3. Aircraft (100) according to any of Claims 1 and 2, characterized in that the branch line (250) is fluidly connected to the free section (206a).

4. Aircraft (100) according to any of Claims 1 to 3, characterized in that it comprises, for each first enclosure (222), an evacuation pipe (224) which has one end opening into the first enclosure (222) and a second end opening to the outside, and in that the associated supplementary evacuation pipe (256) is fluidly connected to the evacuation pipe (224).

5. Purge method (300) implemented in an aircraft (100) according to any of the preceding claims, wherein the purge method (300) comprises, starting from a situation in which the control unit (268) causes the activation of the second means, the opening of each first solenoid shut off valve (220) and each second solenoid shut off valve (212), and the closure of each third solenoid valve (252) and the distribution system (260) so that the inert fluid does not flow: - a waiting step (302), in which the control unit (268) waits for information from at least one of the sensors (266) informing it of the detection of a leak in a free section (106a), - if such information is not received, a looping step in which the process loops back to the waiting step (302), - if such information is received, a stopping step (304) in which the control unit (268) causes the stopping of the second means corresponding to the free section (106a) where a leak has been detected, - a closing step (306) in which the control unit (268) causes the closure of the first solenoid shut off valve (220) and the second solenoid shut off valve (212) corresponding to the free section (106a) where a leak has been detected, - an opening step (308) in which the control unit (268) causes the opening of the third solenoid valve (252) corresponding to the free section (106a) where a leak has been detected, and - a command step (310) in which the control unit (268) commands the distribution system (260) so as to feed the inert fluid from a safety tank (258) towards the free section (106a) where a leak has been detected.

6. Purge method (300) according to Claim 5, characterized in that it comprises, between the stopping step (304) and the command step (310): - a first closing step in which the control unit (268) causes the closure of the second solenoid shut off valve (212) corresponding to the free section (106a) where a leak has been detected, - an opening step in which the control unit (268) causes the opening of the third solenoid valve (252) corresponding to the free section (106a) where a leak has been detected, and - a second closing step in which the control unit (268) causes the closure of the first solenoid shut off valve (220) corresponding to the free section (106a) where a leak has been detected.