EP2212565A1

EP2212565A1 - Hydraulic system for an aircraft

Info

Publication number: EP2212565A1
Application number: EP08846081A
Authority: EP
Inventors: Roger Morvan; Nicolas Dubois; Cedric Lonjon
Original assignee: Airbus Operations SAS
Current assignee: Airbus Operations SAS
Priority date: 2007-10-23
Filing date: 2008-10-22
Publication date: 2010-08-04
Anticipated expiration: 2028-10-22
Also published as: US8800277B2; EP2212565B1; ATE512309T1; FR2922521A1; WO2009056733A1; US20110088383A1

Abstract

A hydraulic system for aircraft wherein at least one circuit includes two hydraulic pumps, at least one of which is driven by an engine that may suffer uncontained failure that can damage hydraulic lines close to the pump, is equipped with pressure sensors for the hydraulic fluid in the lines close to the pump and a sensor for the hydraulic fluid level in a hydraulic tank of the circuit supplied by the pump. A control system for a cut-out valve installed on a suction line wherein the fluid arrives at the pump includes logic that determines the occurrence of an uncontained engine failure requiring the isolation of the pumps from line elements that may have been damaged from measurements of the fluid pressures in the lines, from measurement of the level of fluid in the tank and from information supplied late by a uncontained engine failure detection system to command the closure of the cut-out valve. The disclosed embodiments allow achieving a simplified hydraulic architecture wherein two independent circuits are supplied by two pumps each mounted on propulsion engines.

Description

Hydraulic system for aircraft

The present invention belongs to the field of hydraulic systems used on board aircraft for the control of mobile elements such as aerodynamic control surfaces and landing gear parts.

More particularly, the invention relates to a protection for such hydraulic systems which limits the consequences of the rupture of certain pipes in the vicinity of the pumps for generating the hydraulic pressure during an engine burst.

On the majority of modern transport aircraft many moving parts are driven by actuators using a power transported in a hydraulic fluid under pressure.

The aerodynamic control surfaces and the moving elements of the landing gear are the main elements driven by hydraulic actuators and their good functioning is essential, any uncontrolled failure may endanger the aircraft.

For these safety reasons, the hydraulic systems of an aircraft, comprising hydraulic generations, hydraulic distributions and actuators, are arranged according to architectures that seek to limit the consequences of possible failures of the various components of said systems and in any case to avoid that a probable failure can not lead to consequences likely to jeopardize the integrity of the aircraft concerned.

Many architectures have been devised and or implemented on board aircraft to limit the consequences of failures of hydraulic system components. Principles common to all known architectures, at least for those used on board civil aircraft that must comply with stringent certification rules, consist in arranging several independent hydraulic circuits, generally two or three circuits, each circuit may comprise two or more times some components, for example two pumps of generation of the hydraulic pressure (redundancy rules), and in addition to arranging the components of said edge circuits of the aircraft so that the risk of damaging two or more redundant circuits or components, due to a the same event causes damage, is unlikely (rule of segregation).

In order to implement these basic principles for the safety of hydraulic systems, certain hydraulic circuits are provided with at least two sources of hydraulic power generation, hydraulic pumps driven by different motors, for example a propulsion motor on the ground. left wing of an airplane and a propulsion motor on the right wing (or an electric motor, or a wind turbine or an auxiliary power unit).

In this type of hydraulic circuit, it is then necessary that the failure of a generation source of the circuit does not render the circuit unusable which would have the consequence of rendering useless the second generation source of the same circuit. In the opposite case the redundancy of the pumps would then be apparent and would not reach the desired goal.

A major risk for a hydraulic circuit whose hydraulic power generation uses a hydraulic pump driven by a turbojet engine or turbine engine propulsion engine comes from the debris that can be projected during a burst of a rotating part of said turbine, an event described as engine bursting.

Hydraulic pumps driven mechanically by the propulsion engines are necessarily located close to said engines and it is generally impossible for the hydraulic lines connected to said pumps to be installed outside of all the areas likely to be affected by the debris consequences of an engine burst.

In the case of such an event, the risk is high that a hydraulic line is strongly damaged or even severed and, without particular precaution, the hydraulic circuit concerned quickly loses hydraulic fluid and becomes unusable.

In order to prevent all the hydraulic fluid of a circuit from being lost in the event of the cutting of a pipe during an engine burst, a device specific to the engine, for example an engine control computer which includes a monitoring function, which analyzes engine operating parameters suitable for detecting an engine burst, generates a specific signal to signal a burst of the engine in question, which signal is used to control the closing of fire-stop valves mounted on the hydraulic lines and which causes the isolation of the hydraulic circuit with respect to the burst zone in which a pipe may have been cut.

A disadvantage of this type of device comes from the fact that most often the burst detection means of an engine are not able to generate the corresponding signal before a significant delay, of the order of 30 seconds, to look at the hydraulic leak generated by the severing of a pump line.

In order to activate the isolating fire valve (s) in the hydraulic circuit of the pumps driven by the faulty engine before the hydraulic fluid is completely lost, it is then necessary to have a large capacity fluid reservoir, a solution generally discarded because of the mass induced by such a solution.

It is also possible to set up other detection means such as break wires associated with the hydraulic lines which, because of their rupture in the event of rupture of the pipework, make it possible to quickly detect the cutting of a pipe.

These solutions are however not entirely satisfactory either because of the fragility of the wires to break which work, in the case of hydraulic lines close to the propulsion engines, in a severe environment and which do not always make it possible to detect all the possible trajectories engine debris.

Finally, the need to consider the case of engine bursting and damage to hydraulic lines in the vicinity of the pump or pumps associated with this engine leads to complex and cumbersome hydraulic generation system architectures, in particular by setting up of hydraulic circuits entirely outside the areas of debris projection in case engine burst which requires the use of pumps driven by means other than the propulsion engines, for example by electric motors or by wind turbines ...

To simplify the architecture of the hydraulic systems of an aircraft, the invention proposes a hydraulic system comprising at least one hydraulic circuit powered by at least two pumps and in which among the pumps of the hydraulic circuit:

- At least one pump is driven by a motor liable to burst engine, which engine burst is likely to project debris in a projection zone;

- Pipes connecting the pump to the rest of the hydraulic circuit are installed in part in the projection zone, the said pipes comprising: - one or more low pressure hydraulic fluid suction lines in which the hydraulic fluid flows from between another, a hydraulic cover towards the pump, the suction pipe or lines each having a fire-stop valve which, in an open position, allows the fluid to circulate in the pipe and in a closed position prevents the flow of fluid in the suction pipe considered ;

one or more high-pressure hydraulic fluid discharge pipes, called HP discharge pipe, in which the hydraulic fluid flows from the pump to the rest of the hydraulic circuit, the discharge pipe or pipes each having a check valve arranged to prohibit the circulation of the hydraulic fluid in the discharge pipe concerned towards the pump;

where appropriate, one or more low pressure hydraulic fluid drain lines in which the hydraulic fluid flows from a pump casing to the tarpaulin, the one or more drain pipes each comprising a non-return valve arranged to prevent the flow of hydraulic fluid in the drain pipe concerned from the cover to the pump housing. In order for a motor burst which damages HP pipes, suction lines and / or discharge pipes and, where applicable, drain lines, close to a pump, the hydraulic circuit to which the pump is connected is not rendered unusable. makes the hydraulic leak caused by the damage of the pipes, the suction pipe or lines, the HP discharge pipe (s) and the drain pipe (s) each comprise at least one pressure sensor, each pressure sensor being arranged between the pump and the fire valve or the non-return valve of the pipe in question, capable of delivering a characteristic signal of a value of the pressure of the hydraulic fluid in the pipe in question, and the hydraulic system comprises a control device the fire valve that:

- receives pressure sensors from each line, suction lines, discharge lines and drain lines, the signal characteristic of the measured pressure; comparing each characteristic signal of the measured pressure with a predefined threshold for each pipe;

generates a FVCF signal for closing the fire stop valve when at least one of the signals characteristic of a measured pressure is below the threshold at which it is compared. To avoid triggering an unjustified closure of the fire valve due to a variation of the pressure in the suction line which is subject to significant pressure fluctuations during normal use, the valve control device firewall inhibits the FVCF closing control signal of the fire stop valve when the pressure measured on the suction pipe is lower than the threshold value of the predefined pressure for said suction pipe if a characteristic signal of a level of Hydraulic fluid in the tarpaulin does not determine that said fluid level in the tarpaulin is below a predefined minimum level, called low tarp level.

In order to take into account small leaks that do not induce pressure drops in the pipes below the predefined thresholds, ie sufficient to be interpreted as damage to a pipe, the valve control device firewall :

- Generates a FVCF closing signal of the fire stop valve when no pressure in the pipes is measured below the predefined thresholds but a low level of tarpaulin signal is received and; a signal identifying an engine burst is received from an engine burst detection system.

To prevent particular conditions from causing the fire valve control device to generate a signal to reopen the fire stop or valves when these valves have been closed, the closing signal generated by the fire control device the fire stop valve is locked when a low level signal of the hydraulic fluid in the tank is received and a signal is further received from the engine burst detection device that a burst is detected.

To consolidate the conditions that trigger the closure of the fire stop valve, preferably the pressure in a pipe is determined by means of two pressure sensors and the pressure in a given pipe is considered to be lower than the threshold defined for said pipe if :

one of the two sensors at least associated with said channel delivers a signal characteristic of a pressure lower than the corresponding threshold; - Signals of validity of the measurements provided by the two sensors indicate that neither sensor is able to transmit a reliable measurement.

For similar reasons, the low level of the hydraulic fluid in the tank is consolidated by: - comparing a QB value of the level, measured by a level sensor, of fluid in the tank with a SQB threshold and combining the result of this comparison with a logical AND of a minimum level detector QMIN in the sheet when the value transmitted by the level sensor is considered reliable because of the value of a validity signal associated with said level sensor, or ; using the only information QMIN of the minimum level detector when the value transmitted by the level sensor is considered unreliable due to the value of a validity signal associated with said level sensor.

In order not to hinder the start-up of the hydraulic systems when the engines are started from a stopped state, the control device of the fire stop valve inhibits the FVCF signal for closing the fire stop valve, if said shut-off valve the fire has not been closed due to an assumed or identified engine burst, when the aircraft is not in flight and or the pump is depressurized by a voluntary CDP depressurization control. Advantageously, the control device of the fire stop valve considers that the aircraft is not in flight when the engines are not detected in operation and that the speed of the aircraft is less than a threshold speed lower than a speed minimum flight.

For safety and to prevent the fire valve from being opened without the necessary operations to restore the aircraft has been performed, the control device of the fire valve is able to generate an OVCF signal of control of the opening of the fire stop valve and authorizes the generation of said opening OVCF signal, when the conditions of closure of the fire stop valve have been realized during a flight, only when the engines of the The aircraft are all detected when stationary, the aircraft is detected on the ground and the level of hydraulic fluid in the tank is higher than the low level.

The invention also relates to an hydraulic system for an aircraft comprising two independent hydraulic circuits each of said circuits comprising two hydraulic pumps and the two pumps of the same circuit being driven by different propulsion engines of the aircraft, in which each hydraulic pump is associated with a fire valve ordered according to a logic consistent with the logic just described.

In this way the architecture of the hydraulic system is simplified compared to known architectures without the reliability of the hydraulic system is affected.

The method according to the invention is described with reference to the figures which show schematically: FIG. 1: a hydraulic system architecture comprising two independent hydraulic circuits according to the invention; FIG. 2: a block diagram of the means of the invention in the vicinity of a hydraulic pump driven by a propulsion motor; Figure 3: control logic of the fire valve associated with a hydraulic pump;

According to the invention, an hydraulic system for an aircraft comprises at least one hydraulic circuit powered by at least two distinct hydraulic pumps, at least one of which comprises ducts which are in a zone of possible projection of debris from an engine into the engine. hypothesis of an engine burst, in particular because of its mechanical drive by said engine which imposes a very close installation of said engine.

FIG. 1 illustrates an example of an architecture of a hydraulic system of an aircraft corresponding to such a situation. The hydraulic installation of Figure 1 comprises two independent hydraulic circuits, said green circuit, and Ib, said yellow circuit.

The so-called two green and yellow circuits are very similar in functional terms.

Each circuit Ia, Ib comprises two hydraulic pumps 10a, 11a, respectively 10b, 11b which are each driven by different motors.

2a and 2b propulsion of the aircraft so that if a motor, 2a, respectively 2b, stops driving the pumps 10a and 10b, respectively lia and 11b to which they are connected, for example due to a stop of the rotation of said motor, the two hydraulic circuits remain functional because of their supply by the pumps 11a, 11b, respectively 10a, 10b connected to the other motor 2b, respectively 2a. Each hydraulic circuit comprises pipes of a hydraulic distribution in which circulates in a closed circuit a hydraulic fluid, shown schematically in Figure 1 by a single line 3a, 3b which supply hydraulic energy consumer equipment, actuators, hydraulic motors ... , necessary for example for flight controls 12, high lift devices and engine thrust reversers 13 and landing gear systems 14.

A hydraulic circuit comprises, if necessary, auxiliary hydraulic power generation means 15 for maintenance purposes. Each circuit also comprises at least one hydraulic cover, not shown, pressure tank which contains a reserve of hydraulic fluid.

The cover makes it possible to compensate for losses of hydraulic fluid, in particular because of the unavoidable micro-leaks in a hydraulic system and to compensate for fluid level variations induced by the operation of the equipment and by variations in service temperature which are sources of variations. of fluid volume.

The tarpaulin is therefore an essential element of a hydraulic circuit and in particular its volume, which characterizes a capacity of the tarpaulin to compensate for losses of hydraulic fluid.

The cover includes in particular at least one sensor with a level Qb of hydraulic fluid in the cover and preferably a specific detector of a low level Qmin of the hydraulic fluid, low level Qmin, which is deduced, if necessary, from the level measurement Qb of fluid.

FIG. 2 schematically illustrates the situation of a hydraulic generation of a hydraulic circuit at the level of a propulsion engine 2 which corresponds to one of the motors 2a, 2b of FIG.

The motor 2 mechanically drives a pump 10, corresponding to a pump 10a or 10b or 11a or 11b of Figure 1 along the engine and the green or yellow hydraulic system considered. The engine 2 also comprises a device 21 for detecting an engine burst which generates a particular information signal when a burst is detected by means of a communication line 22 such as a data transmission bus.

Such a device 21 is advantageously a motor operation control system, said FADEC, in which is incorporated in a known manner the burst detection function by analyzing signals from various sensors, not shown, the engine.

The pump 10 is connected to the hydraulic circuit by pipes in which the hydraulic fluid flows to the pump and pipes in which the hydraulic fluid leaves the pump.

In the example of Figure 2 the pump comprises, according to a known pump architecture, three pipes.

A first pipe 31, called suction, corresponds to the arrival of low pressure hydraulic fluid to the pump 10, fluid arriving from consumer equipment and or the tarpaulin.

A second pipe 32, called a drain, corresponds to a low-pressure hydraulic fluid outlet from a drainage casing of the pump 10. The drain pipe sends to the tank the hydraulic fluid that arrives in the casing of the pump 10 because of leaks internal to said pump. A third pipe 33, called HP discharge, corresponds to a high-pressure hydraulic fluid flow from the pump 10 to the consumer equipment.

In known manner, the suction pipe 31 is provided with at least one isolation valve 311, called a fire stop valve, comprising a first position, called an open position, in which the hydraulic fluid circulates freely in the corresponding pipe, and a second position, said closed position, in which the hydraulic fluid can no longer circulate between a downstream part, pump side of the valve, and an upstream part, hydraulic circuit side and consumer equipment, the pipe.

If the pump comprises two or more suction lines, not shown in the figures, similarly each pipe is provided with at least one isolation valve. In the rest of the description, the expression "the fire stop valve" is to be interpreted as "the fire valves associated with the suction lines of the pump" when said pump comprises more than one suction pipe.

In a known manner also each of the drain lines 32 and discharge pipes HP 33 is provided with at least one non-return valve 321, 331 respectively, each check valve being arranged on the corresponding pipe so that the hydraulic fluid circulates freely in the pipe from the pump 10 to the hydraulic circuit and can not flow in the opposite direction, that is to say towards the pump. If the pump comprises two or more drain pipes or HP discharge, not shown in the figures, similarly each pipe is provided with at least one non-return valve.

Check valves are simpler than fire stop valves because they do not require any control and are very reliable because of their constitution. They are sufficient to prevent a return of hydraulic fluid to the pump without opposing the passage of fluid in the pipe in normal operation. Although preferred, the check valves may be replaced or supplemented by valves controlled to perform the same functions as the valves. In such an arrangement, said valves are then controlled simultaneously with the fire valve (s) of the suction pipe.

Each duct 31, 32, 33 is also equipped, between the pump

On the one hand and the fire-stop valve 311 or the non-return valves 321, 331 on the other hand, at least one pressure sensor 312a, 312b, respectively

322a, 322b and 332a, 332b, which delivers a pressure information of the hydraulic fluid in the corresponding pipe. The fireproofing valve 311, the nonreturn valves 321, 331 and the pressure sensors 312a, 312b, 322a, 322b, 332a, 332b, are arranged on the pipes preferably in zones outside a zone 23, said projection zone, in which may be projected debris from the engine may damage the hydraulic lines 31, 32, 33, so that said sensors, said valve and said valves are not likely to be damaged by Debris projections or at least to decrease this risk as much as possible. Sensors, valves and valves are for example installed in an area of a coupling mat of the engine 2. Advantageously the pressure sensors are arranged closer to the zone 23 to be as sensitive as possible to the pressure variations of the hydraulic fluid in the pipe sections located in said zone.

In addition, a control device of the fire stop valve 311 receives signals from the pressure sensors arranged on the pipes so that when the pressures measured by the sensors are below thresholds, adapted to each pipe considered, said device of command generates a signal having the effect of controlling the closure of said fire stop valve.

Due to quasi-instantaneous measurements of the pressure provided by the pressure sensors arranged on the pipes and the rapid pressure drop in a pipe that would result from the cutting of said pipe, the detection by a sensor of a pressure drop in below the threshold associated with said sensor is interpreted by the control system of the fire valve as a leak in the corresponding pipe possible consequence of an engine burst and said control system closing the fire stop valve 311 of the pipe suction 31 of the pump 10 driven by the motor 2.

This closure of the fire stop valve 311 is controlled within a very short time, at most of the order of a few seconds, following the detection of the pressure drop and therefore of the supposed burst, much shorter than that of the order of thirty seconds after which the engine burst detection device 21 is able to give the engine burst information. The pump 10 and the associated pipe elements that may have been damaged are then isolated from the remainder of the hydraulic circuit, by the fire stop valve 31 on the one hand and by the non-return valves 32, 33 on the other hand, without a significant amount of hydraulic fluid has been lost and thus maintaining said hydraulic circuit operational with the other pump of the circuit considered.

In a particular embodiment, when the means used to detect an engine burst are considered to deliver sufficiently reliable information, the control device of the fire stop valve also comprises a logic that actuates the closure of the associated valve 311 at the pump 10 when the engine burst detection device 21 declares a burst of the engine on which said pump is mounted, even when none of the pressures measured by the pressure sensors 312a, 312b, 322a, 322b, 332a, 332b is below the thresholds. It is indeed possible in this case that the engine burst has generated limited leaks that did not reduce the pressure measured by the pressure sensors below the thresholds for which the device controls a closure of the fire valve 311 In this case the loss of hydraulic fluid remains limited despite the detection time of the engine burst by the burst detection device 21.

The tarpaulin also comprises at least one sensor of the level Qb of hydraulic fluid in said tarpaulin which delivers a signal characterizing said fluid level.

Preferably, the cover also comprises a low-level detector which generates a signal which changes state when the fluid level in the cover falls below a predefined level.

It should be noted that even in absence of leakage, when the engine burst is confirmed, it is desirable to isolate the pump 10 when the engine 2 has burst because the imbalance of an engine after a burst is generally large and the risk of damage to the hydraulic lines is high due to the high vibration level.

Advantageously the control device of the fire stop valve receives signals to inhibit the closing command of the fire stop valve 311 when the pressures measured by the pressure sensors 312a, 312b, 322a, 322b, 332a, 332b are normally below the threshold values, in particular during phases of For example, the logic of the control device of the fire stop valve inhibits the closing of the fire stop valve 311 when the speed of the aircraft is below a given speed, for example a speed of 100 Kt for a civilian plane, which implies that the plane is not flying.

In a preferred embodiment of the invention the pressure condition, for which it is considered by the control device of the fire valve that a pipe 31, 32, 33 is damaged, is established by means of a first sensor 312a, respectively 322a and 332a, and a second sensor 312b, respectively 322b and 332b, for measuring the pressure in said pipe, sensors which each deliver on the one hand a measured pressure value of the fluid in the corresponding pipe and on the other hand a validity signal which characterizes a reliability of the information delivered by the sensor.

The pressure value delivered by a sensor may be an analog or digital value corresponding to a measured value and which is then compared by the control device of the fire stop valve to the threshold value associated with the said sensor, or by construction of the said sensor. discrete value that changes state for the threshold value.

In a preferred embodiment implementing two pressure sensors by pipeline, in order to consolidate the pressure loss condition on a pipe, the control device of the fire stop valve determines that the pressure is below the predefined threshold:

if the first sensor delivering a valid signal due to the value of the associated validity signal gives a pressure value lower than the predefined threshold for this sensor, and or;

if the second sensor delivering a valid signal due to the value of an associated validity signal gives a pressure value lower than the predefined threshold for this sensor, or if the first and the second sensors are declared not to give valid information because of their validity signals, a condition which leads to suppose that the two sensors are damaged.

When the detection of an engine burst is not confirmed within a given time required for the engine burst detection device 21, for example a delay of thirty seconds, to deliver the burst information, it is made assumption that the closure of the fire stop valve 311 is not justified and the control device of the fire stop valve 311 controls the reopening of said valve to obtain the return to a nominal operation of the pump.

On the other hand, if the detection of an engine burst is confirmed within the given time required for the engine burst detection device 21 to deliver the burst information, the closure of the fire stop valve 311 is justified and the control device of the fire stop valve 311 locks the closing command of said valve so that the reopening of said valve is then impossible until the restoration of conditions corresponding to a restoration of the circuit when the aircraft is at ground.

A detailed example of an operating logic of the fire valve control device for a pump 10 arranged as in the example of FIG. 2 according to the invention is given in FIG. 3. Each pump driven by an engine capable of projecting debris, whatever the circuit supplied with hydraulic pressure by said pump, is preferably provided with a similar device for controlling a fire stop valve or, if appropriate, fire stop valves associated with the pump considered if several valves are implemented.

This FIG. 3 presents a diagram that uses the general conventions of representation of the logic circuits by means of AND logic gates AND OR logic gates (OR), associated or not with inverted inputs, as well as TEMP (TEMP) and COMPARATOR (COMP).

In FIG. 3, the input and output signals have the following meanings:

- for the input signals:

According to the logic proposed, as is apparent from the analysis of the diagram of FIG. 3, for the signals comprising two logical states (1,0) or (True, False), a signal takes the logical value 1 or True when the condition given in the definition is fulfilled.

The schema can be transposed without difficulty if input signals do not respect this principle and the logic is not strictly limited to the diagram proposed, in particular additional conditions for tripping or inhibiting the closing or opening commands of the fire stop valve which may be introduced for example for reasons of operational safety of the device. The operation of the invention in the case of the particular example of the logic proposed in Figure 3 is detailed below.

In nominal conditions, aircraft in flight and engines in normal operation: the level of hydraulic fluid in the tank of the hydraulic circuit considered is greater than the minimum level, said low level, ie the measured quantity of fluid QB is greater than at the lower threshold SQB and the low level detection signal QMIN is at the logical value 0; the engine is supplied with fuel and the signal ML is at logic value 1;

the hydraulic pump of the hydraulic circuit in question is pressurized and the signal CDP is at logic value 0;

- the FADEC management and engine monitoring computer delivers an ER signal at logic value 1 to characterize the correct operation of the engine

the engine burst detection device 21, the FADEC computer in the example in question, delivers a signal DEFA at the logic value 0, no engine burst being detected.

It is also assumed in the case of the nominal operation that the validity signals, intended to avoid taking into consideration a signal transmitted by a faulty equipment, are all at logic value 1, that is to say that the signals emitted by the equipment is taken as valid. During a transient motor startup phase the pressures, measured by the pressure sensors 312a, 312b, 322a, 322b, 332a, 332b, are progressively established from values below the threshold values SHP, SD and SLP respectively for the three discharge pipes HP, drain and suction.

During this transient phase, the FVCF closing command signal of the fireproofing valve 311 is thus locked and said fireproofing valve is kept open, FVCF is at logic value 0 and OVCF at logic value 1.

During take-off, the speed of the aircraft increases and when the speed reaches a threshold speed, said threshold speed being chosen lower than a minimum flight speed of the aircraft concerned, for example a speed of 100 knots for a civil transport aircraft modern, the closing of the fire valve 311 becomes possible.

During the flight, in normal flight condition, the fire stop valve 311 is open and the logic is in a state to control a closing of said valve. In the event of a bursting of the engine, debris is ejected which may damage one of the discharge and / or drain and / or suction lines, a damage which may cause a significant leakage, especially in the event of the cutting of a pipe, c that is to say a rapid loss of hydraulic fluid with respect to the time required for the engine burst detection device 21 to identify the burst.

The damage may also be more limited, for example by perforating a pipe in a limited manner, and cause a leak whereby the loss of hydraulic fluid is slow compared to the time required for the engine burst detection device 21 to identify the engine. bursting. If no pipe is damaged during engine burst, no leakage occurs and in this case there will be a priori no decrease in the measured pressure of the fluid in the pipes or drop of fluid level in the tank.

Case of a major leak:

When the HP 33 discharge line experiences a significant leak, the pressure in the discharge line HP drops and the values PHP1 and PHP2 measured by the pressure sensors 332a and 332b discharge become lower than the threshold value SHP which has the effect of activating the closure of the fire valve 311 since the closure logic is active taking into account the other conditions of activation. The check valves 321, 331 prohibit the flow of hydraulic fluid to the pump 10 which is no longer supplied with fluid.

Similarly, when the drain line 32 experiences a large leak, the pressure in said drain line drops and the values PD1 and PD2 measured by the drain pressure sensors 322a and 322b become lower than the threshold value SD which has the effect of to activate the closing of the fire protection valve 311.

Similarly, when the suction pipe 31 undergoes a significant leak, the pressure, normally maintained by the sheet, in said suction pipe drops and the PLP1 and PLP2 values measured by the suction pressure sensors 312a and 312b become lower. to the threshold value SLP which has the effect of activating the closing of the fireproof valve 311.

However, in the latter case, because of the relatively low pressures in the suction pipe 31, in general a few bars, often between 2 and 5 bar, and large relative variations of the said pressure in normal operation, either because of the fluid volume in the tank, either due to the pressure drop in the circuit during a high demand for flow by hydraulic consumers, it is advantageous to consolidate the detection of a pressure drop in the suction pipe 31 by a signal 301, said low level in the tank, which is in the logic state 1 when the hydraulic fluid level in the tank is less than a determined threshold.

In a preferred embodiment of the logic, the low level signal 301 in the accumulator is itself consolidated by a combination of a measurement of the hydraulic fluid level QB in the accumulator compared to a predefined threshold SQB and a low level detection signal QMIN, which signal QMIN goes to logic state 1 when the fluid level in the accumulator becomes lower than a given level, advantageously the corresponding level at the SQB threshold or a neighboring level.

The consolidation of the pressure drop measurement in the suction pipe 31 by the detection of the low level in the sheet avoids triggering a FVCF order to close the fire stop valve 311 due to normal pressure variations. in the hydraulic circuit while in the case of a major leak, the pressure drop in the suction pipe and the low level detection occur quickly after the start of the leak.

In the logic proposed in FIG. 3, each of the two pressure sensors 312a, 312b or 322a, 322b or 332a, 332b of the same pipe, respectively 31 or 32 or 33, is sufficient to deliver pressure drop information subject to that the validity signal associated with it is at logic value 1.

When the validity signals of the two sensors of the same pipe are at a logic value of 0, that is to say that the pressure values transmitted by the said sensors are not reliable, it is assumed that the sensors are damaged by example as a result of an engine burst, and that the corresponding pipe is also likely to have been damaged.

The logic used therefore considers that the non-validity of the two sensors of the same pipe is equivalent to a pressure drop in said pipe.

Preferably the detection of a pressure drop is subject to a delay for each pipe so as not to cause the fire valve 311 to close unexpectedly on a transient signal that could result from normal operation of the hydraulic system.

Case of a slow leak:

When the leakage of hydraulic fluid is slow, which results for example in the event of engine bursting of a limited damage of a pipe 31, 32, 33 by a debris or loosening of a coupling due to strong vibrations generated by an unbalance of rotating parts of the engine 2, the hydraulic system remains operational as long as there is hydraulic fluid in the tarpaulin to supply the pump 10.

In this case, whatever the faulty ducting, the fluid level in the tank decreases sufficiently slowly for the engine burst detecting device 21 to establish, within a known time, generally of the order of 30 seconds, the motor burst diagnosis.

When the signal DEFA emitted by the burst detection device 21, in the example given the FADEC, passes to the logic value 1 and when the monitoring of the fluid level in the sheet leads to a consolidated low level signal 301, as in the case analyzed during a major leak on the suction pipe 31, the closing of the fire stop valve 311 is controlled.

It should be noted that in this case the fire stop valve 311 is not closed in the absence of an engine burst signal, ie if DEFA is always at logic value 0, even when the low level in the tarpaulin is detected. Indeed in this situation, there is no reason to suppose that the possible leakage is located between the pump 10 and the fire stop valve 311 or the nonreturn valves 321, 331 and consequently the closing of said fire stop valve would be without effect on the leak and deprive the circuit of the energy supplied by the pump 10. To be fully operational, the logic of the hydraulic system that isolates the pump 10 by closing the fire stop valve must take into account additional constraints of which the main ones are explained below.

A first constraint relates to the controlled depressurization of the pump 10. The voluntary depressurization of the pumps of the hydraulic circuits is possible by an action of a pilot of the aircraft in the cockpit which has the effect of passing the variable CDP to the logical value 0.

In this case the pressure in the discharge pipe 33 and the drain pipe 32 normally decreases and the closure logic of the fire stop valve 311 outside the intended low level detection cases in the tank is inhibited. On the other hand, once the logic has been activated and the fire protection valve 311 is closed, the CDP signal is no longer taken into account whatever the action of the pilot acting on this variable. This logic latch 300 of the output 302 of a logic flip-flop can not be opened in flight because it requires that the ground condition established by the variable SOL is again at the logic value 1, that the motors are stopped, which corresponds to to the variable ER at the logical value 0, and that the pressure in the pipes is reestablished so that an unlock function by the output 303 of the logic flip-flop is activated.

When the logic has been activated, the closing of the fireproofing valve 311 must be maintained, in particular when it has been activated by the low level parameter, which is the case during a slow leak but also in the case of rupture of the suction pipe 31, because in both cases the fluid level in the tank rises because the pump 10 of the engine 2 broke remains driven and usually delivers hydraulic fluid into the tank, particularly the fluid contained between the pump 10 and the nonreturn valve 333 of the discharge pipe 33, but also that sucked by the pump 10 into the suction pipe 31.

The locking of the output 302 is performed when the conditions for activating the closure of the fire stop valve are present and the DEFA signal of the engine burst detecting device 21 is also present.

When the logic has been activated and locked, it can not be unlocked until the unlock conditions on the ground are met.

When an activation of the closure logic of the fire stop valve based on the measurement of pressure losses in one or more pipes is not confirmed by the signal of the engine burst detection device 21, the conditions activation are still present for the cases triggered by low pressure measurements on the discharge pipe 33 or on the drain pipe 32, reinforced by the closure of the fire stop valve 311, and therefore by a lack of hydraulic fluid in said pipes, and the logic remains activated, that is to say that the closing condition of said valve is not locked.

When the closure logic of the fire stop valve is triggered by the rupture of the suction pipe 31 or in a leakage scenario slow, logic that implements the measurement of the level of hydraulic fluid in the tank, and that the fluid level in the tank passes over the low level threshold for the reasons explained above, the fire valve 311 is open again The leak, which still exists, then causes the level of hydraulic fluid in the tank to drop again and when the level reaches the low level again, the closing logic of the fire damper is again activated, permanently this time because the level remains below the threshold value SQB. In practice, the choice of said threshold value SQB or QMIN comes from this failure scenario, the volume of hydraulic fluid then remaining in the tank once this level has been reached which should allow satisfactory operation of the hydraulic circuit which is supplied with hydraulic pressure by the another pump of said circuit driven by another motor. If the closure logic of the fire valve detects a pressure drop on one or more of the three pipes 31, 32, 33 of the pump 10 and if after a delay 304 the input signals TVC, ER and DEFA indicate that the aircraft is in flight and that the engine 2 is operational then the logic lock 300 is not engaged and the FVCF command of the closing of the fire stop valve 31 is inhibited.

This logic deals with a case that does not correspond to an engine burst because there is no external leak or engine burst detected, but which corresponds to a loss of pressure for another unidentified cause, for example a cause related to the pump 10 herself.

When the closure logic of the fire stop valve 311 and the output 302 of the logic lock 300 have been activated, the unlocking is necessary after repair and restoration of the circuit, on the ground obviously.

When the signals ER and SOL establish that the airplane is actually on the ground engine stopped and when the condition low level of the hydraulic fluid in the tarpaulin no longer exists, following the restoration of the circuit, the output 303 of the logic lock 300 allows the reopening of the 311 fire stop valve previously closed and locked by the locking signal 302.

The logic having isolated a leak following the bursting of an engine, the hydraulic circuit in question, which has at least one other pump driven by at least one other engine, for example a propulsion motor of the opposite wing, remains functional. does the operation of said other pump. The bursting motor is identified by the pressure signals dedicated to it, and in the case of slow leakage, even if the cover is common for two or more pumps comprising fire dampers controlled by equivalent logic. to that which has just been described, the signal of the engine burst detection device 21 unambiguously determines the faulty motor on which the fire stop valve must be closed.

The hydraulic equipment supplied by said hydraulic circuit is preferably positioned outside the probable trajectories of the debris, or otherwise provided with insulation fuses.

The device described in detail for a hydraulic circuit in a particular embodiment makes it possible to produce a hydraulic system architecture for a redundant aircraft as shown in FIG. 1 comprising two independent hydraulic circuits, the green circuit Ia and the yellow circuit Ib, each circuit comprising two pumps 10a, 11a, respectively 10b, 11b, each driven by a motor 2a, 2b different from an aircraft comprising at least two propulsion engines.

In this architecture, a bursting of a motor 2a, 2b is likely to cause leakage on both green and yellow hydraulic circuits Ib at the two pumps 10a, 10b or 11a, 11b driven by the respective motor 2a or 2b which undergoes a burst.

The hydraulic system implementing, preferably on the two hydraulic circuits 1a, 1b and on the two pumps 10a, 10b, respectively 11a, 11b, of each circuit, the closing logic of each fire stop valve associated with each pump according to to the invention will realize the insulation of the damaged pipes and the two hydraulic circuits la, Ib will remain operated by the pumps driven by the other engine because having the necessary amount of hydraulic fluid to ensure the proper operation of said hydraulic circuits.

Claims

Hydraulic system of an aircraft comprising at least one hydraulic circuit (1a, 1b) fed by at least two pumps (10a, 11a), respectively (10b, Hb), in which:

- At least one pump (10) among said at least two pumps is driven by a motor (2) liable to burst motor, which engine burst is likely to project debris in a projection zone (23);

- Pipes connecting the pump (10) to the remainder of the at least one hydraulic circuit are installed in part in the projection zone (23), said pipes comprising:

at least one suction pipe (31) for low pressure hydraulic fluid in which the hydraulic fluid circulates from among others a hydraulic cover to the pump (10), said at least one suction pipe comprising a fire valve ( 311) which in an open position circulates the fluid in said pipe and in a closed position prevents the flow of fluid in said suction pipe;

at least one discharge pipe (33), referred to as HP discharge, of high pressure hydraulic fluid in which the hydraulic fluid flows from the pump to the rest of the hydraulic circuit, said at least one HP discharge pipe comprising a non-return valve; return (331) arranged to prohibit the flow of hydraulic fluid in said discharge pipe HP to the pump (10); characterized in that the at least one suction pipe (31) and the at least one HP discharge pipe (33) each comprise at least one pressure sensor, respectively (312a, 312b), (332a, 332b), able to deliver a characteristic signal of a value of the pressure of the hydraulic fluid in the pipe considered between the pump (10) and the fire stop valve (311), respectively between the pump (10) and the anti-tamper valve. -return (331), and characterized in that the hydraulic system comprises a control device of the fire stop valve

(311) who:

- receives said at least one pressure sensor of each pipe, suction pipe (31) and HP discharge pipe (33), the signal characteristic of the measured pressure;

comparing each characteristic signal of the measured pressure with a predefined threshold for each pipe;

generates a control signal FVCF for closing the fire stop valve (311) when at least one of the signals characteristic of a measured pressure is lower than the threshold at which it is compared.

- Hydraulic system according to claim 1 wherein the connecting pipes of the pump (10) to the rest of the hydraulic circuit, partially installed in the projection zone (23), comprise at least one drain line (32) of hydraulic fluid at low pressure in which the hydraulic fluid flows from a housing of the pump (10) to the tank, said drain pipe including a non-return valve (321) arranged to prevent the flow of hydraulic fluid in said drain pipe from the covering to the pump casing and comprising at least one pressure sensor (322a, 322b) capable of delivering a characteristic signal of a value of the pressure of the hydraulic fluid in the pipe considered between the pump (10) and the anti-tamper valve. return (321), and wherein the fire valve control system receives the characteristic signal of fluid pressure in the drain line (32) and generates a FVCF control signal for closing the fire valve

(311) when said measured pressure is below a threshold. - Hydraulic system according to claim 1 or claim 2 wherein the control device of the fire stop valve inhibits the FVCF closing control signal of the fire valve (311) when the pressure measured on the suction pipe (31) is less than the threshold value of the predefined pressure for said suction pipe if a signal characteristic of a hydraulic fluid level in the tank does not determine that said fluid level in the tank is below a minimum level. predefined, says low level of covering.

Hydraulic system according to Claim 3, in which the fire valve control device:

generates a FVCF signal for closing the fireproofing valve (311) when no pressure in the suction (31), HP discharge (33) and, if applicable, drain (32) pipes is measured lower than predefined thresholds but a low level tarpaulin signal is received and;

a signal identifying an engine burst is received from an engine burst detection system (21).

Hydraulic system according to Claim 4, in which the FVCF signal for closing the fire stop valve is locked in a closed valve condition when a low level signal of the hydraulic fluid in the tank is received and a signal of engine burst is received from the engine burst detection device (21).

hydraulic system according to claim 3 or claim 5 wherein the pressure in a pipe (31, 32, 33) is determined by means of two pressure sensors, respectively (312a, 312b), (322a, 322b), (332a). , 332b), and in which the pressure in a given pipe is considered to be lower than the threshold defined for the said channeling if:

one of the two sensors at least associated with said channel delivers a signal characteristic of a pressure lower than the corresponding threshold;

- Signals of validity of the measurements provided by the two sensors indicate that neither sensor is able to transmit a reliable measurement.

- Hydraulic system according to one of claims 3 to 6 wherein the low level of the hydraulic fluid in the tank is consolidated: - by comparing a QB value of the level, measured by a level sensor, of fluid in the tank with a threshold SQB and combining the result of this comparison with a logical AND of a minimum level detector QMIN in the sheet when the value transmitted by the level sensor is considered reliable because of the value of a validity signal associated with said level level sensor, or;

using the only information QMIN of the minimum level detector when the value transmitted by the level sensor is considered unreliable due to the value of a validity signal associated with said level sensor.

- Hydraulic system according to one of the preceding claims wherein the control device of the fire stop valve inhibits the FVCF closing signal of the fire valve or valves (311), if said one or more firestop valves have not been closed due to an assumed or identified engine burst, when the aircraft is not in flight and or the pump (10) is depressurized by a voluntary CDP depressurization command.

- Hydraulic system according to one of the preceding claims wherein the control device of the fire stop valve is adapted to generate an opening control signal OVCF of the fire stop valve (311) and authorizes the generation of said opening signal, when the conditions of closure of the fire stop valve (311) have been realized during a flight, only when the engines of the aircraft are all detected at a standstill , that the aircraft is detected on the ground and that the level of hydraulic fluid in the tank is higher than the low level.

- Hydraulic system for aircraft comprising two independent hydraulic circuits (la, Ib) each of said circuits comprising two hydraulic pumps (10a, 11a), respectively (10b, Hb), and the two pumps of the same circuit being driven by motors different propulsion of the aircraft, wherein each hydraulic pump (10a, 11a, 10b, Hb) is associated with a fire stop valve controlled according to a logic according to one of the preceding claims.