Redundant Aircraft Engine Control Channels for Link Fault Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control devices for turbojet engines face challenges in discriminating between processor malfunctions and communication issues between channels, leading to unnecessary isolation of healthy channels and potential engine flame-out, which reduces redundancy and increases in-flight shutdown rates.
Innovation Solution
A control device with two channels, each equipped with sensors and processing units that consolidate measurements and compute actuator commands, includes a failsafe operation mode where the passive channel computes commands based on previous active channel data during communication link interruptions, and a process-monitoring unit to temporarily or definitively disable the passive channel if divergence is detected, ensuring only the malfunctioning channel isolates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the control device compares only the results of computations on each channel to detect malfunctions, then it can identify processor failures, but it cannot discriminate between processor malfunctions and communication link interruptions, leading to unnecessary isolation of healthy channels
Solution Approach 1:
The control device is divided into two independent channels, each with its own sensors and processing units. This segmentation allows each channel to operate autonomously and detect faults independently, preventing a single point of failure and enabling accurate discrimination between processor malfunctions and communication issues.
Solution Approach 2:
Each channel continuously monitors and compares its computations with the other channel. This feedback mechanism enables the system to detect discrepancies and determine whether they originate from processor malfunctions or communication link interruptions, thereby improving fault detection accuracy while maintaining channel availability.
2Reliability
If the passive channel is disabled upon detecting a communication link interruption, then the system secures itself against potential hazards, but it penalizes the availability of redundancy for the mission and increases in-flight shutdown rates
Solution Approach 1:
The control system dynamically adjusts the operational state of channels based on the type of fault detected. When a communication link interruption is detected, the system maintains the passive channel in a monitoring capacity rather than disabling it completely. This dynamic approach preserves redundancy and mission availability while ensuring system safety through continued monitoring.
Solution Approach 2:
The system changes the operational parameters of the passive channel based on fault type. Instead of a binary enabled/disabled state, the passive channel transitions to a restricted monitoring mode during communication interruptions, allowing it to remain partially operational and maintain redundancy without compromising system safety.
Data Source
AI summary
The invention relates to an engine control device comprising a first control channel (V1) and a second control channel (V2), each control channel comprising a first sensor (CAV1, CAV2) and a second sensor (CBV2, CBV2), each configured to provide, respectively, a first measurement (A) and a second measurement (B) to each channel, each of the channels having an active or passive state defining an active channel (V1) or a passive channel (V2), the active channel (V1) being designed to control at least one actuator (ACT) of the engine while the passive channel (V2) is designed to take over for the active channel if the latter fails.