Monitoring the health status of a computer's energy reserve

Abstract

Monitoring the health status of a computer's energy reserve, particularly in an aircraft. One aspect of the invention relates to a method for determining the health status of an energy reserve in an onboard computer. Figure for the abstract: Figure 2

Description

Title of the invention: Monitoring the health status of a computer's energy reserve. TECHNICAL FIELD OF THE INVENTION

[0001] The technical field of the invention is that of embedded systems, in particular in an aircraft.

[0002] The present invention relates to a method for determining the state of health of an energy reserve of a computer, a computer intended to implement this method and an aircraft comprising said computer. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0003] The integration of computers into an aircraft, typically a FADEC (Full Authority Digital Engine Control) computer, is severely restricted by compactness constraints, particularly regarding the size, weight, and power consumption of these computers. The main challenge is therefore to reduce the size of this equipment.

[0004] Some computers are connected to a power reserve to supply the computer in the event of a power outage, whether accidental or not. The power reserve is designed to supply the computer for a predefined and sufficiently long period, known as the "theoretical discharge time." This theoretical discharge time corresponds to the total discharge time of the power reserve when it is not subject to a failure.

[0005] The theoretical discharge time comprises two successive phases: a transparency phase and a backup phase, the latter being triggered when the transparency phase is complete. The transparency phase, with a duration referred to as the "transparency duration," allows the computer to continue its operations until the end of the power outage, provided that the outage is shorter than the transparency duration. In other words, the transparency phase allows the computer to remain transparent to the power outage as long as the outage is shorter than the transparency duration.

[0006] The backup phase allows the computer, when the interruption is longer than the transparency period, to cease its operations and save a set of data relating to its operation, otherwise known as the "context." The backup phase has a duration called the "backup time," which is triggered after the transparency period. The theoretical discharge time is therefore at least as long as the sum of the transparency period and the backup time.

[0007] With repeated use, the power supply and / or storage capacity of the energy reserve diminishes until it is no longer able to power the computer to complete the context save. The save phase therefore no longer meets the planned save duration. Consequently, it is necessary to regularly check that the energy reserve is functioning correctly, typically before performing a mission with the aircraft.

[0008] It is known to monitor the health of the energy reserve using an external device. This device applies load tests, typically current and / or voltage, to the energy reserve and assesses its health by comparing the values ​​collected during these tests to reference data. This type of approach therefore requires the use of additional equipment, which contradicts the compactness constraints mentioned above.

[0009] There is therefore a need for a means of monitoring the health status of the energy reserve of a computer in a system constrained in compactness. Summary of the invention

[0010] The invention offers a solution to the problems mentioned above, by allowing the assessment of the state of health of the energy reserve by the computer itself, instead of using an additional device.

[0011] A first aspect of the invention relates to a method, implemented by a computer, for determining the state of health of an energy reserve, the energy reserve being adapted to be activated when the computer is no longer powered by a power supply and to power the computer for a predefined duration, called the theoretical discharge time, the theoretical discharge time corresponding to the duration of power supply to the computer by the energy reserve in nominal operation, the method comprising: • After restarting the computer following a discharge of the energy reserve, obtain information relating to said discharge, the information being determined by the computer; • Compare the information obtained with reference information and: • When the information obtained verifies a rule based on the reference information, determine that the energy reserve has a so-called nominal state of health; • When the information obtained does not verify a rule based on the reference information, determine that the energy reserve has a so-called failing state of health.

[0012] The term "energy reserve" means one or more electronic components adapted to store electrical energy when the computer is powered by A third-party power source is used to power the computer when that third-party power source is disconnected. Typically, a power bank includes one or more capacitors that return to the computer the energy stored during their charging. The power bank is designed to power the computer for a theoretical discharge time, which is, for example, between 2 ms and 500 ms.

[0013] The term "discharge" refers to the transfer of energy stored in the energy reserve to the computer in the event of a power outage. The term "discharge" here refers to a complete discharge of the energy reserve, meaning that the energy stored in the reserve is entirely depleted at the end of the discharge. If the energy reserve is not depleted by the discharge, it is referred to as a "partial discharge."

[0014] The term "health status" refers to a characteristic attributed to the energy reserve that indicates whether it is subject to an anomaly, for example, a malfunction of one of its components, resulting in its inability to supply the computer with sufficient power for a sufficient duration in the event of a power outage for the computer to function as expected. In other words, a failure of the energy reserve leads to an effective discharge time, i.e., the time actually maintained by the reserve during its discharge, that is shorter than the theoretical discharge time. The energy reserve is therefore in a so-called nominal health status when the energy reserve discharges in a time greater than or equal to the theoretical discharge time. Conversely, the energy reserve is in a so-called deficient health status when the energy reserve discharges in a time shorter than the theoretical discharge time.

[0015] "Restarting" refers to starting the computer after it has been switched off. Specifically, restarting is performed after the energy reserve has been discharged, at which point the computer is switched off. Restarting allows the computer to be turned back on after this discharge. The discharge may be caused by an incident, whether intentional or accidental, that cuts off the power supply to the computer while it is in use. For example, the discharge may be caused by switching off the computer when it is no longer needed.

[0016] The term "discharge information" refers to data determined by the computer that characterizes the discharge of the reserve. In particular, this data indicates whether the discharge was carried out normally, i.e., whether the actual discharge time reached the theoretical discharge time, or not. The information is in an alphanumeric format, typically a scalar, a string of characters, a boolean, etc.

[0017] A "reference information-based rule" means one or more conditions which, when the information obtained is compared with the reference information, make it possible to determine whether the state of health is satisfactory or deficient.

[0018] Thanks to the invention, it is possible to monitor the health status of an energy reserve without using an auxiliary system. The health status check is performed directly by the computer as soon as it is restarted.

[0019] Advantageously, the health check can be performed when the computer is started for a new use, even though it was intentionally shut down at the end of the previous use. The discharge is then intentionally triggered by shutting down the computer at the end of the previous use. Typically, in the case of an embedded computer, for example in a vehicle such as an aircraft or a car, it is possible to implement the method when the vehicle is put into service for a new use and has been shut down at the end of the previous use, thereby discharging the energy reserve.

[0020] In addition to the characteristics just mentioned, the process according to the first aspect of the invention may have one or more complementary characteristics from among the following, considered individually or according to all technically possible combinations.

[0021] In one embodiment, the process according to the first aspect comprises: • When the health status is failing, issue an alert including an indication relating to the failing health status.

[0022] An "alert" is defined as a warning transmitted to an operator and / or a monitoring system to alert the operator and / or the monitoring system that the energy reserve is in a failing state of health that prevents it from performing its function for the entire theoretical discharge time. The alert may be a voice message, a visual message, alphanumeric data transmitted to an alert triggering mechanism, or any other type of alert.

[0023] The term "indication relating to the failing state of health" means data included in the alert which indicates that the energy reserve is in a failing state of health.

[0024] In one embodiment, the information relating to the discharge of the energy reserve is a counter, a first value is assigned to the counter before the activation of the energy reserve, the counter is incremented from the first value up to a second value when an instant preceding the end of the discharge of the energy reserve is reached, the previous instant being dependent on the theoretical discharge time and a clock signal, and the rule is that the information obtained is equal to the reference information, the reference information being equal to the second value.

[0025] The term "counter" refers to a predetermined parameter that can be incremented by the computer during the execution of the process. Typically, the increment indicates that the discharge is proceeding normally. When the increment is not performed, the discharge is not proceeding normally.

[0026] A "clock signal" is understood to be an oscillating electrical signal whose period is called a clock cycle. The clock signal is generated by one of the computer's components, for example, by a processor (CPU for "Central Processing Unit") or a real-time clock (RTC for "Real-Time Clock"). At each clock cycle, the computer triggers one of the operations it must perform, for example, incrementing the counter or saving one or more pieces of context data.

[0027] The term "instant preceding the end of the discharge" means the last instant corresponding to the last complete clock cycle before the theoretical end of the discharge of the energy reserve.

[0028] It is thus possible to determine quickly, without requiring the storage of extensive data, whether the discharge occurred normally. Indeed, when the information obtained is equal to the first value, this means that the discharge did not reach its theoretical discharge time, since it was not possible to assign the second value to the discharge information at the last instant before the theoretical end of the discharge. Conversely, when the information is equal to the second value, this means that the energy reserve is functioning normally, since it allowed the second value to be assigned to the information at the last instant before the theoretical end of the discharge, i.e., before the theoretical discharge time.

[0029] In one embodiment, after determining the state of health of the energy reserve, the first value is assigned to the information relating to the discharge of the energy reserve.

[0030] The counter can be in a very simple format, in this case binary, reducing the computational cost of implementing the process according to the first aspect.

[0031] For example, the counter can take a zero value as its first value and a non-zero value as its second value. Other types of values ​​can be used, such as TRUE / FALSE, OK / NOK, etc. combinations.

[0032] In addition, the discharge information is reset before implementing the process again according to the first aspect.

[0033] In one embodiment, the first value is equal to the value of the counter incremented at the instant preceding the end of the penultimate discharge.

[0034] The counter thus represents a number of discharges that have previously taken place and for which the theoretical discharge time has been reached. The counter can be incremented after each discharge performed normally. For example, the counter has successive positive integer values, and a positive integer increment.

[0035] In one embodiment, a first value is assigned to the information relating to the discharge of the energy reserve before the activation of the energy reserve, a second value is assigned to the information relating to the discharge of the energy reserve during the discharge of the energy reserve, the second value being equal to the duration of the discharge, called the effective discharge duration, and the rule is that a difference between the information obtained and the reference information is less than a predefined threshold, the reference information being the theoretical discharge duration.

[0036] In this embodiment, the information relating to the energy discharge corresponds to the actual duration of the discharge that took place. The information is therefore determined even if the instant preceding the theoretical end of the discharge has not been reached. It is thus possible to determine whether the actual duration of the discharge corresponds to the predicted theoretical duration, taking into account a margin of error through the use of the predefined threshold.

[0037] In one embodiment, after determining the state of health of the energy reserve, the first value is assigned to the information relating to the discharge of the energy reserve.

[0038] It is therefore possible to reset the information relating to the discharge before implementing the process again according to the first aspect.

[0039] In one embodiment, the process according to the first aspect further comprises: • Predict an energy reserve failure, the failure being predicted when a difference between the theoretical discharge time and a future discharge time is greater than or equal to the predefined threshold, the future discharge time being associated with a number of future activations of the energy reserve and being determined from an evolution of the discharge time, the evolution of the discharge time being determined for two or more discharges of the energy reserve prior to the reactivation of the computer.

[0040] It is thus possible to rely on a history of actual discharge times, determined by previous implementations of the process according to the first aspect, to predict when the energy reserve will fail. The date on which the failure will occur is preferably estimated as the number of activations of the reserve up to that failure. This therefore represents the number of times this energy reserve has been used.

[0041] A second aspect of the invention relates to a computer configured to implement the method according to the first aspect.

[0042] A third aspect of the invention relates to an aircraft comprising a computer according to the second aspect.

[0043] A fourth aspect of the invention relates to a computer program product comprising instructions which, when the program is executed on a computer, lead the latter to implement the steps of the process according to the first aspect.

[0044] A fifth aspect of the invention relates to a computer-readable recording medium comprising instructions which, when executed by a computer, lead the computer to carry out the steps of the process according to the first aspect.

[0045] The invention and its various applications will be better understood by reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0046] The figures are presented for illustrative purposes only and are in no way limiting of the invention. • Fig. 1 is a schematic representation of a vehicle including an on-board computer. • Figure 2 is a synoptic diagram illustrating the sequence of steps of a process according to a method of implementation. • Figure 3 is a synoptic diagram illustrating the sequence of steps in the proceed according to another embodiment. • Figure 4 is a synoptic diagram illustrating the sequence of steps of a process leading to the implementation of the process in Figures 2 or 3. DETAILED DESCRIPTION

[0047] Unless otherwise specified, the same element appearing on different figures has a unique reference.

[0048] In order to reduce the size of embedded systems, particularly in an aircraft such as an airplane, a helicopter or a drone, the invention described below proposes a method enabling this embedded system to determine by itself whether the energy reserve of its computer is functioning correctly or whether it has a malfunction.

[0049] Although the invention and its various variants are presented in the case of a computer embedded in an aircraft, the proposed approach can be applied to any other type of vehicle or system carrying a computer powered by an energy reserve in the event of a power outage affecting the computer.

[0050] As illustrated in [Fig. 1], the computer 10 is embedded in a system, here a vehicle 1 such as an airplane, a drone, or a helicopter. The computer 10 is connected to a power supply 12, which provides power to the computer 10.

[0051] The computer 10 is also connected to a power reserve 11, which replaces the power supply 12 in the event of a power outage. A switch 13 is connected between the power reserve 13 and the computer 10.

[0052] The switch 13 is controlled by a controller 14, which serves to close the switch 13 in the event of a power failure. The controller 14 is also connected to the power supply and serves to detect a power failure.

[0053] When there is no power interruption, the switch 13 is open, allowing the energy reserve 11 to store energy. This energy is returned to the computer when the energy reserve 11 is discharged.

[0054] In order to monitor that the energy reserve 11 is capable of supplying the computer 10 in accordance with a theoretical discharge time, the invention relates to a method 100 for determining the state of health of an energy reserve 11, as illustrated in [Fig.2].

[0055] The theoretical discharge time represents the duration for which the energy reserve 11 must supply power to the computer 10 when the energy reserve is not malfunctioning. The theoretical discharge time therefore corresponds to a so-called nominal operating condition for the energy reserve 11.

[0056] The method 100 is implemented by the computer 10 itself, which is therefore adapted to implement this method 100. The computer comprises at least one processor. The computer also comprises memory, volatile and / or non-volatile. The computer includes instructions, for example stored in its volatile or non-volatile memory, which, when executed by the processor of said computer, cause the processor, and therefore the computer, to implement the method 100.

[0057] The computer can be any type of computer. As an example of an embodiment, the computer 10 is a FADEC (Full Authority Digital Engine Control) computer.

[0058] In the implementation example presented, the method 100 is implemented through a method 200, as illustrated in [Fig.4], for monitoring the operation of the energy reserve 11 of the system 1. The method 100 could, however, be implemented in a completely different framework than that proposed in the example and be, for example, implemented individually.

[0059] The method 200 includes a step 210 of cutting off the power supply to the vehicle 1. This power cut-off can be voluntary, typically because the use of the vehicle 1 is finished, or be accidental, for example due to a malfunction of the power supply 12. As an example, in the case of an aircraft, the power supply 12 of the vehicle 1 is cut off at the end of the mission for which the aircraft is used.

[0060] The method 200 also includes a step 220 of activating the energy reserve 11, due to the shutdown of the power supply, which then supplies the computer until it is completely discharged.

[0061] The method 200 also includes a step 230 of stopping the computer 10 when the discharge of the energy reserve 11 is complete, i.e. the energy reserve is exhausted.

[0062] The method 200 also includes a step 240 of restarting the computer by restarting the power supply 12 of the vehicle 1. As an example, in the case of an aircraft, the power supply 12 of the vehicle 1 is switched off at the end of the mission for which the aircraft is used, and then switched back on for the next mission.

[0063] The process 200 also includes a step 250 of implementing the process 100.

[0064] The method 100 includes a step 110 for obtaining information relating to the discharge of the energy reserve. This step 110 is implemented after the computer has been restarted. In other words, this step 110 is implemented after the computer has been restarted.

[0065] The computer was therefore stopped before the implementation of process 100, which caused the discharge of the energy reserve 11, for example via the implementation of process 200.

[0066] The invention therefore takes place in the case where a power outage has been longer than the transparency period, which has triggered the complete discharge of the energy reserve, before the implementation of the process 100.

[0067] The process 100 also includes a step 120 of comparing the information obtained with reference information. The reference information is preferably of the same nature as the information obtained, so as to reduce the number of calculations required for the analysis of the information obtained.

[0068] The reference information is predefined, for example by an operator, a manufacturer, via a simulation tool, etc. The reference information indicates a characteristic, for example of the same nature as the information obtained, of the energy reserve when it is functioning normally, i.e., is in a nominal state of health.

[0069] It is therefore verified, by implementing this comparison step 120, whether the information obtained complies with a rule with respect to the reference information. In other words, it is a matter of verifying whether the information obtained conforms to the reference information, which represents the nominal behavior of the energy reserve.

[0070] In particular, when the rule in question is verified by the information obtained, then the calculator 10 determines that the energy reserve 11 has a nominal state of health.

[0071] Conversely, when this rule is not followed, the computer 10 determines that the energy reserve 11 is in a faulty state. The energy reserve 11 is therefore subject to malfunction.

[0072] The process 100 may further include a step 130 for issuing an alert when the health status of the energy reserve 11 is failing. The alert includes an indication of the failing health status.

[0073] The alert is, for example, sent by the control unit 10 to a third-party device, such as a display device that shows the alert content to an operator, to a suitable actuator to activate a visual and / or audible warning when the alert is sent, or to any other third-party device. Alternatively, the alert can be sent to an application and / or a system dedicated to monitoring the components, devices, and systems included in the vehicle 1. The application and / or monitoring system can then analyze the alert and automatically perform tests on the energy reserve 11 before informing the operator.

[0074] Examples of embodiments of the process 100 are given below. Through these different embodiments, it can be seen that the information relating to the discharge of the energy reserve 11 is defined as being equal to a first value before the activation of the discharge of the energy reserve 11. This assignment of the first value to the information relating to the discharge of the energy reserve, as well as the nature and definition of this first value, depend on the embodiment variant concerned.

[0075] It can also be appreciated that triggering the discharge can lead to a change in the discharge information for the energy reserve 11. In other words, during the discharge of the energy reserve 11, the value of the discharge information can be changed to a second value. Typically, the assignment of this second value to the discharge information for the energy reserve can occur during the discharge, either at a single point or periodically throughout the discharge duration, depending on the embodiment implemented.

[0076] In a first embodiment, the information relating to the discharge of the energy reserve 11 is a counter. The first value is thus assigned, i.e., entered, by the computer 10 to the counter before the energy discharge is triggered. The counter therefore takes the first value before the energy discharge is triggered. Typically, the computer assigns the first value to the counter during the previous use of the vehicle, before a power outage. This assignment does not occur, for example, during a step 205 of process 200, prior to step 210 of power supply interruption. This assignment can alternatively be implemented before the implementation of process 200. Alternatively, the assignment of the first value to the meter can be implemented at the end of a previous implementation of process 100. The assignment of the first value to the meter is preferably carried out after the penultimate discharge of the energy reserve, for example, after the discharge preceding the discharge of step 220 of process 200.

[0077] When the discharge reaches the theoretical discharge time, more particularly when the instant preceding this theoretical discharge time is reached, the counter is incremented, that is to say it is modified, to be equal to the second value.

[0078] The instant preceding the end of the discharge is defined in terms of the clock cycle of one of the components of the computer 10. This previous instant is therefore dependent on the theoretical duration of discharge and the clock signal generated by one of the components of the computer 10.

[0079] In the example proposed, the clock signal is generated by the processor of the computer 10, but can alternatively be generated by another component such as a real-time clock included in the computer 10. The previous instant then corresponds to the last complete clock cycle generated before the theoretical end of the discharge, i.e., the theoretical discharge time, or to a predefined value depending on a number of clock cycles before the end of the theoretical discharge time.

[0080] The preceding instant is therefore the ultimate instant before the theoretical discharge time at which the calculator 10 is sufficiently powered to perform a final operation, i.e., the increment of the counter.

[0081] In this first embodiment, to determine the time preceding the theoretical discharge time, the computer 10 must measure the time elapsed since the energy reserve was activated. This determination is made by counting the number of clock cycles of the relevant component of the computer 10, mentioned above. Since the duration of a clock cycle is known, the computer is therefore able to estimate the time elapsed since the start of the discharge. Thus, when this elapsed time corresponds to the time preceding the theoretical end of the discharge, the computer 10 then updates the counter.

[0082] Alternatively, the calculator 10 measures the time elapsed since the beginning of the backup phase of the theoretical discharge duration. In this case, the theoretical discharge duration is equal to the theoretical backup duration, i.e., the duration theoretically planned for the backup phase, and not the total discharge duration, which also includes the transparency phase.

[0083] The rule for determining whether the energy reserve 11 is in a nominal or faulty state of health is that the information obtained, i.e., the meter, which takes the first or to the second value depending on the success of the increment, is equal to the reference information. In particular, the reference information is, in this embodiment, equal to the second value.

[0084] In other words, upon implementation of the comparison step 120, if the information obtained is equal to the second value, then the energy reserve 11 is in a nominal state of health. If, on the contrary, the information obtained is equal to the first value, the energy reserve 11 is in a faulty state of health.

[0085] In a first variant of this first embodiment, the counter is a binary counter, whose first value is its initial value (for example, 0, False, NOK, etc.), and the second value is its final value (1, True, OK, etc., respectively).

[0086] In this first embodiment, to ensure that the counter is reset before the next discharge, the method 100 may include a step 140, after the comparison step 120, of modifying the discharge information to assign the first value to the discharge information. If necessary, this counter reset step 140 may be implemented before, after, or concurrently with the alert issuance step 130.

[0087] In a second variant of this first embodiment, the counter is a non-binary counter with a predefined increment step, for example, an integer step such as a unit step. The counter then serves to indicate the number of discharges performed normally, i.e., whose discharge duration is at least equal to the theoretical discharge duration. The counter is then incremented by the chosen step after each discharge performed normally.

[0088] Thus, when process 100 is implemented, the counter is already equal to the first value, which corresponds to the counter value during the penultimate discharge performed normally, at the instant preceding the theoretical end of the discharge. Therefore, there is no counter reset step in this variant of the first embodiment. The second value is thus the first value to which the increment of the chosen step is added, for example, a step of 1. In this embodiment, a counter whose second value is 13 indicates that the energy reserve has been discharged normally 13 times.

[0089] In a second embodiment, the discharge information is a measure of the actual discharge time, i.e., the real discharge time and not its theoretical duration. The actual time is then compared to the theoretical duration to assess whether the energy reserve 11 is functioning normally. The measurement of the actual discharge time is therefore carried out by the computer before it is restarted, i.e., before the implementation of process 100.

[0090] In this embodiment, the first value is assigned, i.e., configured, by the control unit 10 to the discharge information before the energy discharge is initiated. Typically, the control unit performs the assignment to the first value during the previous use of the vehicle, before a power interruption occurs, for example, during a step 205 of process 200, prior to the power interruption step 210. Alternatively, the assignment of the first value to the counter can be implemented at the end of a previous implementation of process 100. The assignment of the first value to the counter is preferably performed after the penultimate discharge of the energy reserve, for example, after the discharge preceding the discharge in step 220 of process 200. The counter is therefore initialized to the first value, for example, a predefined value, such as zero.

[0091] The effective discharge time is evaluated by the computer according to the time base imposed by the clock signal of one of its components. In the example shown, the clock signal is generated by the processor of computer 10, but it can alternatively be generated by another component such as a real-time clock included in computer 10.

[0092] In this embodiment, the computer 10 therefore determines the time elapsed since the activation of the energy reserve. This determination is made by counting the number of clock cycles of the relevant component of the computer 10, as mentioned above. Since the duration of a clock cycle is known, the computer is thus able to evaluate at any given moment the time elapsed since the start of the discharge. The computer assigns the second value to the discharge information at each instant corresponding to a clock cycle until the energy reserve 11 is depleted. The second value then corresponds to the value to which the information is assigned at the last assignment. The second value is therefore equal to the actual duration of the discharge. Thus, when step 110 is implemented, the discharge information obtained by the computer is this second value.

[0093] Alternatively, the calculator 10 determines the time elapsed since the start of the backup phase from the theoretical discharge duration. The second value then corresponds to the actual discharge duration since the start of the backup phase. In this case, the theoretical discharge duration is equal to the theoretical backup duration, i.e., the duration theoretically planned for the backup phase, and not the total discharge duration, the latter also including the transparency phase.

[0094] In this embodiment, the reference information is therefore the theoretical discharge time. The rule that the information obtained must respect is therefore that a difference calculated between the reference information, i.e., the theoretical discharge time discharge, and the information obtained, i.e., the second value, is less than a predefined threshold.

[0095] This threshold is predefined by the operator or manufacturer, or via a simulation tool, or by any other means. For example, the predefined threshold is equal to 1%, 2%, 5%, or even 10% of the theoretical discharge time. The difference between the information obtained and the reference information is calculated as an absolute value.

[0096] In this embodiment, to ensure that the discharge information is reset before the next discharge, the process 100 may include a step 140, after the comparison step 120, for modifying the discharge information to assign the first value to the discharge information. If necessary, this reset step 140 may be implemented before, after, or concurrently with the alert issuance step 130.

[0097] In a variant of the second embodiment, as illustrated in [Fig. 3], the method 100 may include a step 150 for predicting a future failure of the energy reserve, subsequent to the comparison step 120. This prediction step 150 is implemented when it is determined, in the comparison step 120, that the state of health is nominal.

[0098] Indeed, determining the effective discharge time of the energy reserve 11 for several successive discharges, at least two discharges, makes it possible to create a history of this effective discharge time.

[0099] It is therefore possible to determine an evolution of the effective discharge time as a function of the number of discharges of the energy reserve.

[0100] The evolution of the effective discharge time can be modeled via an interpolation or regression function, for example a linear or non-linear function, or by a more sophisticated approach, for example based on machine learning.

[0101] Thus, when, for a future discharge, the computer 10 determines that the difference between the theoretical discharge time and the actual discharge time predicted by the model does not meet the predefined threshold, i.e., that the difference is greater than or equal to this threshold, then it is predicted that a failure will occur during this future discharge. Consequently, this future discharge will be shorter than the predicted theoretical time, taking into account the tolerance imposed by the predefined threshold.

[0102] The method 100 can then also include a step 160 of issuing an indication relating to the number of discharges before the failure predicted by the model. The indication is, for example, sent to the operator to schedule maintenance, or to a dedicated application for monitoring the components, devices and systems included in vehicle 1. The monitoring application can thus anticipate the failure and inform or plan maintenance before the occurrence of the failure.

[0103] In the various embodiments presented, the discharge information is preferentially stored in the non-volatile memory of the computer 10. Thus, at each assignment and / or initialization, the value stored in memory is modified to correspond to the value assigned during said assignment and / or initialization, respectively. The computer 10 is therefore adapted to write the discharge information to the relevant memory.

[0104] Similarly, in order to assess whether the theoretical discharge time is reached, or to perform the comparison in the second embodiment, the theoretical discharge time is preferably stored in the non-volatile memory of the computer 10. This time can alternatively be stored in volatile memory, provided that the computer obtains this data before the discharge, for example through a third-party device which transmits this information to it or by information from the operator.

[0105] Furthermore, the calculator 10 is also adapted to detect or be informed by the controller 14 of the activation of the discharge, by approaches known per se.

[0106] In the various embodiments, when the theoretical discharge time is equal to the backup time, the computer is adapted, by techniques known per se, to determine the end of the transparency phase and the beginning of the backup phase, in order to trigger the measurement of the elapsed time.

[0107] In the various embodiments, it is possible to save the result of the comparison, i.e., the determined health status, and to associate it with one or more data points relating to the discharge or the use of vehicle 1 during which the discharge occurred. For example, the data point relating to the discharge could be the date of the discharge, the mission number associated with the last use of vehicle 1, the environmental conditions under which vehicle 1 was used during this last use, etc.

Claims

Demands

1. A method, implemented by a computer, for determining the health status of an energy reserve, the energy reserve being adapted to be activated when the computer is no longer supplied by a power supply and to supply the computer for a predefined duration, called the theoretical discharge time, the theoretical discharge time corresponding to the duration of supply of the computer by the energy reserve in nominal operation, the method comprising: - After restarting the computer following a discharge of the energy reserve, obtaining information relating to said discharge, the information being determined by the computer; - Comparing the information obtained with reference information and: • When the information obtained verifies a rule based on the reference information, determining that the energy reserve has a so-called nominal health status;• When the information obtained does not verify a rule based on the reference information, determine that the energy reserve has a so-called failing state of health.

2. Method according to the preceding claim, comprising: - When the health status is failing, issue an alert including an indication relating to the failing health status.

3. A method according to any one of claims 1 and 2, wherein the information relating to the discharge of the energy reserve is a counter, a first value is assigned to the counter before the activation of the energy reserve, the counter is incremented from the first value to a second value when a time preceding the end of the discharge of the energy reserve is reached, the time preceding being dependent on the theoretical discharge time and a clock signal, and the rule is that the information the obtained is equal to the reference information, the reference information being equal to the second value.

4. A method according to claim 3, wherein, after determining the state of health of the energy reserve, the first value is assigned to the information relating to the discharge of the energy reserve.

5. A method according to claim 3, wherein the first value is equal to the value of the counter incremented at the instant preceding the end of the penultimate discharge.

6. A method according to any one of claims 1 and 2, wherein a first value is assigned to the information relating to the discharge of the energy reserve before the activation of the energy reserve, a second value is assigned to the information relating to the discharge of the energy reserve during the discharge of the energy reserve, the second value being equal to the duration of the discharge, referred to as the effective discharge duration, and the rule is that a difference between the information obtained and the reference information is less than a predefined threshold, the reference information being the theoretical discharge duration.

7. A method according to claim 6, wherein after determining the state of health of the energy reserve, the first value is assigned to the information relating to the discharge of the energy reserve.

8. A method according to any one of claims 6 and 7, further comprising: - Predicting a failure of the energy reserve, the failure being predicted when a difference between the theoretical discharge time and a future discharge time is greater than or equal to the predefined threshold, the future discharge time being associated with a number of future activations of the energy reserve and being determined from an evolution of the discharge time, the evolution of the discharge time being determined for two or more discharges of the energy reserve prior to the reactivation of the computer.

9. Calculator configured to implement the method according to any one of claims 1 to 8.

10. Aircraft comprising a computer according to the preceding claim.

Images