CN114488771B

CN114488771B - Emergency oil drain integrated control system

Info

Publication number: CN114488771B
Application number: CN202210101122.4A
Authority: CN
Inventors: 葛锐; 江凯威; 张霄宇; 张瑞琪; 朱德轩
Original assignee: Comac Shanghai Aircraft Design & Research Institute; Commercial Aircraft Corp of China Ltd
Current assignee: Comac Shanghai Aircraft Design & Research Institute; Commercial Aircraft Corp of China Ltd
Priority date: 2022-01-27
Filing date: 2022-01-27
Publication date: 2024-02-20
Anticipated expiration: 2042-01-27
Also published as: CN114488771A

Abstract

Providing an emergency oil drain integrated control system, wherein the first cutting assembly comprises a first motor and a first cutting valve, and is used for cutting off emergency oil drain and independently acting by the first motor; the second cut-off assembly comprises a second motor and a second cut-off valve, and is also used for cutting off emergency oil drain and independently operated by the second motor. The independent emergency oil drain control system comprises a first oil level sensor assembly and an emergency control module, wherein the control module is configured to open a first cutting assembly to cut off emergency oil drain after receiving signal control of the first oil level sensor assembly; the fuel measurement management system comprises a management module, a second fuel level sensor assembly and a fuel quantity sensor assembly, wherein the management module is configured to control the opening of the second cutting assembly to cut off emergency fuel discharge after receiving a signal transmitted by the fuel quantity sensor assembly; and after receiving the signal transmitted by the second oil level sensor assembly, simultaneously controlling the opening of the first cutting assembly and the second cutting assembly. The system can effectively prevent the aircraft from excessively discharging oil.

Description

Emergency oil drain integrated control system

Technical Field

The invention relates to the field of aviation onboard systems, in particular to the field of oil discharge control of an aerial airplane.

Background

The emergency oil drain system is arranged to ensure that quick air oil drain can be realized under an air emergency condition, and ensure that even under extreme conditions such as faults when an aircraft takes off, the aircraft can have enough safe level to return to ground for landing. However, the oil discharge amount needs to be closely monitored, and if the oil is excessively discharged, the subsequent flying can be influenced.

At present, two main flow types of oil discharge control methods exist, one is to use a manual/automatic suspension air emergency oil discharge control system, and the other method is only aimed at a model which is specially provided with an emergency oil discharge pump for emergency oil discharge. Both of the above-mentioned common methods have disadvantages:

(1) Both are not separated from the fuel measurement management system, and the fuel quantity or low oil level signals provided by the fuel measurement management system are used, so that the emergency oil discharge can not be realized safely, reliably and effectively under the condition that the fuel measurement system fails due to too much dependence on the fuel measurement management system, and the fuel measurement management system is in a single-link control mode;

(2) Most of emergency oil drain cut-off valves adopt cut-off valves of single motor actuators, and common mode failure of the valves is easy to cause;

(3) The above needs require a class a system development security level (Development Assurance Level, DAL), which is relatively costly to develop;

(4) The emergency oil discharge pump and related auxiliary equipment such as installation and power supply control of the emergency oil discharge pump are additionally increased by controlling the installation height of the emergency oil discharge pump, so that the weight of the aircraft is increased, a certain height is required to be selected for installation of the emergency oil discharge pump, the difficulty of arranging the aircraft is increased, and the difficulty of matching the aircraft design is increased.

Disclosure of Invention

The invention aims to provide an emergency oil discharge comprehensive control system which can effectively avoid excessive oil discharge and ensure flight safety.

The emergency oil drain integrated control system for achieving the purpose comprises a first cutting-off assembly, a second cutting-off assembly, an independent emergency oil drain control system and a fuel measurement management system.

The first cut-off assembly comprises a first motor and a first cut-off valve, wherein the first cut-off valve is used for cutting off emergency oil drain and is independently operated by the first motor; the second cut-off assembly comprises a second motor and a second cut-off valve, and the second cut-off valve is also used for cutting off emergency oil drain and is independently operated by the second motor; the independent emergency oil drain control system comprises a first oil level sensor assembly and an emergency control module, wherein the emergency control module is configured to start the first cutting assembly after receiving signal control of the first oil level sensor assembly so as to cut off emergency oil drain; the fuel measurement management system comprises a fuel measurement management module, a second fuel level sensor assembly and an oil quantity sensor assembly, wherein the fuel measurement management module is configured to control the opening of the second cutting assembly after receiving a signal transmitted by the oil quantity sensor assembly so as to realize cutting off of emergency oil discharge, and simultaneously control the opening of the first cutting assembly and the second cutting assembly after receiving the signal transmitted by the second fuel level sensor assembly.

In one or more embodiments, the first and second oil level sensor assemblies, the first and second cutoff assemblies are all of dissimilar designs.

In one or more embodiments, the first fuel level sensor assembly emits a first signal when the fuel level in the fuel tank is below a first threshold, the second fuel level sensor assembly emits a second signal when the fuel level in the fuel tank is below a second threshold, the first threshold is greater than the second threshold, and the fuel level sensor assembly emits a third signal when the fuel level in the fuel tank is below a third threshold, the third threshold corresponding to a fuel level of the fuel tank that is greater than the first and second thresholds.

In one or more embodiments, the emergency control module includes a first control unit and a first switch assembly, the first control unit configured to open the first switch assembly after receiving a signal transmitted by the first oil level sensor assembly, to cause the first motor to control to shut off the first shut-off valve, thereby opening the first shut-off valve to shut off the emergency drain.

In one or more embodiments, the fuel measurement management module includes a second control unit and a second switch assembly, the second control unit being configured to open the second switch assembly to cause the second motor to control the shut-off valve to shut off after receiving the signal from the fuel level sensor assembly, and to open the second switch assembly to cause the first motor and the second motor to control the first shut-off valve and the second shut-off valve to simultaneously shut off the first shut-off valve and the second shut-off valve, respectively, after receiving the signal from the second fuel level sensor assembly.

In one or more embodiments, the fuel measurement management module includes a second control unit and a second switch assembly, the second control unit configured to turn on the second switch assembly to cause the second motor to be energized to control the shut-off of the second shut-off valve upon receiving a signal from the fuel level sensor assembly, turn on the second switch assembly to cause the second motor to control the second shut-off valve to effect shut-off upon receiving a signal from the second fuel level sensor assembly, and further configured to exchange data to the emergency control module to drive the first motor to effect shut-off of the first shut-off valve via the emergency control module while receiving a signal from the second fuel level sensor assembly.

In one or more embodiments, in a first mode of the system, after a failure of the fuel metering management system, the independent emergency drain control system independently senses the fuel level in the fuel tank via a first fuel level sensor assembly and instructs the first cut-off assembly to open to cut off emergency drain via the emergency control module when the fuel level is below the first threshold.

In one or more embodiments, in a second mode of the system, after the independent emergency drain control system fails, the fuel measurement management system senses the amount of fuel in the fuel tank via the fuel sensor assembly and instructs the second shut-off assembly to open to shut off the drain via the fuel measurement management module when the amount of fuel in the fuel tank is below the third threshold;

when the second cutting-off assembly cannot accept the instruction of the fuel measurement management module, the second fuel level sensor assembly senses the fuel level in the fuel tank, when the fuel level is lower than a second threshold value, the second cutting-off assembly is instructed by the fuel measurement management module to realize cutting-off, and the fuel measurement management module also realizes simultaneous cutting-off of the first cutting-off assembly.

In one or more embodiments, in a third mode of the system, after failure of the second fuel level sensor assembly, the system detects the amount of fuel in the tank by the fuel level sensor assembly and instructs the second shut-off assembly to shut off the emergency drain by the fuel measurement management module when the amount of fuel in the tank is below the third threshold;

the system measures the fuel level in the fuel tank via the first fuel level sensor assembly when the second shut-off assembly fails to receive the command from the fuel measurement management module, and commands the first shut-off assembly to shut off the emergency drain via the emergency control module when the first threshold is exceeded.

In one or more embodiments, in a fourth mode of the system, after failure of the fuel level sensor assembly, the system senses the fuel level in the tank via the first fuel level sensor assembly and instructs the first cut-off assembly to cut off the emergency drain via the emergency control module when the fuel level is below the first threshold,

when the first cutting assembly cannot receive the transmission instruction of the emergency control module, the system senses the oil level in the oil tank through the second oil level sensor assembly, and when the oil level is lower than the second threshold value, the first cutting assembly is instructed to cut off through the fuel measurement management module, and the second cutting assembly is also cut off through the fuel measurement management module.

In one or more embodiments, in a fifth mode of the system, after failure of both the fuel level sensor assembly and the first fuel level sensor assembly, the system senses the fuel level in the fuel tank via the second fuel level sensor assembly and instructs the first shut-off assembly to shut-off when the fuel level is below the second threshold, and also enables simultaneous shut-off of the second shut-off assembly via the fuel measurement management module.

In one or more embodiments, in a sixth mode of the system, after failure of both the second and first fuel level sensor assemblies, the system senses the fuel level in the fuel tank via the fuel level sensor assembly and instructs the second shut-off assembly to shut off the emergency drain via the fuel measurement management module when the fuel level is below the third threshold.

In one or more embodiments, in a seventh mode of the system, when the second fuel level sensor assembly, the first fuel level sensor assembly, and the fuel level sensor assembly are all normal, the system senses the fuel level in the fuel tank via the fuel level sensor assembly and instructs the second shut-off assembly to open to shut off the fuel drain via the fuel measurement management module when the fuel level sensor assembly is below the third threshold;

the system senses the fuel level in the fuel tank independently through the first fuel level sensor assembly when the second shut-off assembly fails to receive the command of the fuel measurement management module, and commands the first shut-off assembly to open through the emergency control module when the second shut-off assembly is below the first threshold.

In one or more embodiments, the emergency oil drain integrated control system further includes a pre-self-test processing unit, where a self-test program is built in the pre-self-test processing unit, and the program is used for detecting the oil amount in the oil tank before oil drain.

In one or more embodiments, in a first self-test procedure of the pre-self-test processing unit, the system senses the fuel level in the fuel tank via the first fuel level sensor assembly and controls the first cut-off assembly to be in a locked-off state via an emergency control module when the fuel level is below a fourth threshold.

In one or more embodiments, in a second self-test procedure of the pre-self-test processing unit, the system senses the fuel level in the fuel tank via the second fuel level sensor assembly and controls the first cut-off assembly to be in a locked cut-off state via the fuel measurement management module when the fuel level is below a fourth threshold.

In one or more embodiments, the fuel measurement management module is further configured to control the opening of the first cutting assembly after receiving the signal transmitted by the fuel sensor assembly, and in a third self-checking procedure of the pre-self-checking processing unit, the system senses the fuel in the fuel tank through the fuel sensor assembly, and controls the first cutting assembly to be in a locking cutting state through the fuel measurement management module when the fuel corresponding to the fourth threshold is lower than the fuel.

In one or more embodiments, in a fourth self-test procedure of the pre-self-test processing unit, the system senses the fuel level in the fuel tank via the second fuel level sensor assembly and, when it is below a fourth threshold, via data exchange between the fuel measurement management module and the emergency control module, thereby controlling the first cut-off assembly to be in a locked cut-off state by means of the emergency control module.

In one or more embodiments, in a fifth self-test procedure of the pre-self-test processing unit, the system senses the amount of fuel in the fuel tank through the fuel sensor assembly and, when the amount of fuel corresponding to the fourth threshold is lower than the fourth threshold, through data exchange between the fuel measurement management module and the emergency control module, thereby controlling the first cut-off assembly to be in a locked cut-off state by means of the emergency control module.

In one or more embodiments, the system is capable of controlling the severing of a plurality of emergency bleed passages on each of the aircraft fuel tanks.

According to the emergency oil discharge comprehensive control system, the two independent fuel oil measurement management systems and the independent emergency oil discharge control system are arranged, so that a double-chain control structure is formed, oil level measurement data and/or oil quantity measurement data in the fuel oil measurement management system are not required to be relied on, the oil level in the oil tank is independently measured by virtue of the independent first oil level sensor assembly, the safety problem caused by a single-chain control mode caused by the fact that a main flow machine type relies on the fuel oil measurement management system is solved, the first cutting assembly and the second cutting assembly independently operate, the cutting valve is independently controlled by the independent motor, the minimum amount of emergency oil discharge is monitored by double redundancy, and the emergency oil discharge control with high integrity and high reliability under the condition that the fuel oil measurement system fails is realized, so that common mode failure is avoided.

Drawings

The above and other features, properties and advantages of the present invention will become more apparent from the following description in conjunction with the accompanying drawings and embodiments, in which:

FIG. 1 is a schematic diagram of one embodiment of control logic of an emergency oil drain integrated control system.

FIG. 2 is a schematic diagram of another embodiment of control logic of the emergency oil drain integrated control system.

FIG. 3 is a schematic diagram of the piping architecture of the emergency oil drain integrated control system.

FIG. 4 is a simplified diagram of one embodiment of an emergency drain integrated control system.

FIG. 5 is a flow chart of an emergency oil drain integrated control method.

FIG. 6 is a flow chart of a self-test procedure for the emergency oil drain integrated control system.

Sign mark description

15. Oil supply pipeline

16. Emergency oil drain port

17. Emergency oil discharging pipeline

100. Fuel measurement management system

102. Second oil level sensor assembly

103. Oil mass sensor assembly

105. Second control unit

111. Remote data concentrator

112. Aircraft avionics network

113. Cockpit display screen

114. Cab roof control board

160. Fuel measurement management module

200. Independent emergency oil drain control system

201. First oil level sensor assembly

205. First control unit

260. Emergency control module

310. First switch assembly

320. Second switch assembly

400. Second cutting assembly

402. Second motor

450. Second cut-off valve

500. First cutting assembly

501. First motor

550. First cut-off valve

Detailed Description

The present invention will be further described with reference to specific embodiments and drawings, in which more details are set forth in the following description in order to provide a thorough understanding of the present invention, but it will be apparent that the present invention can be embodied in many other forms than described herein, and that those skilled in the art may make similar generalizations and deductions depending on the actual application without departing from the spirit of the present invention, and therefore should not be construed to limit the scope of the present invention in terms of the content of this specific embodiment. It is noted that these and other figures are merely examples, which are not drawn to scale and should not be construed as limiting the scope of the invention as it is actually claimed.

The design requirements of the current civil aircraft emergency oil drain system mainly come from two aspects: climbing gradient requirements and maximum landing weight requirements.

According to the climb gradient requirement, the aircraft must meet the climb gradient requirements of regulatory requirements 25.119 and 25.121 (d) at maximum takeoff weight minus 15 minutes engine fuel consumption weight, per airworthiness regulatory requirement CCAR 25.1001. Otherwise, an emergency oil drain system must be set up and oil drain completed within 15 minutes. The total flight time at this point was 30 minutes, including 15 minutes of oil drain time and 15 minutes of typical return to ground fly time, reducing the aircraft weight below that which would meet the climb gradient requirements of 25.119 and 25.121 (d).

According to the maximum landing weight requirement, even if the aircraft can meet the climbing gradient requirements of 25.119 and 25.121 (d), if the requirements of the maximum landing weight cannot be met, such as the limitation of wheel speed, brake energy, running to brake distance and the like which do not exceed the qualification approval cannot be guaranteed, the aircraft is required to have an emergency oil drain function, and the oil drain time is not required to be limited within 15 minutes.

The drain time for a typical aircraft is 60 minutes. At present, in main stream engine type emergency oil discharging system architectures of B787, A330, A350 double-engine wide body aircrafts and the like, an airfoil oil supply pump and a central airfoil override pump are generally used for emergency oil discharging, isolation between the oil supply system and the oil supply system is realized by adopting a cut-off valve, and part of oil supply pipelines are shared as emergency oil discharging pipelines. In addition, if some types have requirements on oil discharge rate or oil discharge time, and the capability of a simple wing oil supply pump or a central wing override pump is insufficient, a special emergency oil discharge pump is additionally added to perform emergency oil discharge, such as a B777 double-engine wide-body aircraft.

There are two types of oil drain control methods of the current mainstream machine type.

One is to use a manual/automatic suspension air emergency oil drain control system, such as B777, B787, a330, a350 double-hulled wide-body aircraft. When the method is used for emergency oil discharge, firstly, the emergency oil discharge quantity is selected, the default is the fuel quantity corresponding to the maximum landing weight, then the emergency oil discharge is started, and when the residual fuel quantity reaches the target oil quantity, the emergency oil discharge is automatically stopped; if the automatic cut-off is not triggered normally, the emergency oil drain function can be manually stopped.

Another approach is directed to models that are specifically configured with an emergency oil drain pump for emergency oil drain, such as B777 double-hulled wide aircraft. In order to ensure safe, i.e. excessive, oil drain, a low oil level signal is generated when a certain predetermined safe minimum oil level is reached, the inlet of the emergency oil drain pump is exposed to the fuel oil level, and the emergency oil drain function is stopped.

The above methods have disadvantages. In order to prevent excessive oil discharge, a manual oil discharge cut-off function is arranged, but the function is completely dependent on the processing level and the capability of a flight unit, the unit is required to pay attention to and handle in real time during emergency oil discharge, however, when emergency oil discharge is generally required to be started, an abnormal emergency situation occurs to an airplane, at this time, the energy of the flight unit is very precious, and potential safety hazards are easily brought to human factors such as unit omission.

To prevent excessive oil drain, the emergency oil drain system adds a dedicated emergency oil drain pump configuration, but this additional addition of emergency oil drain pumps and their installation, power control, and other accessory devices adds up to at least about 15kg, and is therefore not a mainstream model design direction. The installation of the emergency oil discharge pump must be at a certain height, the difficulty of the arrangement of the aircraft is increased, and the aircraft is contradicted with the design standard that the oil storage capacity of the outer wing is required to be ensured to be large enough and the safety fuel quantity of the residual quantity after emergency oil discharge can be met when the aircraft is designed, so that the design matching difficulty of the aircraft is increased, and the possibility that the emergency oil discharge cannot be carried out due to single failure exists, for example, the emergency oil discharge pump of a single wing fails, and the emergency oil discharge of the wing can not be executed.

In order to solve the above-mentioned shortcomings, the present disclosure provides an emergency oil drain integrated control system, which realizes the integrated control of emergency oil drain by means of two relatively independent control links and can cope with various emergency failure conditions, thereby improving the safety and comprehensiveness of control.

As shown in conjunction with fig. 1 and 2, the integrated emergency drain control system includes a fuel measurement management system 100, a stand-alone emergency drain control system 200, a first shut-off assembly 500, and a second shut-off assembly 400.

The first shut-off assembly 500 comprises a first motor 501 and a first shut-off valve 550, the first shut-off valve 550 being adapted to shut off the emergency drain on the emergency drain line 17. Specifically, as shown in fig. 2, the emergency oil drain port 16 is used for draining oil on the emergency oil drain line 17, and the first cut-off valve 550 is used for cutting off the emergency oil drain line, so as to prevent the fuel in the oil supply line 15 from continuously draining oil from the emergency oil drain port 16. The first shut-off valve 550 is independently operated by the first motor 501.

The second shut-off assembly 400 includes a second motor 402 and a second shut-off valve 450, the second shut-off valve 450 also serving to shut off the emergency drain and being independently actuated by the second motor 402.

That is, the first and second shut-off modules 500 and 400 operate independently of each other to form a double backup shut-off valve group, solving the common mode failure and single point failure problems of the main stream model single motor driven single valve or double motor driven single valve, and guaranteeing the safety of control.

The gate valve can be selected as the cut-off valve, the moving direction of the gate plate is vertical to the fluid direction, and the full opening and the full closing of the cut-off valve are realized through motor driving. The structure of ball valve, sleeve valve, butterfly valve, etc. can be selected to realize the cutting off of oil path in the flow channel.

Those skilled in the art will appreciate that valve bodies capable of achieving a shut-off function are applicable to the present disclosure.

In one embodiment, the first and second severing assemblies 500, 400 each employ a fail safe design. Under the design of failure of the valve, the valve is automatically cut off when the power is off, so that the oil drain way is kept in a cut-off state when the valve body fails.

Preferably, the valve bodies are provided with a switch state signal feedback function, so that the states can be timely fed back to the independent emergency oil drain control system 200 and the fuel measurement management system 100.

The independent emergency drain control system 200 includes a first oil level sensor assembly 201 and an emergency control module 260, the emergency control module 260 being configured to effect the opening of the first shut-off assembly 500 upon receipt of a signal from the first oil level sensor assembly 201 to effect the shut-off of the emergency drain.

The fuel measurement management system 100 includes a fuel measurement management module 160, a second fuel level sensor assembly 102, and a fuel sensor assembly 103, the fuel measurement management module 160 being configured to control the opening of the second shut-off assembly 400 upon receipt of a signal transmitted by the fuel sensor assembly 103, and to simultaneously control the opening of the first shut-off assembly 500 and the second shut-off assembly 400 upon receipt of a signal transmitted by the second fuel level sensor assembly 102 to effect the shut-off of the emergency drain.

The fuel sensor assembly 103 obtains fuel data by measuring characteristics such as density, volume, mass, etc., and the fuel level sensor obtains fuel level data by measuring the level of the fuel in the fuel tank.

In one embodiment, to further improve the independence of the independent emergency drain control system 200 from the fuel measurement management system 100, the first and second oil level sensor assemblies 201, 102 are used to detect that the physical characteristics of the oil levels are different; the physical characteristics of the first and second severing assemblies 500, 400 for effecting severing are different. That is, the first and second oil level sensor assemblies 201 and 102, the first and second cut-off assemblies 500 and 400 are all designed using a non-similar redundancy principle.

The concept of non-similarity redundancy (non-similar redundancy) is described on page 383 of the chinese aviation encyclopedia published by the aviation industry press in 2000, and refers to a component or system that uses components that have similar or related functional characteristics and different physical characteristics, including parameters such as physical structure and physical principles. Therefore, the physical characteristics of the first oil level sensor assembly 201 and the second oil level sensor assembly 102 for detecting the oil level are set to be different, that is, a design principle of dissimilarity redundancy is adopted, for example, the two oil level sensor assemblies for measuring the oil level adopt different design architectures, different physical parameters, different measurement standards and other different principles, so that the probability of common-mode faults can be reduced, and the reliability of hardware can be improved. The mechanical principles of the first and second severing assemblies 500, 400 for effecting severing are also designed using dissimilar redundancy principles to effect independence from one another.

For example, in one embodiment, the first oil level sensor assembly 201 is configured to measure an oil level via a first physical parameter and the second oil level sensor assembly 102 is configured to measure an oil level via a second physical parameter, the first physical parameter being different from the second physical parameter for measuring the oil level; or a different measured physical junction of the second oil level sensor assembly 102 and the first oil level sensor assembly 201 using the same physical parameter. The independent emergency drain control system 200 is therefore no longer dependent on the oil level data obtained by the fuel measurement management system 100.

For example, one of the liquid level sensors adopts a capacitive oil level sensor, and the capacitance formed by filling liquid medium between the positive probe and the negative probe is linearly changed along with the liquid level, so that the change of the capacitance, namely the change of the liquid level, is converted into a standard electric signal for output, and liquid level data is obtained through the change of the capacitance; the other adopts a floating ball type sensor, and the liquid level position is changed into an electric signal by utilizing the buoyancy of the liquid to the magnetic floating ball and the magnetic attraction of the dry reed of the floating ball liquid level meter, so that the acquisition of liquid level data is realized.

The second oil level sensor assembly 102 and the first oil level sensor assembly 201 include, but are not limited to, oil level sensors that selectively employ the two principles described above, and other types of oil level sensors, such as magnetically levitated oil level sensors, magnetically telescopic oil level sensors, and the like, may be employed in the present disclosure, but should be ensured to take different physical characteristics to achieve independence from each other.

By adopting the second oil level sensor assembly 102 and the first oil level sensor assembly 201 of different types, the identification accuracy of the oil level is ensured, and when one of the oil level sensor assemblies fails, the other oil level sensor can still collect the oil level data as a standby, so that a completely independent double-chain control system is further realized, common-mode faults caused by a single-chain logic model are avoided, and safe and reliable control of the emergency oil discharging system is realized.

In one embodiment, the first oil level sensor assembly 201 signals a first signal when the oil level in the tank is below a first threshold, and the second oil level sensor assembly 102 signals a second signal when the oil level in the tank is below a second threshold, the first threshold being greater than or equal to the second threshold.

The fuel sensor assembly 103 sends out a third signal when the fuel level in the fuel tank is lower than a third threshold, and the fuel level in the fuel tank corresponding to the third threshold is greater than or equal to the first threshold and the second threshold.

For example, when the amount of fuel in the fuel tank is Akg, the fuel sensor assembly 103 senses and signals first; when the amount of fuel in the fuel tank further drops to Bkg, the first fuel level sensor assembly 201 can sense the corresponding liquid level and send out a signal; as the amount of fuel in the tank continues to drop further to Ckg, the second level sensor assembly 102 is able to sense the corresponding level and signal, wherein A is greater than or equal to B is greater than or equal to C.

When a=b=c, multiple detection of the oil amount can be achieved by setting the priority trigger sequence of the sensors.

With continued reference to fig. 1 and 2, in one embodiment, the emergency control module 260 includes a first control unit 205 and a first switch assembly 310, the first control unit 205 being configured to activate the first switch assembly 310 upon receiving a signal transmitted by the first oil level sensor assembly 201 to cause the first motor 501 to control the shut-off of the first shut-off valve 550 to shut off the emergency drain.

For example, the first switch assembly 310 may select an electrical circuit including a relay. The input amount to the first switch assembly 310 is controlled by the first control unit 205, and the output form of the first switch assembly 310 is adjusted to enable the contacts to be normally closed, so that the power supply to the first motor 501 is realized, and the opening of the first cut-off valve 550 is further promoted to cut off the oil path. As another example, the first motor 501 may also be powered off to effect the shut-off of the first shut-off valve 550.

In one embodiment, the fuel measurement management module 160 includes a second control unit 105 and a second switch assembly 320, the second control unit 105 configured to: opening the second switch assembly 320 after receiving the signal transmitted from the oil sensor assembly 103 to cause the second motor 402 to control the second shut-off valve 450 to be shut off; the second switch assembly 320 is turned on after receiving the signal transmitted from the second oil level sensor assembly 102 to cause the first motor 501 and the second motor 402 to simultaneously shut off the first shut-off valve 550 and the second shut-off valve 450.

In another embodiment, the fuel measurement management module 160 includes a second control unit 105 and a second switch assembly 320, the second control unit 105 being configured to turn on the second switch assembly 320 to energize the second motor 402 to control the shut-off of the second shut-off valve 450 upon receiving a signal from the fuel level sensor assembly 103, to turn on the second switch assembly 320 to control the first motor 501 to shut-off the second shut-off valve 450 upon receiving a signal from the second fuel level sensor assembly 102, and to exchange data to the emergency control module 260 to shut-off the first shut-off valve 550 via the emergency control module 260 while receiving a signal from the second fuel level sensor assembly 102.

That is, the fuel measurement management module 160 accepts two signals from the second fuel level sensor assembly 102 and the fuel level sensor assembly 103, but the processing paths for the two signals are different.

Detailed description of the inventionas will be understood in connection with fig. 1 and 2, the solid line represents the processing path affected by the second oil level sensor assembly 102, the broken line represents the processing path affected by the oil level sensor assembly 103, and the dash-dot line represents the processing path affected by the first oil level sensor assembly 201.

After the second oil level sensor assembly 102 transmits a signal to the second control unit 105, the second switch assembly 320 can be controlled by the second control unit 105 to directly open the first cutting assembly 500 and the second cutting assembly 400 as shown in fig. 1, or the second control unit 105 receives the signal and transmits the signal to the emergency control module 260 through the aircraft avionics network 112 as shown in fig. 2, so that the emergency control module 260 controls the first cutting assembly 500, and the fuel measurement management module 160 controls the second cutting assembly 400 to simultaneously control the first cutting assembly 500 and the second cutting assembly 400.

In the example shown in fig. 1, the second switching assembly 320 may optionally include a relay having multiple contacts to accomplish this. The relay may be selected from relays such as electromagnetic relays, electronic relays, inductive relays, etc., or any control module capable of implementing a control switching function. By adjusting the time, frequency, etc. of the input amount such as voltage, current, etc. to the second switching assembly 320, the output form of the second switching assembly 320 is adjusted, and by providing a plurality of contacts, switching of a plurality of circuits is achieved, thereby achieving simultaneous control of the first motor 501 and the second motor 402 shown in fig. 1.

Preferably, the first and second switching elements 310 and 320 employ a non-similar redundancy principle to ensure independence of opening the first and second switching elements 500 and 400 to avoid common mode failure.

In general, the amount of oil in the oil tank decreases in sequence as the oil level sensor assembly 103, the first oil level sensor assembly 201, and the second oil level sensor assembly 102 issue signals. That is, for the amount of oil in the same tank, the amount of oil measured by the oil sensor assembly 103, the first oil level sensor assembly 201, and the second oil level sensor assembly 102 decreases in order.

Thus, when the second level sensor assembly 102 activates a signal, it is generally indicated that the tank oil level is at a lower level, with a greater risk, and therefore as a final line of defense, after the second level sensor assembly 102 signals a low oil level, the second shut-off valve 450 and the first shut-off valve 550 will be simultaneously controlled to be in a shut-off state, by operating both valve operations to ensure that the drain is stopped.

With continued reference to FIG. 3, the system is capable of controlling the cutoff of a plurality of emergency bleed passages on each of the aircraft fuel tanks. As shown in fig. 3, the left and right sides represent the oil tanks of the left and right wings of the aircraft, and two independent emergency oil drain control systems 200 are respectively connected with the oil tanks of the left and right wings of the aircraft, so as to realize the control of each emergency oil drain channel.

The fuel level sensor assembly 103 and the second fuel level sensor assembly 102, which are located within the fuel tank, each communicate data to a remote data concentrator 111, which remote data concentrator 111 is configured to collect and relay each data.

After the first oil level sensor assembly 201 independently measures the oil level, a first signal is transmitted to the first control unit 205 if it is lower than a first threshold value; the second oil level sensor assembly 102 sends out a second signal and transmits to the second control unit 105 when the oil level in the oil tank is below a second threshold value; the oil quantity sensor assembly 103 sends out a third signal when the oil quantity in the oil tank is lower than a third threshold value and transmits the third signal to the second control unit 105, so that double-link transmission of data in the oil tank is realized.

Furthermore, the second control unit 105 and the first control unit 205 are also connected to the aircraft avionics network 112, the aircraft avionics network 112 being used to effect a communication exchange of the individual component network data with one another. The cockpit display 113 is used to present various data to the driver. The driver also operates the emergency drain through a push button switch on the cockpit top control plate 114.

It is easy to understand that the emergency oil drain integrated control system is suitable for each emergency oil drain channel on an aircraft, can realize the integral control of the corresponding emergency oil drain architecture, and can realize safe, reliable and effective emergency oil drain of each oil drain channel under the condition that a fuel oil measuring system breaks down.

The system is further described below in connection with various embodiments.

In a first mode of the system, after a failure of the fuel metering management system 100, the independent emergency drain control system 200 senses the in-tank level independently through the first level sensor assembly 201 and instructs the first cut-off assembly 500 to open to cut off emergency drain through the emergency control module 260 when the first threshold is exceeded.

That is, when the independent emergency drain control system 200 is normal and both the second oil level sensor assembly 102 and the oil amount sensor assembly 103 of the fuel measurement management system 100 are malfunctioning, the oil level in the tank is sensed only by the first oil level sensor assembly 201. When the first oil level sensor assembly 201 senses the oil level value, a signal is sent to the first control unit 205, and the first control unit 205 receives the signal and then controls the first cut-off assembly 500 to be opened, so that further oil discharge is prevented through cutting off of the first cut-off valve 550.

In a second mode of the system, after the independent emergency drain control system 200 fails, the fuel measurement management system 100 senses the amount of fuel in the fuel tank via the fuel sensor assembly 103 and instructs the second shut-off assembly 400 to open to shut off the drain via the fuel measurement management module 160 when the amount of fuel in the fuel tank falls below a third threshold; when the second cutting assembly 400 cannot accept the instruction of the fuel measurement management module 160, the second fuel level sensor assembly 102 senses the fuel level in the fuel tank, and when the fuel level is lower than a second threshold value, the second cutting assembly 400 is instructed by the fuel measurement management module 160 to cut off the fuel path, and the fuel measurement management module 160 controls the first cutting assembly 500 to cut off simultaneously.

That is, when the independent emergency drain control system 200 fails and each link of the fuel measurement management system 100 is normal, both the second fuel level sensor assembly 102 and the fuel level sensor assembly 103 are normal. Since the oil sensor assembly 103 senses the oil in the oil tank, the oil sensor assembly 103 transmits a signal to the second control unit 105, and the second control unit 105 controls the second shut-off assembly 400 to be opened after sensing the oil signal, so that the second shut-off valve 450 is in a closed state, and oil drain is prevented.

After successful closing of the second shut-off valve 450, the tank stops draining and the second oil level sensor assembly 201 is not triggered.

If the second shut-off assembly 400 fails to receive the command from the fuel measurement management module 160 due to a failure or line fault of the second motor 402, the blocking of the second shut-off valve 450 cannot be achieved. If the second motor 402 fails, the second oil level sensor assembly 102 senses a low oil level in the oil tank and transmits a signal to the second control unit 105, and the second control unit 105 controls the opening of the first cut-off assembly 500 to put only the first cut-off valve 550 in a closed state, preventing the oil from being discharged.

If the blocking of the second shutoff valve 450 cannot be achieved due to other reasons such as line failure, for example, the second shutoff assembly 400 cannot receive the instruction from the fuel measurement management module 160, the fuel measurement management module 160 can directly instruct the second control module 400 to achieve the shutoff, and the fuel measurement management module 160 can also achieve the simultaneous shutoff of the first shutoff assembly 500, and the implementation manner may be through the example shown in fig. 1 or through the example shown in fig. 2, which is not repeated here.

In a third mode of the system, after the second fuel level sensor assembly 102 fails, the system detects the amount of fuel in the tank via the fuel level sensor assembly 103 and instructs the second shut-off assembly 400 to shut off the emergency fuel drain path via the fuel measurement management module 160 when the amount of fuel in the tank falls below a third threshold; the system measures the in-tank level of fuel by the first level sensor assembly 201 when the second shut-off assembly 400 is not receptive to the fuel measurement management module 160 command and instructs the first shut-off assembly 500 to shut off the emergency drain by the emergency control module 260 when it is below a first threshold.

That is, the second fuel level sensor assembly 102 in the fuel measurement management system 100 fails, while the fuel level sensor assembly 103 is normal. The oil sensor assembly 103 now signals the first oil level sensor assembly 201. When the oil quantity sensor assembly 103 senses the oil quantity value, a signal is sent to the second control unit 105, the second control unit 105 receives the signal and then controls the second cut-off assembly 400 to be opened, and further oil discharge is prevented through cutting of the second cut-off valve 450.

After successful closing of the second shut-off valve 450, the tank stops draining and the first oil level sensor assembly 201 is not triggered.

However, when the second motor 402 of the second shut-off assembly 400 fails or the transmission line fails, and the second shut-off assembly 400 cannot receive the command of the fuel measurement management module 160, the second shut-off valve 450 cannot be blocked, and the first control unit 205 continues to sense the low fuel level in the fuel tank through the first fuel level sensor assembly 201 and transmit a signal to the first control unit 205, and the first control unit 205 controls the first shut-off assembly 500 to be opened, so that the first shut-off valve 550 is in a closed state, and the fuel drain is prevented.

In a fourth mode of the system, after the fuel sensor assembly 103 fails, the system detects the fuel level in the fuel tank by the first fuel level sensor assembly 201 and instructs the first cut-off assembly 500 to cut off the emergency fuel drain passage by the emergency control module 260 when the first cut-off assembly 500 fails to receive the transmission instruction of the emergency control module 260, senses the fuel level in the fuel tank by the second fuel level sensor assembly 102 and instructs the second cut-off assembly 400 to cut off the fuel line by the fuel measurement management module 160 when the first cut-off assembly 500 is below the second threshold, and controls to achieve simultaneous cut-off of the first cut-off assembly 500 by the fuel measurement management module 160.

That is, the fuel amount sensor assembly 103 in the fuel measurement management system 100 fails, while the second fuel level sensor assembly 102 is normal. At this time the oil level is sensed by the first oil level sensor assembly 201 prior to the second oil level sensor assembly 102. When the first oil level sensor assembly 201 senses the oil level value, a signal is sent to the first control unit 205, and the first control unit 205 receives the signal and then controls the first cut-off assembly 500 to be opened, so that further oil discharge is prevented through cutting off of the first cut-off valve 550.

After successful closing of the first shut-off valve 550, the tank stops draining and the second oil level sensor assembly 102 is not triggered.

However, if other faults, such as a line break, occur, the first shut-off assembly 500 cannot receive the command of the emergency control module 260, and the blocking of the first shut-off valve 550 cannot be achieved. The system continues to sense a low level of oil in the tank through the second oil level sensor assembly 102 and communicates a signal to the second control unit 105. The oil measurement management module 160 simultaneously implements the simultaneous cut-off of the first cut-off valve 550 and the second cut-off valve 400 through the example shown in fig. 1 or 2, and the prevention of the oil drain will not be repeated here.

In a fifth mode of the system, after failure of both the fuel level sensor assembly 103 and the first fuel level sensor assembly 201, the system senses the fuel level in the fuel tank via the second fuel level sensor assembly 102 and instructs the second shut-off assembly 400 to shut off the fuel line when the fuel level is below a second threshold via the fuel measurement management module 160 and enables simultaneous shut-off of the first shut-off assembly 500 via the fuel measurement management module 160.

That is, when the independent emergency drain control system 200 fails, the fuel quantity sensor assembly 103 of the fuel measurement management system 100 fails, but the second fuel level sensor assembly 102 is normal, the fuel quantity in the fuel tank is sensed only by the second fuel level sensor assembly 102.

When the second oil level sensor assembly 102 senses the oil amount value, a signal is sent to the second control unit 105, and the second cut-off assembly 400 and the first cut-off assembly 500 are cut off simultaneously, so that further oil drain is prevented.

In a sixth mode of the system, after failure of both the second and first oil level sensor assemblies 102, 201, the system senses the oil level in the tank via the oil level sensor assembly 103 and instructs the second shut-off assembly 400 to shut off the emergency drain path via the fuel measurement management module 160 when the third threshold is exceeded.

That is, when the independent emergency drain control system 200 fails, the second fuel level sensor assembly 102 of the fuel measurement management system 100 fails, but the fuel level sensor assembly 103 is normal, the fuel level in the fuel tank is sensed only by the fuel level sensor assembly 103.

When the oil quantity sensor assembly 103 senses that the oil quantity value is lower than the third threshold value, a signal is sent to the second control unit 105, and the second control unit 105 receives the signal and then controls the second cut-off assembly 400 to be opened, and the cut-off of the second cut-off valve 450 is performed to prevent further oil drainage.

In a seventh mode of the system, when the second oil level sensor assembly 102, the first oil level sensor assembly 201 and the oil level sensor assembly 103 are all normal, the system senses the oil level in the oil tank through the oil level sensor assembly 103 and instructs the second shut-off assembly 400 to shut off the emergency oil drain passage through the fuel measurement management module 160 when the oil level is below a third threshold; when the second shut-off assembly 400 fails to receive the instructions of the fuel metering management module 160, the system senses the fuel level in the fuel tank independently via the first fuel level sensor assembly 201 and instructs the first shut-off assembly 500 to shut off the emergency fuel drain passage via the emergency control module 260 when the fuel level is below a first threshold.

That is, when the fuel measurement management system 100 and the independent emergency drain control system 200 are both normal, the first oil level sensor assembly 201, the second oil level sensor assembly 102, and the oil amount sensor assembly 103 are all normal at this time. Since the oil sensor assembly 103 senses the oil in the oil tank, the oil sensor assembly 103 transmits a signal to the second control unit 105, and the second control unit 105 controls the second shut-off assembly 400 to be opened after sensing the oil signal, so that the second shut-off valve 450 is in a shut-off state, and oil drain is prevented.

After successful closing of the second shut-off valve 450, the tank stops draining, and the first and second oil level sensor assemblies 101, 202 are not triggered.

However, if the blocking of the second cut-off valve 450 cannot be achieved due to a failure, the first oil level sensor assembly 201 senses the oil level in the oil tank and transmits a signal to the first control unit 205 when the oil level is lower than the first threshold, and the first control unit 205 controls the opening of the first cut-off assembly 500 to put the first cut-off valve 550 in a cut-off state, preventing the oil from being discharged.

In one embodiment, the emergency oil drain integrated control system further comprises a front self-checking processing unit, wherein a self-checking program is built in the front self-checking processing unit and is used for detecting the oil quantity in the oil tank before oil drain. When the oil quantity is detected to be enough in the preposed self-checking program and the oil can be discharged, the emergency oil discharge comprehensive control system is normally used; however, when the oil amount is detected to be insufficient for normal oil drain in the pre-self-checking procedure, the first cutting assembly 500 needs to be set to be in a locked cutting state, so that the oil drain channel is always cut off, and oil drain is avoided.

The following list five self-checking procedures, any one of which can be used in actual operation to realize the pre-self-checking process. The selection of the five self-test programs can be preset in the processing unit by the crew.

In one embodiment, as shown in connection with fig. 1 and 5, in a first self-test procedure, the system senses the level of fuel in the tank via the first fuel level sensor assembly 201 and controls the first disconnect assembly 500 to be in a locked-off state via the emergency control module 260 when the level of fuel in the tank is below a fourth threshold.

And the fourth threshold value is more than or equal to the oil level of the oil tank corresponding to the third threshold value.

In one embodiment, continuing to refer to fig. 1 and 5, in a second self-test procedure, the system senses the fuel level in the tank via the second fuel level sensor assembly 102 and controls the first shutoff assembly 500 to be in the locked-off state via the fuel measurement management module 160 when the fuel level is below a fourth threshold.

In one embodiment, the fuel measurement management module 160 is further configured to control the opening of the first shut-off assembly 500 after receiving the signal transmitted by the fuel sensor assembly 103, and in a third self-test procedure, the system senses the fuel in the fuel tank via the fuel sensor assembly 103 and controls the first shut-off assembly 500 to be in a lockout shut-off state via the fuel measurement management module 160 when the fuel level corresponding to the fourth threshold is lower.

In this third self-test procedure, after the fuel sensor assembly 103 transmits a signal to the fuel measurement management module 160, the fuel measurement management module 160 can simultaneously control the first and second shut-off assemblies 500 and 400. But this logical order is only applied in the third self-test procedure.

In one embodiment, as shown in connection with fig. 2 and 5, in a fourth self-test procedure, the system senses the fuel level in the tank via the second fuel level sensor assembly 102 and, when it is below a fourth threshold, via data exchange between the fuel measurement management module 160 and the emergency control module 260, controls the first cut-off assembly 500 to be in a locked-off state via the emergency control module 260.

In one embodiment, continuing to refer to fig. 2 and 5, in a fifth self-test procedure, the system senses the fuel level in the fuel tank via the fuel level sensor assembly 103 and, when the fuel level is below a fourth threshold, via data exchange between the fuel measurement management module 160 and the emergency control module 260 to control the first disconnect package 500 to be in a lockout disconnect state via the emergency control module 260.

By introducing the embodiments, the emergency oil drain integrated control system can cope with various emergency situations, so that the oil drain structure is comprehensively controlled.

An embodiment of the aircraft emergency oil drain integrated control method is shown in fig. 5.

First, step S601 is performed to perform self-checking and pre-positioning on the first cutting assembly 500 and the second cutting assembly 400.

A specific self-test procedure is shown with reference to fig. 6. After the self-test is started in step 700, step 701 is performed to initialize and power up the aircraft.

Continuing with step 702, open and close self-tests are performed on the first severing assembly 500 to ensure functional integrity of the first severing assembly 500; proceeding to step 703, performing a functional judgment on the first cutting assembly 500 to check whether the opening and closing of the first cutting assembly is normal; after the first cutting assembly 500 is functioning properly, step 704 is performed to cut off the first cutting assembly 500, such that the oil drain channel is cut off by the first cutting assembly 500.

Continuing with step 705, performing an open and close self-test on the second severing assembly 400 to ensure the functional integrity of the second severing assembly 400; proceeding to step 706, performing a functional judgment on the second shut-off assembly 400 to check whether the opening and closing thereof are normal; after the second shut-off assembly 400 is functioning properly, step 707 is performed to shut off the second shut-off assembly 400, thereby placing the oil drain channel in a double shut-off state.

It will be appreciated that the order of detection of the second severing assembly 400 and the first severing assembly 500 may also be replaced.

Continuing with step 708, according to the description of the self-checking procedure, the first oil level sensor assembly 201, the second oil level sensor assembly 102, or the oil level sensor assembly 103 determines the oil level or the oil level of the oil tank, and step 709 is performed to determine whether the oil level or the oil level is lower than the bottom line oil level set by the emergency oil drain safety margin, where the bottom line oil level is the oil level corresponding to the fourth threshold.

Therefore, the oil quantity corresponding to the fourth threshold is larger than the third threshold, and the value of the bottom line oil quantity is an independent value set in the self-checking process, so that whether the oil quantity of the aircraft oil tank is lower than an emergency oil discharge safety margin value during take-off is detected.

If the fuel level in the aircraft fuel tank is lower than the emergency fuel drain safety margin value during take-off, which indicates that the fuel level in the aircraft fuel tank is too low, the aircraft fuel should be carefully drained, so step 710 is performed, in which the first cutting assembly 500 is set to be in a locked cutting state, that is, the first cutting assembly 500 is ensured to cut off the fuel drain channel all the time, so as to avoid further reducing the fuel level; further, in step 711, after the first cutting assembly 500 is in the locked-off state, the integrated control method for emergency oil drain described in the present disclosure will not be applicable to the first cutting assembly 500 any more, and the first cutting assembly 500 will not support emergency oil drain later.

If the oil quantity of the aircraft oil tank is larger than the emergency oil discharge safety margin value during take-off, the oil quantity in the aircraft oil tank is larger, and oil discharge is possible to be realized. Step 712 then proceeds to open the first cutting assembly 500, i.e., to maintain the first cutting assembly 500 clear of the oil drain passage. At this time, the second cutting assembly 400 is in the cut-off state based on step 707. That is, after step 712, the second severing assembly 400 is in the severed state and the first severing assembly 500 is in the unsevered state.

The process can simplify the subsequent oil discharging link, does not need to open the first cutting assembly 500 and the second cutting assembly 400 at the same time when the subsequent oil is discharged, and only needs to open the second cutting assembly 400, thereby simplifying the operation process and steps.

After completing steps 713 and 711, completing step 714 ends the self-test and emergency drain cut-off priming process, ending the self-test priming operation.

Returning to decision 703 and decision 706, if the first and second severing assemblies 500, 400 do not pass during the self-test, but the first and second severing assemblies 500, 400 are found to fail, step 722 is performed to report the on-board maintenance system (Onboard Maintenance System, OMS) and the crew alerting system (Crew Alerting System, CAS) to help the crew locate the failed component quickly; step 723 is then performed, wherein the first shut-off valve 550 and the second shut-off valve 450 are both in a fail-safe shut-off state, thereby implementing the fail-safe design of the valves; the personnel then proceed to step 724 to conduct troubleshooting or dispatch on demand (Master Minimum Equipment List, mmol) based on the master minimum equipment list approved by the civil aviation central office, and then proceed to step 725 to end the process.

Returning to FIG. 5, after the self-test and priming is performed, step 602 is performed to prepare for emergency oil drain priming.

When emergency oil discharge is needed, as in the existing emergency oil discharge control system, the driver operates the button switch on the cab top control board 114 to realize the pre-positioning operation of emergency oil discharge, for example, the target fuel quantity of the maximum landing weight can be automatically selected, and other target fuel quantities can be manually set. At this time, the fuel measurement management system 100 takes part in control, and confirms whether suppression is required or not according to various conditions such as the target fuel amount, for example, whether the aircraft is on the ground or not. Under the condition that the condition is met, emergency oil drain pre-positioning preparation is realized, and oil drain is prepared.

Continuing with step 603, an emergency drain is initiated. In accordance with the description of steps 712-714, the first cutting assembly 500 is in the open state, and the oil drain process can be implemented by only opening the second cutting assembly 400.

Continuing with step 604, after the oil drain process has been performed for a period of time, various emergency situations may occur when an emergency oil drain needs to be shut off. The oil drain can be performed according to the different logic situations described in the first to seventh embodiments, and will not be repeated here.

The aircraft emergency oil discharge comprehensive control method adopts two independent control links, and oil tank information acquired by the two independent control links are different in source, so that the dependence that the existing architecture design is not separated from a fuel measurement management system is solved.

Simultaneously, the fuel measurement management system 100 and the independent emergency fuel drain control system 200 adopt two sets of cutting assemblies, each cutting valve is controlled by an independent motor respectively, and the independent actions of each set of cutting assemblies are mutually independent, so that the problems of single-point failure and common-mode failure are avoided. The method is realized in a whole-course automatic way, and manual operation of a flight crew is not needed, so that the energy of the flight crew is saved.

In addition, the failure of the current main flow type emergency oil drain control system is generally classified as a CAT class I failure grade, and belongs to a higher class A grade, so that a higher requirement is put on a system development guarantee grade DAL, and the cost of a developed system is relatively higher. The method decomposes the A-level function into two B-level functions, and avoids excessive oil discharge through two B-level systems respectively, so that the development assurance level DAL of the system can be reduced, and the development cost of the system is reduced; and the waste of oil caused by excessive oil discharge can be prevented, and the economy is improved.

It should be noted that in order to simplify the presentation of the disclosure herein and thereby aid in understanding one or more inventive embodiments, various features are sometimes incorporated into one embodiment, the drawings, or the description thereof, in the foregoing description of embodiments of the present disclosure. This method of disclosure, however, is not intended to imply that more features than are presented in the claims are required for the subject application. Indeed, less than all of the features of a single embodiment disclosed above.

While the invention has been described in terms of preferred embodiments, it is not intended to be limiting, but rather to the invention, as will occur to those skilled in the art, without departing from the spirit and scope of the invention. Therefore, any modification, equivalent variation and modification of the above embodiments according to the technical substance of the present invention fall within the protection scope defined by the claims of the present invention.

Claims

1. Emergent oil drain integrated control system, its characterized in that, this system includes:

a first shut-off assembly (500) comprising a first motor (501) and a first shut-off valve (550), said first shut-off valve (550) being adapted to shut off emergency oil drain and being actuated independently by said first motor (501);

A second shut-off assembly (400) comprising a second motor (402) and a second shut-off valve (450), said second shut-off valve (450) being adapted to shut off emergency oil drain and to be actuated independently by said second motor (402);

a self-contained emergency oil drain control system (200) comprising a first oil level sensor assembly (201) and an emergency control module (260), the emergency control module (260) being configured to, upon receipt of a signal control of the first oil level sensor assembly (201), open the first cut-off assembly (500) to cut off emergency oil drain;

a fuel measurement management system (100) comprising a fuel measurement management module (160), a second fuel level sensor assembly (102) and a fuel quantity sensor assembly (103), the fuel measurement management module (160) being configured to control the opening of the second shut-off assembly (400) upon receipt of a signal transmitted by the fuel quantity sensor assembly (103) to shut off emergency fuel drain, and to simultaneously control the opening of the first shut-off assembly (500) and the second shut-off assembly (400) upon receipt of a signal transmitted by the second fuel level sensor assembly (102).

2. The emergency oil drain integrated control system of claim 1, wherein,

-the first oil level sensor assembly (201) and the second oil level sensor assembly (102) are arranged to detect that the physical characteristics of the oil level are different;

The first severing assembly (500) and the second severing assembly (400) differ in physical characteristics for effecting severing.

3. The emergency oil drain integrated control system of claim 1, wherein,

the first oil level sensor assembly (201) emits a first signal when the oil level in the oil tank is lower than a first threshold value, the second oil level sensor assembly (102) emits a second signal when the oil level in the oil tank is lower than a second threshold value,

the first threshold value is equal to or greater than the second threshold value,

the fuel quantity sensor assembly (103) sends out a third signal when the fuel quantity in the fuel tank is lower than a third threshold value,

and the oil level of the oil tank corresponding to the third threshold value is greater than or equal to the first threshold value and the second threshold value.

4. The emergency oil drain integrated control system of claim 1, wherein the emergency control module (260) includes a first control unit (205) and a first switch assembly (310), the first control unit (205) being configured to open the first switch assembly (310) upon receiving a signal transmitted by the first oil level sensor assembly (201) to cause the first motor (501) to control a first cut-off valve (550) to cut off the emergency oil drain.

5. The integrated emergency drain control system of claim 1, wherein the fuel measurement management module (160) includes a second control unit (105) and a second switch assembly (320), the second control unit (105) configured to,

Opening the second switch assembly (320) after receiving the signal transmitted from the oil quantity sensor assembly (103) to enable the second motor (402) to control the second cut-off valve (450) to cut off,

the second switch assembly (320) is turned on after receiving a signal transmitted from the second oil level sensor assembly (102) such that the first motor (501) and the second motor (402) control the first shut-off valve (550) and the second shut-off valve (450) to be shut off simultaneously, respectively.

6. The integrated emergency drain control system of claim 1, wherein the fuel measurement management module (160) includes a second control unit (105) and a second switch assembly (320), the second control unit (105) configured to,

opening the second switch assembly (320) upon receiving a signal transmitted from the second oil level sensor assembly (102) to cause the second motor (402) to control the second shut-off valve (450),

is further configured to exchange data with the emergency control module (260) after receiving the signal transmitted from the second oil level sensor assembly (102) to drive the first motor (501) to cut off the first cut-off valve (550) through the emergency control module (260).

7. The emergency oil drain integrated control system of claim 3, wherein, in a first mode of the system,

after the fuel measurement management system (100) fails, the independent emergency oil discharge control system (200) independently senses the oil level in the oil tank through a first oil level sensor assembly (201), and when the oil level is lower than the first threshold value, the first cutting assembly (500) is instructed to be opened through the emergency control module (260) so as to cut off emergency oil discharge.

8. The emergency oil drain integrated control system of claim 3, wherein, in the second mode of the system,

after the independent emergency oil drain control system (200) fails, the fuel oil measurement management system (100) senses the oil quantity in the oil tank through the oil quantity sensor assembly (103) and instructs the second cutting assembly (400) to be started through the fuel oil measurement management module (160) to cut off oil drain when the oil quantity is lower than the third threshold value;

the system also senses the fuel level in the fuel tank through the second fuel level sensor assembly (102) when the second shut-off assembly (400) fails to accept the instructions of the fuel measurement management module (160), and instructs the second shut-off assembly (400) to shut off when the fuel level is below a second threshold, and also enables the simultaneous shut-off of the first shut-off assembly (500) through the fuel measurement management module (160).

9. The emergency oil drain integrated control system of claim 3, wherein, in a third mode of the system,

after the second oil level sensor assembly (102) fails, the system detects the oil quantity in the oil tank through the oil quantity sensor assembly (103) and instructs a second cutting assembly (400) to cut off emergency oil drain through a fuel oil measurement management module (160) when the oil quantity is lower than the third threshold value;

the system measures the in-tank oil level by means of a first oil level sensor assembly (201) when the second shut-off assembly (400) fails to receive the instructions of the fuel measurement management module (160), and instructs the first shut-off assembly (500) to shut off the emergency drain by means of an emergency control module (260) when the first threshold is exceeded.

10. The emergency oil drain integrated control system of claim 3, wherein, in a fourth mode of the system,

after failure of the fuel level sensor assembly (103), the system detects the fuel level in the fuel tank through the first fuel level sensor assembly (201) and instructs the first cutting assembly (500) to cut off emergency fuel drain through the emergency control module (260) when the fuel level is lower than the first threshold,

when the first cutting assembly (500) cannot receive the transmission instruction of the emergency control module (260), the system senses the oil level in the oil tank through the second oil level sensor assembly (102), instructs the second cutting assembly (400) to cut off when the oil level is lower than a second threshold value through the fuel measurement management module (160), and simultaneously cuts off the first cutting assembly (500) through the fuel measurement management module (160).

11. The emergency oil drain integrated control system of claim 3, wherein, in a fifth mode of the system,

after the oil quantity sensor assembly (103) and the first oil level sensor assembly (201) are failed, the system senses the oil level in the oil tank through the second oil level sensor assembly (102), instructs the second cutting assembly (400) to cut off when the oil level is lower than the second threshold value through the fuel measurement management module (160), and simultaneously cuts off the first cutting assembly (500) through the fuel measurement management module (160).

12. The emergency oil drain integrated control system of claim 3, wherein, in a sixth mode of the system,

after failure of both the second (102) and first (201) fuel level sensor assemblies, the system senses the fuel level in the tank via the fuel level sensor assembly (103) and instructs the second shut-off assembly (400) to shut off the emergency drain via the fuel measurement management module (160) when the fuel level is below the third threshold.

13. An emergency oil drain integrated control system as claimed in claim 3, wherein, in a seventh mode of the system, when the second oil level sensor assembly (102), the first oil level sensor assembly (201) and the oil amount sensor assembly (103) are all normal,

The system senses the oil quantity in the oil tank through the oil quantity sensor assembly (103), and instructs a second cutting assembly (400) to cut off the emergency oil drain through the fuel measurement management module (160) when the oil quantity is lower than the third threshold value;

the system senses the fuel level in the fuel tank independently through a first fuel level sensor assembly (201) when the second shut-off assembly (400) fails to receive the instruction of the fuel measurement management module (160), and instructs the first shut-off assembly (500) to shut off the emergency fuel drain through an emergency control module (260) when the first threshold is lower.

14. The integrated emergency drain control system of claim 1, further comprising a pre-self-test processing unit having a built-in self-test program for detecting the amount of oil in the tank prior to drain.

15. The emergency oil drain integrated control system of claim 14, wherein,

in a first self-test procedure of the pre-self-test processing unit, the system senses the oil level in the oil tank through the first oil level sensor assembly (201), and controls the first cutting assembly (500) to be in a locking cutting state through an emergency control module (260) when the oil level is lower than a fourth threshold value.

16. The emergency oil drain integrated control system of claim 14, wherein,

the system senses the fuel level in the fuel tank through the second fuel level sensor assembly (102) in a second self-checking program of the pre-self-checking processing unit, and controls the first cutting assembly (500) to be in a locking cutting state through the fuel measurement management module (160) when the fuel level is lower than a fourth threshold value.

17. The emergency oil drain integrated control system of claim 14, wherein,

the fuel measurement management module (160) is further configured to control the opening of the first shut-off assembly (500) upon receipt of a signal transmitted by the fuel sensor assembly (103),

and in a third self-checking program of the front self-checking processing unit, the system senses the oil quantity in the oil tank through the oil quantity sensor assembly (103), and controls the first cutting assembly (500) to be in a locking cutting state through the fuel measurement management module (160) when the oil quantity corresponding to the fourth threshold value is lower than the oil quantity.

18. The emergency oil drain integrated control system of claim 14, wherein,

in a fourth self-test procedure of the pre-self-test processing unit, the system senses the fuel level in the fuel tank through the second fuel level sensor assembly (102) and, when the fuel level is lower than a fourth threshold value, through data exchange between the fuel measurement management module (160) and the emergency control module (260) to control the first cut-off assembly (500) to be in a locked cut-off state by means of the emergency control module (260).

19. The emergency oil drain integrated control system of claim 14, wherein,

in a fifth self-checking procedure of the pre-self-checking processing unit, the system senses the oil quantity in the oil tank through the oil quantity sensor assembly (103), and when the oil quantity is lower than the oil quantity corresponding to a fourth threshold value, the system controls the first cutting assembly (500) to be in a locking cutting state through data exchange between the fuel measurement management module (160) and the emergency control module (260) by virtue of the emergency control module (260).

20. The integrated emergency drain control system of claim 1, wherein the system is capable of controlling the cutoff of a plurality of emergency drain channels on each of the aircraft fuel tanks.