Aircraft Engine Shutdown Interface Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional logic for shutting down engines in twin-engine aircraft is not optimized for cruise flight phases, where both engines may need to be shut down automatically due to anomalies, potentially leaving the aircraft without sufficient power during critical flight conditions.
Innovation Solution
A method where the interface device, connected to both engine control units, inhibits the activation of a protection mode on the second engine unless the anomaly severity of the second engine exceeds that of the first engine, allowing for automatic shutdown of both engines during cruise flight by comparing anomaly severity levels and sending appropriate inhibit signals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the interface device prohibits activation of protection mode on the second engine after the first engine is shut down, then the pilot can evaluate and potentially restart the second engine, but the aircraft may operate without sufficient power during cruise flight phases
Solution Approach 1:
The system dynamically changes the protection mode activation logic based on flight phase. During cruise flight, the interface device allows automatic protection mode activation on the second engine if anomaly severity exceeds a threshold. During takeoff and landing phases, the interface device prohibits automatic activation to maintain pilot control. This dynamic adaptation resolves the contradiction by adjusting system behavior according to operational context.
Solution Approach 2:
The system changes the anomaly severity threshold parameter based on flight phase. During cruise flight, a higher anomaly severity threshold is applied, allowing automatic shutdown. During critical phases like takeoff and landing, the threshold is effectively lowered or disabled, requiring pilot evaluation. This parameter change enables the system to balance reliability and operational control based on flight conditions.
2Reliability
If the interface device allows automatic shutdown of the second engine during cruise flight, then aircraft power is maintained, but the system complexity increases due to anomaly severity comparison logic
Solution Approach 1:
The control logic is segmented into distinct functional modules: anomaly detection module in each FADEC, severity level determination module, interface device receiving module, comparison module, and protection mode activation module. This segmentation distributes complexity across multiple specialized components rather than concentrating it in a single complex decision-making unit, making the system more manageable and maintainable.
Solution Approach 2:
The interface device acts as an intermediary between the two FADEC control units. It receives anomaly information from the first FADEC, determines severity levels, compares with the second engine's anomaly, and sends appropriate commands. This intermediary role simplifies the overall system architecture by centralizing the complex comparison logic in a dedicated component rather than requiring direct complex interactions between all system elements.
3Reliability
If the interface device requires anomaly severity comparison before allowing second engine shutdown, then unnecessary shutdowns are prevented, but response time is increased during critical anomalies
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and pre-determining anomaly severity levels for both engines before a shutdown decision is required. The FADEC units continuously assess engine parameters and pre-calculate severity levels, so when an anomaly occurs, the comparison can be performed rapidly using pre-computed data rather than requiring real-time analysis during the decision-critical moment.
Solution Approach 2:
The system implements feedback loops where anomaly severity information is continuously fed back to the interface device from both FADEC units. This ongoing feedback allows the system to maintain up-to-date severity assessments, enabling rapid comparison and decision-making when anomalies occur, as the information is already available and continuously updated rather than requiring new data collection during the emergency.
Data Source
AI summary
A method to automatically shutdown engines of a twin-engine aircraft where each engine is controlled by a control unit (4,5) and an interface device (6) coordinates the control units, the interface device having first and second operating modes, wherein the switching between modes is based on the airspeed and altitude of the aircraft; wherein in the first operating mode, the automatic shutdown can take place only on the first of the two engines (2,3) which exhibits an operational anomaly, and in the second operating mode, typically implemented during a cruise phase, the automatic shutdown will be able to be implemented on a first and then on a second engine (2,3) if the second engine exhibits an operational anomaly more severe than the one exhibited by the first engine.