Actuator equipped with two pressure sensors and a virtual pressure sensor; a braking system and an aircraft equipped with such an actuator, and the method applied

Abstract

The present invention relates to an actuator (10) provided with a pump (15) connected to a first hydraulic connection (30) connected to a reservoir (25) and to a second hydraulic connection (35). A control controller (40) communicates with a first pressure sensor (41) arranged on the second hydraulic connection (35) and measuring a first supply pressure. A monitoring controller (50) communicates with the control controller (40) and a second pressure sensor (51) arranged on the second hydraulic connection (35) and measuring a second supply pressure. A virtual pressure sensor is provided with a verification instrument (55) transmitting at least one verification signal (SVERIF) carrying an operating parameter of the pump (15) to the control controller (40) and to the monitoring controller (50) to identify a fault in the actuator (10) and consequently apply a degraded operating mode. Abstract figure: figure 1

Description

Title of the invention: Actuator equipped with two pressure sensors and a virtual pressure sensor; a braking system and an aircraft equipped with such an actuator, and the method applied

[0001] The present invention relates to an actuator provided with two pressure sensors and a virtual pressure sensor, a method for controlling such an actuator, as well as a braking system and an aircraft provided with such an actuator.

[0002] An aircraft may comprise a plurality of landing gears each comprising at least one wheel. The expression "wheel landing gears" is used hereinafter to designate such a landing gear, regardless of the number of wheels.

[0003] Thus, a rotorcraft may comprise two main landing gears and an auxiliary landing gear each comprising one or more wheels.

[0004] Such an aircraft further comprises a braking system, in particular for immobilizing the aircraft on a parking area.

[0005] A known braking system comprises a brake fluid reservoir. The reservoir is hydraulically connected to a hydraulic inlet of a braking relay by a pump and a non-return valve. An accumulator is hydraulically connected in parallel to the hydraulic inlet of the braking relay. Finally, the braking relay is hydraulically connected to two brakes respectively of two main landing gears. Each brake may comprise at least one hydraulic cylinder capable of moving a braking stator against a braking rotor secured to a wheel of the landing gear concerned.

[0006] The brake relay then comprises a hydraulic distributor per brake. Each hydraulic distributor comprises a piston delimiting a chamber in hydraulic communication with a brake control device. The operation of the brake control device induces the discharge of a liquid into the chamber which pushes the piston. The movement of the piston induces the opening of a valve and the pressurization of the associated brake.

[0007] Furthermore, a parking brake control handle is connected to two cams cooperating with the two pistons. Thus, an action on the parking brake handle rotates the two cams which causes the two pistons to move and the two valves to open to pressurize the two brakes.

[0008] When the aircraft is in operation, the hydraulic energy required for braking is supplied by the pump. When stationary, this hydraulic energy is supplied by the accumulator. Although effective, this braking system is based on the use of a common hydraulic power for both brakes. A hydraulic leak can thus render both brakes inoperative simultaneously.

[0009] Document EP3772442 B1 describes a braking system comprising a hydraulic or pneumatic supply line supplying a control valve in hydraulic or pneumatic communication with a brake. In addition, the control valve communicates with a parking brake valve via a non-return valve, the parking brake valve being connected to a hydraulic or pneumatic return line. A controller configured to control the valves is connected to a parking brake control, to a brake control and to a pressure sensor.

[0010] When the brake control is positioned in an engaged position, the controller closes the parking brake valve and compares the measured pressure to a threshold. If the pressure is below the threshold, the controller deduces the presence of a malfunction. The controller may command a movement of the parking brake control to a non-engaged position in order to inform an operator, and may open the parking brake valve.

[0011] Document FR3076267 B1 describes a method for diagnosing a wear condition of an actuator. This method comprises measuring a signal from the actuator motor, executing a windowing algorithm to obtain from the signal a data set comprising a first and a second maximum, establishing a score attributed to the data set, and evaluating the wear as a function of the score.

[0012] Furthermore, a known system comprises an electrohydraulic actuator equipped with a pump hydraulically connected to a reservoir and to a hydraulic connection. The pump is controlled by a controller in communication with a pressure sensor measuring a pressure in the hydraulic connection. This system is interesting, but the failure of the pressure sensor renders the system inoperative.

[0013] To remedy this, a known monitoring architecture comprises a command controller connected to a command sensor and a monitoring controller connected to a monitoring sensor measuring substantially the same parameter as the command sensor. The monitoring controller verifies that an order sent to the command controller is nominally applied. The control part is thus independent of the command part. Such an architecture is sometimes called COM / MON, the term COM relating to the command controller and the term MON relating to the monitoring controller. Such a monitoring architecture is interesting, but requires the duplication of sensors subject to failures.

[0014] The present invention therefore aims to propose an innovative actuator aiming to have acceptable fault tolerance, in particular for use within a vehicle braking system.

[0015] The invention thus aims at an actuator provided with a pump connected to a first hydraulic connection and to a second hydraulic connection, the first hydraulic connection being connected to a reservoir containing a fluid, said actuator having a controller control communicating with a first pressure sensor, the first pressure sensor being arranged on the second hydraulic connection and measuring a first supply pressure, said actuator comprising a monitoring controller communicating with the control controller and a second pressure sensor, the second pressure sensor being arranged on the second hydraulic connection and measuring a second supply pressure, in a nominal operating mode, the monitoring controller being configured to monitor the actuator as a function of the second supply pressure and the control controller being configured to control a pressure of the fluid delivered by said pump in the second hydraulic connection to a pressure setpoint as a function of the first supply pressure.

[0016] This actuator comprises a virtual pressure sensor provided with a pressure model dependent on a value of at least one operating parameter of the pump evaluated with a verification instrument which transmits at least one verification signal carrying said value to the control controller and to the monitoring controller to identify a failure of the actuator and consequently apply a degraded operating mode.

[0017] The expression “verification instrument” may designate a module capable of directly measuring the value of the operating parameter in question, or even a system which may comprise one or more sensors and / or signal processing means making it possible to provide an estimate of this value of the operating parameter.

[0018] The actuator is thus an electrohydraulic actuator equipped with multiple pressure measuring means, and in particular an actuator conveying hydraulic fluid into a brake if necessary.

[0019] The monitoring controller and the control controller are distinct and functionally segregated, while for example being able to be different parts of the same unit, such as an electronic card for example. Similarly, the first pressure sensor and the second pressure sensor are distinct.

[0020] The first pressure sensor and the second pressure sensor can be positioned to measure a pressure in the same section of the second hydraulic connection, namely substantially the same pressure.

[0021] The first pressure sensor is used in the nominal operating mode to control the pump, or even a valve described later. The second pressure sensor is used to monitor the operation of the actuator.

[0022] When the brake is not applied, the second pressure sensor is for example used by the monitoring controller which checks that the pressure in the second hydraulic connection is zero. If not, the monitoring controller can apply a degraded operating mode by signaling a fault to an alerter and / or by inhibiting the pump by transmitting, for example, a signal to an electrical relay or equivalent to no longer supply electrical power to the pump and / or the control controller.

[0023] During parking braking, the second pressure sensor is for example used by the monitoring controller to check that the pressure prevailing in the second hydraulic connection is equal to a target pressure at the end of a determined duration, for example a pressure of the order of 70 bars plus or minus 5 bars after 2 seconds, and to apply a degraded operating mode if this is not the case.

[0024] In addition, the actuator comprises a virtual pressure sensor dissimilar to the first and second pressure sensors and independent, to determine whether one of the first and second pressure sensors or the pump is malfunctioning. This virtual pressure sensor does not measure a pressure as such, but emits at least one verification signal varying as a function of an operating parameter of the pump which is the image of the pressure downstream of the pump.

[0025] In fact, the pressure prevailing in the second hydraulic connection depends on the volume of fluid delivered by the pump, and can therefore also be evaluated not with a pressure sensor, but using an operating parameter varying jointly with this volume.

[0026] The monitoring controller and the control controller are then configured to derive a pressure value from the verification signal(s) emitted, directly or indirectly, by the verification instrument in order to determine whether the first pressure sensor or the second pressure sensor or the pump is malfunctioning by comparison with the first supply pressure and the second supply pressure. If a fault is detected, a degraded operating mode is applied.

[0027] As a result, a failure of a pressure sensor does not necessarily lead to the total loss of the actuator thanks to the presence of the virtual pressure sensor. The actuator has in particular an increased tolerance to the failure of a pressure sensor.

[0028] The actuator may further comprise one or more of the following features, taken alone or in combination.

[0029] According to one possibility, the virtual pressure sensor can measure one or more operating parameters among the position of a moving element of the pump inducing the circulation of liquid through the pump, an electrical characteristic of an electric motor of the pump.

[0030] Thus, the pump may comprise an electric motor having a moving component setting in motion a pumping member relative to a casing, the instrument of verification measuring at least one of the following operating parameters: the movement of said pumping member or said component, an electrical characteristic of an electric current electrically supplying the motor or circulating in this motor.

[0031] For example, the verification instrument comprises a position sensor evaluating the number of revolutions made by a rotor of the electric motor during an operating phase of the pump, for example by detecting the successive passages of a rotor mark in front of a Hall effect sensor or an equivalent, or even a temperature sensor.

[0032] The virtual pressure sensor can then comprise a law for converting the pressure model providing a pressure as a function of the movement of said pumping member, or even the temperature. The term "law" subsequently designates, for example, a table of values ​​or an equivalent, one or more mathematical equations, an artificial intelligence and, for example, a neural network, etc.

[0033] Alternatively, the operating parameter may be an electrical characteristic, such as an electrical power consumed by the motor during an operating phase of the pump for example. The electrical power consumed is the image of the pressure and the flow rate of the fluid at the pump outlet. Knowledge of this electrical power, possibly combined with a rotation speed of said component of the pump motor measured with a speed sensor or known, makes it possible to create an interesting pressure indicator.

[0034] The virtual pressure sensor can then include a conversion law providing a pressure as a function of the electrical characteristic, or even in addition to said rotation speed.

[0035] Alternatively, the virtual pressure sensor may comprise a conversion law providing a pressure as a function of the movement of said pumping member, or even the temperature, and the electrical characteristic, or even the rotation speed previously described to have optimal precision. This latter variant may make it possible to be subject, to a certain extent, to wear of the device controlled by the actuator and / or internal friction in the pump for example.

[0036] According to a possibility compatible with the previous ones, the monitoring controller can be configured to determine whether the second supply pressure is identical to within a predetermined margin to a target pressure, the monitoring controller and the control controller being configured to apply a degraded operating mode when the second supply pressure is not identical to within a predetermined margin to the target pressure, or even to apply the nominal operating mode when the second supply pressure is identical to within a predetermined margin to the target pressure.

[0037] If the target pressure is substantially equal to the second supply pressure, then the monitoring controller deduces that the actuator is operating normally. In fact, this means that the control controller is normally controlling the pump and therefore that the first pressure sensor is operating correctly, but also that the second pressure sensor is operating correctly. The actuator continues to apply the nominal operating mode.

[0038] If not, an element of the actuator is malfunctioning and a degraded operating mode must be applied.

[0039] According to another example, the monitoring controller can be configured to determine the target pressure from said pressure setpoint.

[0040] The monitoring controller may apply an adjustment law to determine the target pressure. For example, the target pressure is equal to zero when no pressure setpoint is given.

[0041] On the other hand, when a pressure setpoint is given, the target pressure can be equal to the pressure setpoint plus or minus a margin. Therefore, the current operating mode is by default the nominal operating mode and the test can then be carried out regularly from a predetermined duration following receipt of the pressure setpoint.

[0042] Alternatively, the target pressure may be calculated by a mathematical equation as a function of time and the pressure setpoint.

[0043] According to a possibility compatible with the previous ones, the control controller can be configured to determine a first verification pressure from said at least one verification signal and a conversion law, the monitoring controller being configured to determine a second verification pressure from said at least one verification signal and the conversion law.

[0044] The monitoring controller and the command controller then use these monitoring pressures to assess the presence of a fault, and deduce the actions to be taken accordingly.

[0045] Optionally, the actuator may comprise a permanent memory storing update data comprising a change in said value of said at least one operating parameter and at least one of the first and second verification pressures during a current operating cycle of the pump during an application of the nominal operating mode, at least said monitoring controller or said command controller being configured to update said conversion law as a function of the stored update data.

[0046] The relationship between the value of the operating parameter(s) and the pressure prevailing in the second hydraulic connection may change, for example depending on the wear of the controlled brake where applicable. Therefore, this characteristic makes it possible to updating the conversion law by one and / or the other of the controllers to correct the dispersion of the evolution of the pressure according to the operating parameter(s). For example, the update data is injected into a mathematical model, such as a neural network or a mathematical formula for example, to adjust variable coefficients of the conversion law.

[0047] Furthermore, the monitoring controller and the command controller can be configured to apply, when the actuator is not operating according to the nominal operating mode, a degraded operating mode chosen from several degraded operating modes depending on:

[0048] - from a comparison made by the second pressure monitoring controller verification and second supply pressure and

[0049] - of a comparison made by the control controller of the first pressure of verification and first supply pressure.

[0050] If the second check pressure and the second supply pressure are identical within a margin and, at the same time, the first check pressure and the first supply pressure are different within a margin, then the first supply pressure sensor is defective.

[0051] Conversely, if the second verification pressure and the second supply pressure are different within a margin and, at the same time, the first verification pressure and the first supply pressure are identical within a margin, then the second supply pressure sensor is defective.

[0052] Finally, if the second check pressure and the second supply pressure are different within a margin and, at the same time, the first check pressure and the first supply pressure are not identical within a margin then the pump is malfunctioning.

[0053] According to a possibility compatible with the preceding ones, the control controller can transmit to the monitoring controller a similarity signal indicating whether the first verification pressure and the first supply pressure are identical to within a predetermined margin.

[0054] From then on, the monitoring controller can carry out the previous comparisons to evaluate the corrective actions to be taken.

[0055] According to a possibility compatible with the previous ones, as long as the second verification pressure and the second supply pressure are identical to within a predetermined margin and at the same time the first verification pressure and the first supply pressure are not identical to within a predetermined margin, said degraded operating mode can be a degraded servo-control operating mode with virtual sensor during which the command controller is configured to emit a control signal to the pump in depending on the first check pressure and said pressure setpoint and the monitoring controller is configured to monitor the actuator using the second supply pressure.

[0056] In this case, the first supply pressure sensor is defective. The monitoring controller transmits a signal to the control controller to order it to apply the degraded servo-control operating mode with virtual sensor. The control controller uses the first verification pressure instead of the first supply pressure to control the pump, or even a new servo-control law.

[0057] According to a possibility compatible with the previous ones as long as the second verification pressure and the second supply pressure are not identical to within a predetermined margin and at the same time the first verification pressure and the first supply pressure are not identical to within a predetermined margin, said degraded operating mode can be an inactive mode during which the command controller is inactive and the monitoring controller is configured to generate an alert.

[0058] In this case, the pump malfunctions. The monitoring controller can transmit a signal to an alerter, for example to an avionics system within an aircraft. In the presence of another actuator in the aircraft, the pressure setpoint sent to this other actuator can possibly be increased by the avionics system in the presence of said alert as described below.

[0059] According to a possibility compatible with the previous ones, as long as the second verification pressure and the second supply pressure are not identical to within a predetermined margin and at the same time the first verification pressure and the first measured supply pressure are identical to within a predetermined margin, said degraded operating mode can be a degraded monitoring operating mode, the control controller being configured to emit a control signal to the pump as a function of the first supply pressure and the monitoring controller is configured to monitor the actuator using the second verification pressure.

[0060] In this case, the second supply pressure sensor is defective. The monitoring controller monitors the operation of the actuator using the virtual pressure sensor, the control controller operating normally. The monitoring controller uses the second verification pressure instead of the second supply pressure, or even a new monitoring law.

[0061] According to a possibility compatible with the previous ones, the second hydraulic connection can comprise a valve controlled by the control controller.

[0062] For example, when a pressure setpoint is reached, the valve is closed to maintain the pressure downstream of the valve equal to the pressure setpoint.

[0063] The invention also relates to a method for controlling a first actuator provided with a pump connected to a first hydraulic connection and to a second hydraulic connection, the first hydraulic connection being connected to a reservoir containing a fluid, characterized in that the method comprises the following steps: - measuring a first supply pressure in said second hydraulic connection with a first pressure sensor, - measuring a second supply pressure in said second hydraulic connection with a second pressure sensor, - in a nominal operating mode, control of a pressure of the fluid delivered by the pump in the second hydraulic connection, for example with the control controller, as a function of a pressure setpoint and the first supply pressure, and monitoring of the actuator, for example with the monitoring controller, as a function of the second supply pressure, - determination of at least one operating parameter of the pump, and - detection of a failure of the actuator and application accordingly of a degraded operating mode according to said at least one operating parameter.

[0064] This method may further comprise one or more of the following steps:

[0065] -determination of a first verification pressure, with the control controller, from a value of said at least one operating parameter and a conversion law,

[0066] -determination of a second verification pressure, with the monitoring controller, from a value of said at least one operating parameter and the conversion law,

[0067] - comparison with the monitoring controller of the second supply pressure to a target pressure, and application of the nominal operating mode in the affirmative and of a degraded operating mode in the negative,

[0068] - as long as the second check pressure and the second supply pressure are identical to within a predetermined margin and that at the same time the first verification pressure and the first supply pressure are not identical to within a predetermined margin, said degraded operating mode is a degraded servo-control operating mode with virtual sensor,

[0069] - as long as the second check pressure and the second supply pressure are not identical to within a predetermined margin and that at the same time the first verification pressure and the first supply pressure are not identical to within a predetermined margin, said degraded operating mode is a degraded operating mode of control without virtual sensor, and

[0070] -as long as the second check pressure and the second supply pressure are not identical to within a predetermined margin and at the same time the first verification pressure and the first measured supply pressure are identical to within a predetermined margin, said degraded operating mode is a degraded monitoring operating mode.

[0071] Optionally, the first actuator supplies hydraulic fluid to at least one brake of a first main landing gear of an aircraft, said aircraft comprising a second actuator supplying hydraulic fluid to a brake of a second main landing gear, said pressure setpoint being equal to a first braking pressure during nominal operation and to a second braking pressure greater than the first braking pressure in the presence of an alert generated by the second actuator.

[0072] Furthermore, the invention is applicable to a braking system. Thus, a braking system can be provided with a hydraulic brake and a braking control, the braking system comprising an actuator according to the invention, said braking control emitting a pressure setpoint to control the actuator, said second hydraulic connection being hydraulically connected to the hydraulic brake.

[0073] Furthermore, an aircraft may be equipped with two main wheel landing gears and one auxiliary wheel landing gear, the two main wheel landing gears each comprising such a braking system.

[0074] Optionally, the aircraft comprises an immobilization system for immobilizing the auxiliary wheel landing gear on the ground in a predetermined position, and for example for positioning the wheel(s) of this landing gear substantially parallel to the forward direction of the aircraft and / or to the roll axis of the aircraft.

[0075] The aircraft can thus be immobilized on a slope, even in the event of a malfunction of one of the two braking systems. By braking the wheel or wheels of a single main landing gear and by blocking the auxiliary landing gear relative to the airframe of this aircraft to keep its wheel or wheels substantially parallel to the roll axis of the aircraft, the system thus makes it possible to immobilize the aircraft in the event of a failure of the braking system of the other main landing gear. Optionally, the pressure of the hydraulic fluid supplying the braking system in operation can be increased in this configuration.

[0076] The invention and its advantages will appear in more detail in the context of the description which follows with examples given for illustrative purposes with reference to the appended figures which represent:

[0077] [Fig.l], a diagram of an actuator according to the invention for example within a braking system,

[0078] [Fig.2], a diagram of an aircraft having braking systems according to the invention, and

[0079] [Fig.3], a flowchart explaining the method implemented by the invention.

[0080] Elements present in several distinct figures are assigned a single reference.

[0081] [Fig.l] shows an actuator 10, of the electrohydraulic type. This actuator 10 has the function of injecting, if necessary, a fluid 26 into a controlled device 59. According to the example given, this controlled device 59 can be a hydraulic brake 65, the fluid 26 being a liquid of the usual brake fluid type.

[0082] This actuator 10 comprises a pump 15 connected to a first hydraulic connection 30 and to a second hydraulic connection 35 to circulate the fluid from the first hydraulic connection 30 to the second hydraulic connection 35, and vice versa. Each hydraulic connection 30, 35 may comprise at least one pipe. The first hydraulic connection 30 is hydraulically connected to a reservoir 25 containing the fluid 26. The second hydraulic connection 35 is hydraulically connected to the controlled device 59. The second hydraulic connection 35 may comprise a valve 37 hydraulically connected to the pump 15 by a first hydraulic connection 36 and to the controlled device 59 by a second hydraulic connection 38.

[0083] The pump 15 may comprise an electric motor 16 mechanically connected to at least one pumping member 17, such as a piston for example. For example, the electric motor 16 may be a motor with or without brushes. The electric motor 16 is electrically powered by a conventional electrical connection not shown, directly or by a control controller 40. The electric motor 16 has the function of setting this pumping member 17 in motion relative to a casing 18 of the pump 15 to cause the circulation of the fluid 26.

[0084] [Fig. 1] schematically illustrates an example of a pump 15. For example, the electric motor 16 comprises a control module 161 driving a motor module comprising a movable component 160, such as a rotor. Therefore, the control module 161 can deliver an electric current to coils 162 to generate the rotation of the component 160, this component 160 comprising permanent magnets. The rotation of the component 160 generates a translational movement of the pumping member 17 relative to a cylinder 170 of the pump 15 via a cam 163. The translation of the pumping member 17 of the pump 15 causes the movement of fluid 26 through the pump 15.

[0085] The pump 15 can be reversible to circulate the fluid 26 from the reservoir 25 to the controlled device 59, and from the controlled device 59 to the reservoir 25 as required. Conventional valves (not shown) may be present.

[0086] The pump 15, and where appropriate the valve 37, are controlled by a control controller 40.

[0087] The term "controller" means a processing unit capable of applying ins instructions for implementing the steps of the method described below, these instructions being able for example to take the form of a code segment. A processing unit can comprise for example at least one processor and at least one memory, at least one integrated circuit, at least one programmable system, at least one logic circuit, these examples not limiting the scope given to the expression "processing unit". The term processor can designate as well a central processing unit known by the acronym CPU, a graphics processing unit GPU, a digital unit known by the acronym DSP, a microcontroller, etc.

[0088] The control controller 40 is thus connected to the pump 15, and in particular to the electric motor 16 via a wired or wireless connection in order to transmit to it a control signal requiring the operation or stopping of the electric motor 16. The term “signal” hereinafter designates an analog or digital, optical, electrical or radio signal. For example, the control controller 40 can transmit a power signal which activates the pump.

[0089] Similarly, the control controller 40 is connected, if necessary, to the valve 37, via a wired or wireless connection, in order to transmit an opening / closing signal to it to request the opening or closing of this valve 37.

[0090] In addition, the control controller 40 is connected, via a wired or wireless connection, to a first pressure sensor 4L. The first pressure sensor 41 is arranged on the second hydraulic connection 35. The first pressure sensor 41 transmits to the control controller 40 a signal carrying a first supply pressure PCOM prevailing in the second hydraulic connection 35.

[0091] Furthermore, the actuator 10 comprises a monitoring controller 50. The monitoring controller 50 is connected by a wired or wireless link to the control controller 40 and has the function of monitoring the operation of the actuator 10.

[0092] For this purpose, the monitoring controller 50 is connected by a wired or wireless connection to a second pressure sensor 51, the second pressure sensor 51 being arranged on the second hydraulic connection 35. The second pressure sensor 51 transmits to the monitoring controller 50 a signal carrying a second supply pressure PMON prevailing in the second hydraulic connection 35.

[0093] Under these conditions, during a nominal operating mode MODNOM, the control controller 40 controls the pump 15 as a function of a pressure setpoint PCONS and the first supply pressure PCOM. The control controller 40 determines whether the fluid 26 must circulate between the reservoir 25 and the controlled device 59. If so, the control controller 40 transmits a signal to open the valve 37. In addition, the control controller 40 determines the control signal to be sent to the pump 15 as a function of a control law aimed at making the first supply pressure PCOM tend towards the pressure setpoint PCONS. PCONS pressure setpoint can be stored, calculated or transmitted by a control operated by an operator.

[0094] For its part, the monitoring controller 50 monitors the actuator 10 as a function of the second supply pressure PMON, for example by comparing the second supply pressure PMON to a target pressure as a function of the pressure setpoint PCONS as described below. The monitoring controller 50 can furthermore emit an alert signal in particular to an alerter 85, for example of an avionics system within an aircraft. Such an alerter 85 can generate a visual alert, for example by means of the emission of a light with a light-emitting diode or an equivalent or the display on a screen of one or more characters, an audible alarm, by means of a loudspeaker, and / or a haptic alarm, for example using a vibrating unit vibrating an organ held or worn by an individual.

[0095] To detect a possible failure, the actuator 10 further comprises a virtual pressure sensor. This sensor is described as virtual insofar as it does not directly measure a pressure, but at least one other parameter varying jointly with this pressure.

[0096] The virtual pressure sensor is thus provided with a pressure model, for example stored in the control controller 40 and the monitoring controller 50. The operating model comprises a conversion law giving a pressure as a function of the value of one or more operating parameters of the pump 15. Therefore, the virtual pressure sensor comprises a verification instrument 55 which comprises at least one member which transmits a verification signal SVERIF to the control controller 40 and to the monitoring controller 50 to enable them to detect a possible failure of the actuator 10 and in this case apply the required degraded operating mode MODDEG.

[0097] The verification signal(s) SVERIF carry the value of an operating parameter of the pump 15.

[0098] For example, the verification instrument 55 comprises a movement sensor 56 measuring the movement of the pumping member 17 or of a component 160 of the pump 15, or even a temperature sensor measuring a temperature in or outside the pump 15. For example, the verification signal emitted by the movement sensor indicates the number of revolutions made by the rotor since activation of the pump 15. Indeed, this information is the image of the volume of fluid 26 passing through the pump 15, and therefore of the pressure prevailing in the second hydraulic connection 35. Furthermore, the efficiency of the pump 15 can vary as a function of the temperature, which can be evaluated using the temperature sensor.

[0099] Alternatively or in a complementary manner, the verification instrument 55 comprises a standard electrical sensor 57 measuring an electrical characteristic of the electrical current consumed by the electric motor 16 of the pump 15, such as electrical power for example, or even a speed sensor measuring a rotation speed of the rotor.

[0100] Therefore, the control controller 40 is configured to determine a first verification pressure PV1 from the verification signal(s) SVERIF and a conversion law of the pressure model. Similarly, the monitoring controller 50 is configured to determine a second verification pressure PV2 from the verification signal(s) SVERIF and the conversion law. For example, the conversion law comprises either a mathematical equation giving a pressure as a function of the operating parameter(s), or a first mathematical equation giving a volume as a function of the operating parameter(s) and a second mathematical equation giving a pressure as a function of this volume.

[0101] Optionally, during an operating cycle of the pump 15 according to a nominal operating mode, the value of the operating parameter(s) and the pressure measured by one of the pressure sensors form update data stored in a permanent memory 45 of the control controller 40 and / or the monitoring controller 50 for updating the conversion law. The controller concerned automatically updates the conversion law from the update data and an update model, for example at the end of an operating cycle, and can transmit the new conversion law to the other controller.

[0102] From the verification pressures PV1, PV2 and the supply pressures PCOM, PMON, the monitoring controller 50 can assess the presence of a fault and the corrective actions to be carried out.

[0103] Such an actuator 10 may be part of a braking system 60. This braking system 60 may comprise a braking control 63, for example to request parking braking. This braking control 63 can be operated by an operator and may comprise a button or a lever for example. This braking control 63 may transmit, by a wired or wireless connection, a setpoint signal to the control controller 40 and to the monitoring controller 50. The setpoint signal may comprise a pressure setpoint, for example 0 bar when braking is not required and 70 bar when parking braking is required.

[0104] Furthermore, the braking system 60 comprises a conventional hydraulic brake 65 hydraulically connected to the second hydraulic connection 35. By way of example, such a hydraulic brake 65 comprises one or more hydraulic cylinders 66 hydraulically connected to the second hydraulic connection 35 and at least one stator 67 movable in translation relative to a support 200. The hydraulic cylinder(s) 66 are then configured to be able to push the stator(s) 67 against one or more rotors 68 so- linear of a system to be braked.

[0105] In particular, the braking system 60 can be arranged on a vehicle to brake a wheel 70.

[0106] According to [Fig.2], the vehicle may be an aircraft 90. This aircraft 90 may be equipped with two main wheel landing gears 91, 92 and an auxiliary wheel landing gear 93. Therefore, each main wheel landing gear 91, 92 may have its own braking system 60.

[0107] Optionally, the wheeled auxiliary landing gear 93 may be rotatable about a piloting axis to turn the aircraft 90 on the ground. The aircraft 90 may comprise an immobilization system 94 to prevent said rotation and immobilize the wheeled auxiliary landing gear 93 relative to a fuselage of the aircraft 90 in a predetermined position on the ground. In this predetermined position, the wheel of the wheeled auxiliary landing gear 93 may extend parallel to a forward direction of movement of the aircraft 90. Thus, even in the event of a total failure of a braking system 60, the aircraft 90 is not at risk of turning unduly. Such an immobilization system may be of a conventional type, and may, for example, comprise a finger penetrating an orifice or a notch provided in a plate integral in rotation with the landing gear.

[0108] [Fig.3] illustrates the method implemented by the invention.

[0109] This method comprises a COM command of the actuator 10 with the braking command 63. The braking command 63 transmits a signal carrying a pressure setpoint PCONS to the command controller 40 and the monitoring controller 50. For example, the braking setpoint PCONS is transmitted to an avionics system, which transmits it to the command controller 40 and the monitoring controller 50 without modification or after modification. For example, if a failure is detected on the first actuator 61 of [Fig. 2], the avionics system may comprise an avionics controller configured to increase the pressure setpoint transmitted to the second actuator 62 in order to compensate for the malfunction of the first actuator 61.

[0110] Optionally, without action on the braking control 63, the actuator may consider by default that the pressure setpoint is equal to zero.

[0111] In addition, the method comprises the measurement MES1 of a first supply pressure PCOM in the second hydraulic connection 35 with the first pressure sensor 41, and the measurement MES2 of a second supply pressure PMON in the second hydraulic connection 35 with the second pressure sensor 51.

[0112] The monitoring controller 50 then determines an operating state of the actuator as a function of the pressure setpoint PCONS received and the second supply pressure PMON.

[0113] As long as no braking is required, the monitoring controller 50 can check that the second supply pressure PMON is below a threshold. If not, an alert can be generated and / or the monitoring controller 50 can electrically disconnect the control controller 40 and / or the pump 15 from an electrical power source, for example by transmitting a signal to an electrical relay.

[0114] If the braking setpoint is not zero, the operating mode may be the nominal operating mode by default. Upon receipt of the pressure setpoint, the control controller 40 possibly opens the valve 37 and controls the pump 15 according to a difference between the pressure setpoint PCONS and the first supply pressure PCOM

[0115] Therefore, during a test step TST, the monitoring controller 50 determines a target pressure PNOM, for example from the pressure setpoint PCONS. The target pressure PNOM can be a pressure range equal to the pressure setpoint, plus or minus a margin for example.

[0116] During this test step TST, the monitoring controller 50 can determine whether the second supply pressure PMON is identical to within a predetermined margin to the target pressure PNOM at the end of a predetermined duration. This duration can be established by testing and corresponds to the time required for the pressure to reach the target pressure in the second hydraulic connection 35.

[0117] If Yl is in the affirmative, the monitoring controller 50 applies the nominal operating mode MODNOM, and possibly transmits a signal to the control controller 40 carrying an order to apply the nominal operating mode MODNOM. In addition, the monitoring controller 50 monitors the operation of the actuator 10 by continuing to follow the evolution of the second supply pressure PMON with respect to the target pressure PNOM.

[0118] If the negative NI, the monitoring controller 50 determines the degraded operating mode MODDEG to be applied.

[0119] Therefore, the method comprises the determination MES3 of the value of at least one operating parameter VOL of the pump 15 with the verification instrument 55.

[0120] The method then comprises the STPD detection of a failure of the actuator 10 and the consequent application of a degraded operating mode MODDEG as a function of the current value of the operating parameter(s).

[0121] The control controller 40 thus determines a first verification pressure PV1 as a function of the conversion law in force and the current value of the operating parameter(s). Similarly, the monitoring controller 50 thus determines a second verification pressure PV2 as a function of the same conversion law and the current value of the operating parameter(s).

[0122] The monitoring controller 50 compares during a step COMP1 the second verification pressure PV2 with the second supply pressure PMON.

[0123] Similarly, the control controller 40 compares during a step COMP2 the first verification pressure PV1 with the first supply pressure PCOM.

[0124] The monitoring controller 50 and the control controller 40 are configured to apply a degraded operating mode MODDEG based on these two comparisons.

[0125] In order for the monitoring controller 50 to determine the degraded operating mode, the control controller 40 can transmit to the monitoring controller 50 a similarity signal SIM indicating whether the first verification pressure PV1 and the first supply pressure PCOM are identical to within a predetermined margin. The monitoring controller 50 then transmits a signal to the control controller 40 carrying the degraded operating mode to be applied. The reverse is also possible.

[0126] As long as the second verification pressure PV2 and the second supply pressure PMON are identical to within a predetermined margin according to the arrow Y3 and at the same time the first verification pressure PV1 and the first supply pressure PCOM are not identical to within a predetermined margin according to the arrow N2, the degraded operating mode MODDEG is a degraded servo-control operating mode with virtual sensor M0D1.

[0127] During this degraded servo-control operating mode with virtual sensor M0D1, the control controller 40 emits a control signal to the pump 15 as a function of the first verification pressure PV1, instead of the first supply pressure PCOM in the nominal operating mode, and of the pressure setpoint PCONS. The monitoring controller 50 monitors the actuator 10 in the same way as in the nominal operating mode, using the second supply pressure PMON.

[0128] As long as the second verification pressure PV2 and the second supply pressure PMON are not identical to within a predetermined margin according to arrow N3 and at the same time the first verification pressure PV1 and the first supply pressure PCOM are not identical to within a predetermined margin according to arrow N2, the degraded operating mode MODDEG is an inactive mode M0D2.

[0129] During the inactive mode M0D2, the control controller 40 no longer controls the pump 15, and the monitoring controller 50 transmits a signal to the alerter 85 to signal a malfunction of the pump 15.

[0130] As long as the second verification pressure PV2 and the second pressure PMON supply pressures are not identical to within a predetermined margin according to arrow N3 and that at the same time the first verification pressure PV1 and the first measured PCOM supply pressure are identical to within a predetermined margin according to arrow Y2, the degraded operating mode MODDEG is a degraded monitoring operating mode M0D3.

[0131] During the degraded monitoring operating mode M0D3, the control controller 40 transmits a control signal to the pump 15 according to the first supply pressure PCOM, as in the nominal operating mode. On the other hand, the monitoring controller 50 is configured to monitor the actuator 10 using the second verification pressure PV2 instead of the second supply pressure PMON.

[0132] Naturally, the present invention is subject to numerous variations as to its implementation. Although several embodiments have been described, it is understood that it is not conceivable to exhaustively identify all possible modes. It is of course conceivable to replace a means described by an equivalent means without departing from the scope of the present invention.

Claims

Claims

1. Actuator (10) provided with a pump (15) connected to a first hydraulic connection (30) and to a second hydraulic connection (35), the first hydraulic connection (30) being connected to a reservoir (25) containing a fluid (26), said actuator (10) having a control controller (40) communicating with a first pressure sensor (41), the first pressure sensor (41) being arranged on the second hydraulic connection (35) and measuring a first supply pressure (PCOM), said actuator (10) comprises a monitoring controller (50) communicating with the control controller (40) and a second pressure sensor (51), the second pressure sensor (51) being arranged on the second hydraulic connection (35) and measuring a second supply pressure (PMON),in a nominal operating mode (MODNOM) the monitoring controller (50) being configured to monitor the actuator (10) as a function of the second supply pressure (PMON) and the control controller (40) being configured to control a pressure of the fluid delivered by said pump (15) in the second hydraulic connection (35) to a pressure setpoint (PCONS) as a function of the first supply pressure (PCOM), characterized in that said actuator (10) comprises a virtual pressure sensor provided with a pressure model dependent on a value of at least one operating parameter of the pump (15) evaluated with a verification instrument (55) which transmits at least one verification signal (SVERIF) carrying said value to the control controller (40) and to the monitoring controller (50) to identify a failure of the actuator (10) and consequently apply a degraded operating mode (MODDEG).,

2. Actuator according to claim 1, characterized in that the pump (15) comprises an electric motor (16) having a movable component (160) setting in motion a pumping member (17) relative to a casing (18), the verification instrument (55) measuring at least one of the following operating parameters: the movement of said pumping member (17) or of the component (160) of the motor (16), an electrical characteristic of an electric current electrically supplying or circulating in the motor (16).

3. Actuator according to any one of claims 1 to 2, characterized in that the monitoring controller (50) is configured to determine whether the second supply pressure (PMON) is identical, to within a predetermined margin, to a target pressure (PNOM), the monitoring controller (50) and the control controller (40) applying a degraded operating mode when the second supply pressure (PMON) is not identical, to within a predetermined margin, to the target pressure (PNOM).

4. Actuator according to claim 3, characterized in that the monitoring controller (50) is configured to determine the target pressure (PNOM) from said pressure setpoint (PCONS).

5. Actuator according to any one of claims 1 to 4, characterized in that the control controller (40) is configured to determine a first verification pressure (PV1) from said at least one verification signal (SVERIF) and a conversion law of the pressure model, the monitoring controller (50) being configured to determine a second verification pressure (PV2) from said at least one verification signal (SVERIF) and the conversion law.

6. Actuator according to claim 5, characterized in that said actuator (10) comprises a permanent memory (45) storing update data comprising a change in said value of said at least one operating parameter and at least one of the first and second verification pressures during a current operating cycle of the pump (15) during an application of the nominal operating mode, at least said monitoring controller (50) or said control controller (40) being configured to update said conversion law as a function of the stored update data.

7. Actuator according to any one of claims 5 to 6, characterized in that the monitoring controller (50) and the control controller (40) are configured to apply, when the actuator (10) is not operating according to the nominal operating mode (MODNOM), a degraded operating mode (MODDEG) chosen from several degraded operating modes as a function of: - a comparison (COMP1) made by the monitoring controller (50) of the second verification pressure (PV2) and the second supply pressure (PMON) and - a comparison (COMP2) made by the control controller (40) of the first verification pressure (PV1) and the first supply pressure (PCOM).

8. Actuator according to claim 7, characterized in that, as long as the second verification pressure (PV2) and the second supply pressure (PMON) are identical, to within a predetermined margin, and at the same time the first verification pressure (PV1) and the first supply pressure (PCOM) are not identical, to within a predetermined margin, said degraded operating mode (MODDEG) is a degraded servo-control operating mode with virtual sensor (M0D1) during which the control controller (40) is configured to emit a control signal to the pump (15) as a function of the first verification pressure (PV1) and of said pressure setpoint (PCONS) and the monitoring controller (50) is configured to monitor the actuator (10) using the second supply pressure (PMON).

9. Actuator according to any one of claims 7 to 8, characterized in that as long as the second verification pressure (PV2) and the second supply pressure (PMON) are not identical, to within a predetermined margin, and at the same time the first verification pressure (PV1) and the first supply pressure (PCOM) are not identical, to within a predetermined margin, said degraded operating mode (MODDEG) is an inactive mode (M0D2) during which the command controller (40) is inactive and the monitoring controller (50) is configured to generate an alert.

10. Actuator according to any one of claims 7 to 9, characterized in that as long as the second verification pressure (PV2) and the second supply pressure (PMON) are not identical, to within a predetermined margin, and at the same time the first verification pressure (PV1) and the first measured supply pressure (PCOM) are identical, to within a predetermined margin, said degraded operating mode (MODDEG) is a monitoring degraded operating mode (MOD3), the control controller (40) being configured to emit a control signal to the pump (15) as a function of the first supply pressure (PCOM) and the monitoring controller (50) is configured to monitor the actuator (10) using the second verification pressure (PV2).

11. Actuator according to any one of claims 1 to 10, characterized in that the second hydraulic connection (35) comprises a valve (37) controlled by the control controller (40).

12. Method for controlling a first actuator (10, 61) provided with a pump (15) connected to a first hydraulic connection (30) and to a second hydraulic connection (35), the first hydraulic connection (30) being connected to a reservoir (25) containing a fluid (6), characterized in that the method comprises the following steps: - measurement (MES1) of a first supply pressure (PCOM) in said second hydraulic connection (35) with a first pressure sensor (41), - measurement (MES2) of a second supply pressure (PMON) in said second hydraulic connection (35) with a second pressure sensor (51), - in a nominal operating mode (MODNOM), controlling a pressure of the fluid delivered by said pump (15) in the second hydraulic connection as a function of a pressure setpoint (PCONS) and the first supply pressure (PCOM), and monitoring the actuator (10) as a function of the second supply pressure (PMON),- determination (MES3) of at least one operating parameter (VOL) of the pump (15), and - detection (STPD) of a failure of the actuator (10) and application accordingly of a degraded operating mode (MODDEG) as a function of said at least one operating parameter (VOL).,

13. Method according to claim 12, characterized in that the first actuator (61) supplies hydraulic fluid to a brake of a first main landing gear (91) of an aircraft (90), said aircraft (90) comprising a second actuator (62) supplies hydraulic fluid to a brake of a second main landing gear (92), said pressure setpoint is equal to a first braking pressure during normal operation and to a second braking pressure greater than the first braking pressure in the presence of an alert generated by the second actuator.

14. Braking system (60) provided with a hydraulic brake (65) and a braking control (63), characterized in that the braking system (60) comprises an actuator (10) according to any one of claims 1 to 11, said braking control (63) emitting a pressure setpoint (PCONS) to control the actuator, said second hydraulic connection (35) being hydraulically connected to the hydraulic brake (65).

15. Aircraft (90) provided with two main wheel landing gears (91, 92) and an auxiliary wheel landing gear (93), characterized in that the two main wheel landing gears (91, 92) each comprise a braking system (60) according to claim

16. 1H-. Aircraft according to claim 15, characterized in that the aircraft (90) comprises an immobilization system (94) for immobilizing the auxiliary wheel landing gear (93) on the ground in a predetermined position.

Images