Redundant Aircraft Engine Control Channel Fault Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing turbojet aircraft engine control systems struggle to reliably differentiate between processor failures and communication issues between channels, leading to unnecessary isolation of healthy channels and reduced engine availability.
Innovation Solution
Implementing a method with a process monitoring unit that detects differences in calculated commands between channels, allowing for temporary or permanent deactivation of the passive channel only when a fault is confirmed, and activating a degraded operating mode to manage communication link interruptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If a break in the inter-channel link stops mutual monitoring and triggers system securing, then safety is maintained, but redundancy availability is penalized and healthy channels are incorrectly isolated
Solution Approach 1:
The monitoring functions are divided into separate units: the first monitoring unit handles calculation result comparison, while the second monitoring unit handles communication link monitoring. This allows the system to identify communication breaks without triggering full system securing, thereby maintaining redundancy availability while preserving safety through targeted monitoring.
Solution Approach 2:
Instead of assuming that any monitoring discrepancy indicates a processor failure requiring system securing, the invention inverts the logic by first checking communication link status through the second monitoring unit. Only when communication is confirmed functional does the system proceed to treat calculation discrepancies as processor failures, thus avoiding unnecessary isolation of healthy channels.
2Reliability
If the discarded channel is the healthy channel due to communication problems, then redundancy is lost, but if the remaining channel is faulty and isolated by hardware self-tests, then the engine must be shut down, increasing in-flight shutdown rates
Solution Approach 1:
By segmenting the monitoring into two independent units, the system can accurately identify whether a channel should be isolated. The first monitoring unit detects calculation discrepancies, while the second monitoring unit verifies communication status. This prevents false isolation of healthy channels due to communication issues, maintaining redundancy and avoiding unnecessary engine shutdowns.
Solution Approach 2:
The second monitoring unit provides feedback about communication link status to the fault detection logic. This feedback mechanism enables the system to distinguish between genuine processor failures requiring isolation and mere communication interruptions, thereby preserving redundancy availability and reducing in-flight shutdown rates caused by false fault detection.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The invention relates to an engine control device comprising a first control channel (V1) and a second control channel (V2), each control channel comprising a first sensor (CAV1, CAV2) and a second sensor (CBV2, CBV2), each configured to provide, respectively, a first measurement (A) and a second measurement (B) to each channel, each of the channels having an active or passive state defining an active channel (V1) or a passive channel (V2), the active channel (V1) being designed to control at least one actuator (ACT) of the engine while the passive channel (V2) is designed to take over for the active channel if the latter fails.