FR2598802A1 - MULTIPLEXED JUNCTION PROBE FOR FUEL GAUGE SYSTEM, AND SYSTEM CONTAINING SAME - Google Patents

Abstract

The invention relates to an aircraft air fuel gelling system using the multiplexing of measurements of tank elements 15, 16, 18 in order to improve precision and to locate faults. THE SYSTEM OFFERS DOUBLE EQUIPMENT CHANNELS ALLOWING REDUNDANCY OF ALL DATA PROCESSING PARTS IN THE SYSTEM AND USES INTEGRATED VERIFICATION PROGRAMS SO THAT, IF A FAILURE IS DETECTED, ANOTHER CHANNEL IS SWITCHED IN USE. THE LOCATIONS OF DETECTED FAILURES ARE SHOWN IN THE PILOTAGE STATION AT THE SAME TIME AS THE QUANTITY OF FUEL. THE SYSTEM ALSO PROVIDES THE DISPLAY OF CENTER OF GRAVITY MEASUREMENTS.

Description

The present invention relates to fuel gauging systems for

  aircraft and, more specifically, systems using separate multiplexed junction probes

  in separate fuel tanks.

  Prior art aircraft fuel gauging systems typically employ a plurality of probes in each of the separate fuel tanks that are connected in parallel to produce signals indicative of the volume of fuel in each tank. These probes comprise capacitors which are connected so that their admittance varies linearly according to an analog function of the amount of fuel in the tank. A compensation capacitor in each tank, and fully immersed in the fuel, provides another analog indication which varies with the fuel density, from a predetermined calibration which relates the compensation capacitor to the variations in the fuel. fuel density belonging to a standard range. These signals are sometimes directed to main indicators of the cockpit table, which include various circuits 20 for transforming the analog signals into digital output signals which control cockpit display elements. These signals are also sometimes sent to repeater display elements of the fuel filling door of the aircraft. While the gauging systems of the type described are reasonably accurate for fuels belonging to the standard range for which the compensation capacitors have been calibrated, they are subject to increasing errors with respect to measuring the amount of fuel when other, non-standard fuels are used. The accuracy of these fuel gauging systems depends on the precise knowledge of the type or class of fuel in the tanks. Due to variations in the quality control of fuels provided at some airports and the fact that fuels are refined from new sources of crude oil, there is a much greater variation in the density of current fuels than it was at all. the case when the fuel gauging systems described were designed. The typical variation leads to an error of 3 to 4% for the measurement of the amount of fuel. For example, the DC-10 airliner carries 115 t of fuel; therefore, the maintenance of a reasonable reserve requires the transport of at least 4.5 t of fuel due to possible errors in the reading of the fuel gauging system described, which are due to possible deviations from the calibration. capacitor

normal compensation.

  An improved aircraft fuel gauging system is described in U.S. Patent No. 4,420,976. The system disclosed in this patent contains a densimeter in each of the particular fuel tanks, in addition to the various probes and associated compensation capacitor, to produce a signal indicative of the true mass of the fuel contained in the respective tanks. In addition, the system of this patent incorporates a signal processing apparatus which is connected between the fuel tank probes and the fuel quantity display elements to produce display readings as a function of signals from the fuel tanks. tanks. This signal processing system produces double-channel component duplication (allowing redundancy) over most of the signal path and contains a standard electronic module (SEM) mounted in the vicinity of the central connections to the fuel tank probes and having suitable stages of conversion, processing and multiplexing of duplicate signals, dual data buses ranging from standard electronic module to cockpit and fuel filler panels, and receiving and processing stages respectively. double-channel signals at the cockpit table and a dual-channel signal receiving facility at the filler flap. A multiplexer is connected to receive signals from the probes and the compensator in each tank and to apply these signals in multiplexed form to an AN (analog-to-digital) converter which provides a digital output signal to a microprocessor . The microprocessor applies a data stream, corresponding to the digital signals, to signal buses respectively driving

  on the cockpit board and the filler hatch.

  Each data bus is a single shielded twisted pair of conductors. In the display elements, each signal path includes a data receiver connected to the incoming data bus for producing an output signal to a demultiplexer which outputs the demultiplexed signals to devices.

  display control and associated stages of signal combinations. We will refer to this patent for a description more

  Detailed. In the prior art systems which utilize junction probes or similarly operative devices which connect in parallel to several separate tank units in respective fuel tanks, the difficulty of isolating failures of the tank components and the concomitant process of finding fault causes is a major and costly maintenance problem. To locate tank component failures that would significantly reduce the time and cost of maintenance, it would be necessary, in the system of the cited patent, to provide for the individual connection of each tank unit and compensator with each other. the signal processing unit. Such an approach would result in a significant increase in wire terminations and would also increase the weight of the wiring, means

  supporting the wiring and associated connections and bushings.

  It will be understood that each particular instrumentation system component installed on an aircraft represents an increase in the dead weight, evading the aircraft's load carrying capacity. Thus, each of the particular units of the fuel tanks, which are not unique in each tank, represents added dead weight; this weight factor increases from that of the associated wiring, mounting brackets, etc. that are required for each of the probes. In addition, in known prior art systems, the failure or inaccuracy of a reading by a single tank unit affects the accuracy of reading the fuel amount of the entire tank. The system of the cited patent contains a particular circuit for detecting such inaccurate readings and providing an indication of failure to the cockpit display elements. The present invention represents an improved fuel gauging system relating to the fuel system.

  gauging of the true multiplexed mass of the prior art.

  Many of the conceptual considerations and particular aspects of the known patented system are incorporated in the invention, and the present invention represents an extension of its conceptual philosophy by the addition of features which provide simplification, weight reduction, reliability improvement, an increase in the information presented at the cockpit mechanic table and at the level of the filler door display elements for the circuits and components, and the invention reinforces the general capabilities of the system. While the invention is described in the context of an aircraft fuel gauging system in which a multiplexed junction probe is used to combine data signals from multiple sensor units within a tank It will be appreciated that the principles of the invention can be applied to other equivalent fuel measurement configurations, such as, for example, a multiplexer which is associated with tank units in a different configuration than the configuration of the probes. at junctions. Such a multiplexer may be in the form of a multiplexing unit which is installed inside a fuel tank or at a certain place outside the tank (for example a multiplexed partition crossing) to which electrical connections from the different tank units are conducted for multiplex signal processing along the lines

  functional procedures described below.

  According to a particular aspect of the invention, one or more multiplexed junction probes, or functionally identical devices, are disposed in each of the fuel tanks in order to avoid the need to run separate cables for each particular unit of the tank. between the tank probe and the signal processing unit. This multiplexed junction probe is designed to be substantially materially and electrically compatible with existing tank junction probes so that it can be

  replace junction probes on current aircraft.

  The multiplexed junction probe incorporates a signal modulator that transmits data, in serial form, corresponding to the states of the particular components of the reservoir via the existing unified three-wire cable. In case of failure of a particular component of the tank, the signal of that particular component is missing in the sequence of the signal data stream and is therefore not

  collected by the signal processing unit. As a result, the signal processing unit 15 activates a fault warning circuit to display the identity of the failed component.

  According to another aspect of the invention, the system provides a dynamic control of the center of gravity (CG) of the aircraft.

  This is based on the center of gravity in the absence of fuel (ZFCG) and the center of gravity due to the fuel. The center of gravity of the fuel is determined by its mass and its position (moment arm). Separate reservoir units, which are sequentially controlled by the multiplexed junction probes, provide information on the amount of fuel (mass). The data stored in a system memory, which is determined from the curves giving the fuel height as a function of

  volume, is used to give the moment arm information.

  These signals are processed in the signal processing unit, and a resulting display is realized in the cockpit in analog form (bar graph) and in digital form for

  indicate the location of the center of longitudinal granite of the aircraft.

  This system also provides a lateral imbalance warning signal to alert the crew of a fuel imbalance situation between the wing's symmetrical tanks, so that action can be taken to pump fuel.

  from one tank to another to correct the imbalance.

7 1 - - '

1: -, -1

-. k. -1

- -,

  The following description, designed as an illustration of the invention, is intended to provide a better understanding of its features and advantages; it is based on the appended drawings, among which:

  Figure 1 is a schematic diagram showing the layout of fuel tank components of the -X r system; fuel gauging of the patent cited above; FIG. 2 is a side elevation, partly in section, showing the structural configuration of a multiplexed junction probe according to the invention; At 000: 0 - Figure 3 is a simplified block diagram -; / 'of the multiplexed junction probe of Figure 2; Fig. 3A shows a typical interconnection of two multiplexed junction (or MJP) probes of Fig. 3 in a master-slave configuration; FIG. 4 is a block diagram showing a particular arrangement of the multiplexed junction probe fuel gauging system according to the invention; FIG. 5 is a block diagram of the standard electronics module (SEM) of the system of FIG. 4; FIG. 6 shows waveform and timing sequences that are applicable to the fuel quantity data processing of the system of the invention; FIG. 7 is a block diagram of the intermediate device of the system of FIG. 4; FIG. 8 is a diagram showing the face of one of the fuel quantity display elements used in the system of FIG. 4; Fig. 9 is a simplified block diagram of the circuit of the fuel quantity display unit of Fig. 8; FIG. 10 is a diagram showing the face of a display unit of the amount of fuel and the center of gravity that is used in the system of FIG. 4; FIG. 11 is a simplified block diagram of the circuit of the fuel quantity display unit and the center of gravity of FIG. 10; Fig. 12 is a view showing the front panel display element for the display and load selection unit (LSDU) belonging to the system of Fig. 4; and Fig. 13 is a simplified block diagram of the LSDU of Fig. 12. Fig. 1 shows schematically the typical layout of various tank components of the fuel gauging system of US Patent No. 4,420,976. above cited. In the diagram of Figure 1, the wing of the aircraft 10 is shown as separated by partitions 12 and 13 into three separate tanks, a left main tank, a right main tank and a central wing tank. Each of the reservoirs is shown as containing a junction probe 14

  to which are connected a plurality of separate tank units 15 constituting level measuring capacitors which are dispersed in the associated tank. In addition, each reservoir contains a compensation capacitor 16 connected to its junction probe 14.

  In FIG. 1, the separate tank units 15 and the compensation capacitor 16 of a given tank are all connected in parallel to the associated junction probe 14, from which the wiring leads from the wiring to a piece of equipment signal processing (not shown). In addition to the junction probe 14 and capacitors 15 and 16, each tank also includes

  a densimeter 18, from which wires depart to be connected to the signal processing equipment.

  Since the capacitors 15 and 16 of a given reservoir are connected in parallel with the associated junction probe 14, it is impossible for the signal processing equipment associated with this system to determine which particular component of the reservoir could fail, even though the existence of a failure may sometimes be detected from the variation of the total capacitance of the reservoir component from the known correct range of values. The location of the failure is a relatively long extraction process that involves physically disconnecting each capacitor 15 or 16

  vis-à-vis the probe junction 14 to check them one by one.

  In systems according to the invention, the so-called passive junction probes 14 of FIG. 1 are replaced by multiplexed junction (MJP) probes according to the invention. The MJPs are interchangeable directly with the corresponding passive units, with respect to form and mounting. Differences

  Minor wiring is absorbed into the wiring harness "contained in the tank.

  A similar multiplexed junction probe 20 is shown in FIG. 2, and its corresponding circuit configuration is represented by the block diagram of FIG.

  As shown particularly in FIG. 2, the junction probe 20 has a main housing 22, from which a hollow cylindrical mounting tube 24. A strain relief carrier 26 is disposed at the free end of the mounting tube 24. respective pluralities of high junction terminals (Hi-Z), low junction terminals 32 (Lo-Z) and interconnection junction terminals 34 are shown as being mounted on the mounting tube 24. The Case 22 is provided with an externally extending ring 40 and a flange 42 for mounting in the opening already provided in the tanks of the presently existing aircraft for the junction probes 14 of FIG. 1. O-rings 44 are mounted on the ring 40 in order to ensure the seal at the opening with respect to the probe to

  junction 20 mounted in the opening.

  When a multiplexed junction sensor 20 is installed in a fuel tank, particular units of the tank, such as a fuel quantity measuring capacitor 15 and the compensation capacitor 16, are connected between the respective Hi-Z terminals. 30 and Lo-Z 32, shown in FIG. 2. Separate connection wires then run from these respective terminals 30 and 32 through holes (not shown) which are provided in the mounting tube 24, and following the interior thereof to the circuit of Figure 3, which is placed inside a central chamber 46 of the housing 22. This chamber 46 is hermetically sealed by a double O-ring and contains the various electronic components appearing in the schematic diagram of FIG. 3. The connections between the wiring of the various components of the tank and the circuit contained inside the chamber 46 are effected by the intermediate Cross-linked interface connectors 48, as well as internal circuit connections to the cables passing along the hole of the tube 24 and, outwardly, to the interconnection junction terminals 34. internal wiring harness to the tank are fixed in the strain relief holder 26 and

  extend to the terminals 34 to form the connections to the junction probe 20.

  As shown in the simplified block diagram of FIG. 3, the multiplex junction sensor (MPJ) 20 includes a synchronization and control stage 50 which is coupled to provide signals to a Hi-Z controller 52. and a multiplexed current-to-voltage (I / V) converter 54. These signals are generated in synchronism with an input clock signal from a standard electronics module (SEM), shown in FIG. synchronization and control stage 50 produces a triangular excitation signal which is applied to the

  Hi-Z controller 52 in response to each clock signal.

  Corresponding timing signals are also applied to the multiplexer 54, which selects the particular Lo-Z line 32 to be measured and converts current signals to voltage signals for the purpose of measuring the capacitance of each particular component of the tank (the units 15 and the compensator 16 of the tank) in sequence. The resulting voltages are encoded by the converter 54 and are applied to a transmission line control device 56 which outputs the voltage signals as an analog data stream to the SEM. A power supply 57 provides regulated power to

  components in the multiplexed junction probe 20.

  The synchronization and control stage (or T / C stage) 50 receives the synchronization signal produced by the SEM and uses this signal to increment a counter contained in the T / C stage. The counter output signal is applied to the device

  Hi-Z 52 as well as the multiplexed I / V converter 54.

  The T / C stage 50 further comprises a circuit for repositioning its counter in response to a periodic pulse burst appearing on the input clock signal line 34a for

SEM synchronization.

  the Hi-Z controller 52 is an integrator

  which responds to a square wave input signal and produces an output signal for controlling the Hi-Z side of all elements 15 and 16 of the tank. This Hi-Z control signal is a triangular wave of about 16 V peak-peak of a frequency of about I kHz, which is used to excite all elements of the tank.

  The converter 54 multiplexes the Lo-Z input signals of all the elements of the tank and produces a corresponding output voltage signal. When the counter of the T / C stage 50 is incremented, the signal Lo-Z of each element 15, 16 of the reservoir is transformed, in turn, from the current signal state to that of the voltage signal and is outputted to the output of the converter 54. Accordingly, the capacitance information of all tank elements is encoded as an analog data stream and is applied to the transmission line control device 56. In addition to the signals of the separate units and the tank compensator, the converter stage 54 also produces a representation of the Hi-Z waveform used by the SEM to produce an automatic correction.

of gain.

  The multiplexed junction probe 20 may be wired in two different configurations, using two different versions of adaptation to the conditions imposed on an aircraft. Both versions are based on the same platelets of

  printed circuit, the difference between the two arising from the insertion or removal of particular circuit components.

  The two different configurations of the system are the "14-input MJP" configuration and the configuration

  "Major MJP (or mistress) with 14 entries". The 14-input MJP provides the ability to code up to 14 tank elements into an analog data stream, and to transmit either the SEM data or a 14-input master CPM (or master).

  1 m _ When used together, the main 14-input MJP and the 14-input MJP operate in masterclone configuration. According to this combination, the 14-input main MJP receives a data stream from the 14-input MJP used as a slave, or slave. The 14-input Main MJP encodes its 14 updated tank elements on the data stream received from the slave MJP and retransmits all data to the SEM. This master-slave configuration allows the existing positions of a single probe to junction the main tank and a single probe to junction of the peak tank are retained, while simply the type of the junction probe is changed and wires power supply are added, as necessary, to ensure a proper fit

  retrospective with a given aircraft.

  Such a combination is shown in Figure 3A, which shows a slave MJP 20a connected to a main MJP 20b, which is itself connected to the SEM 60. Each MJP unit is connected to an associated plurality of units 15, 16

  of tank and operates in connection with units 15 and 16 and SEM 60 as shown in FIG.

  When using a master-slave combination, the data stream from the transmission line control device 56 of the slave unit is applied to a slave receiver 58 in the main unit via a shielded twisted pair of lead wires. 34d, this unit in turn applying the data stream to its transmission line control device 56 for combination with the transformed signals from the

converter 54.

  The analog data stream from the output of the transmission line control device 56 is

  applied along the cable 34c formed of a shielded twisted pair.

  This data stream is a variable amplitude square wave in the form of pulse amplitude modulation (PAM), where the amplitude of each pulse is directly proportional to the capacitance measured for a 15 or 16 unit. of the tank, as a function of time, in addition to the representation of the waveform: :: S <:! :,,: -: 0: - ",,: EX. 7>; 10

,>

. k. :: D. M .:

- -: 20

  . D:,: - R: s 0 30 k R - k .. f ^.

0 35

-E -:: K

  Hi-Z used to correct the system gain. The controller 56 is a balanced differential amplifier having a source impedance that is approximately equal to the characteristic impedance of the shielded twisted pair cable 34c. This circuit provides immunity against cable load problems, low radiated emissions, and fast response.

  The input clock pulse from the SEM is placed on a coaxial shielded wire 34a which terminates on its characteristic impedance at the multiplexed junction probe of Fig. 3. The receiver associated with these clock pulses is isolated by a transformer to provide noise immunity, DC current isolation and lightning protection.

  The output data stream of the device 56

  transmission line control of a master-slave combination (Figure 3A) incorporates 14 data pulses, an automatic calibration signal (auto-cal), 14 additional data pulses, and a final self-calibration signal . When using a single 14-input MJP, only the first 14 data pulses, an auto-reset voltage, and an auto-calibration signal are provided. The waveform of the data stream is shown in Figure 6, described below.

  Figure 4 is a block diagram showing the general system according to the invention. It is shown to include a plurality of multiplexed junction (MJP) probes associated with various units and compensators 15, 16 of various fuel tanks of an aircraft. In the system shown in FIG. 4, the fuel tanks comprise reservoirs RES1, RES2 and RES3, a central wing auxiliary tank RAAC, a front tank RAV and a rear tank RAR. MPJ pairs 20, interconnected as shown in FIG. 3A, are indicated as master-slave combinations in each of the reservoirs RES1, RES2 and RES3 and in the central wing auxiliary tank RAAC. Density meters 18 are placed in all tanks, except reservoirs RES1 and RES3. Since reservoirs RES1, RES2 and RES3 are commonly used and filled together, a single densimeter is considered suitable for the fuel of these three tanks. Connections between the MJP 20 and the standard electronics module (SEM) 50 are made via lead wires 34. Lead wires 35 connect the densimeters 18 to the SEM 60. These densimeters are described in US Pat. 420,976 above cited; typical units may be obtained commercially as "Type 7824 Avionic Liquid Densitometer" from "Solartron Electronic Group Ltd." from Great Britain. An intermediate device 62 acts as an interface between the SEM 60, the switches 64 of the mechanic board and the various devices 66 for displaying the amount of fuel, as well as the display device of the center of gravity 68, which are placed on the mechanic's board in the cockpit. In addition, block 69 of FIG. 4 is the display and load selection unit (LSDU) which receives input signals from the

  part of the standard electronic module 60. Further details on the LSDU are described below in connection with FIGS. 12 and 13.

  Fig. 5 is a block diagram showing the components that make up the SEM 60. As indicated, the SEM 60 comprises two channels A and B, which are identical with respect to the nature of the components and the circuit realization, in the goal

  to produce perfect circuit redundancy for SEM 60.

  Each channel (channel A is shown in detail) comprises an analog circuit 70, which receives the data streams from the respective MJPs via shielded twisted pair conductive wires 34 and samples these analog signals to produce voltages. Numbers of tank units which are intended to be applied to an associated microprocessor-controlled digital circuit 72. The densimeters 18 are connected to the digital circuit 72 via the conductive wires 35. Each channel also contains a power supply 74 which is supplied by the main power supply of the aircraft (115 V AC at 400 Hz) and which delivers appropriate voltages to the analog circuit 70 and the digital circuit 72. Each channel has two output buses, an output bus 80 going to device!

. 14

  intermediate 62 and an output bus 82 to LSDU 69, with respect to channel A, and a return bus 84 carrying

  loopback signals from the intermediate device 62.

  The digital circuit 72 includes a fixed memory 5 (ROM) which stores programs and a random access memory (RAM) which stores digital volume measurements which are obtained from the voltages supplied by the units of the tank with the aid of analog circuit 70, as well as the information relating to the input signals of the densimeter. The digital circuit 72 calculates the true mass of the fuel, the center of gravity (based on fuel mass, fuel position and center of gravity in the absence of fuel), and center limits. gravity (based on the overall weight of the aircraft), and transmits the corresponding data to the intermediate device and the LSDU for display on various display units. The digital circuit 72 also controls the integrated verification (BIT) of the entire system to detect possible failures and provide corresponding indications.

  on the cockpit display.

  Figure 6 shows the sampling of waveforms of the various signals representing the amount of fuel and timing pulses that control the synchronization of the data for digital formatting. The upper waveform of FIG. 6 represents the received data, plus the self calibration signal superimposed thereon. The upper waveform of FIG. 6 is sampled at points V1, V1A, V2, V2A, ..., V14A,

  V15 V15 V16 and V16A, as indicated on the waveform.

  The lower waveform of FIG. 6 represents the series of clock pulses which synchronize the data and which, in response to a clock burst appearing at the beginning of a clock pulse.

  clock pulse chain, start the signal sequence.

  The signals from a MJP 20, corresponding to the upper waveform of FIG. 6, are applied to the analog circuit 70 of the SEM 60 and are digitally transmitted by sampling at the indicated points. in Figure 6, the

  : .. sampling signals being delivered to the digital circuit 72.

  The circuit 72 processes the samples put in digital form according to a selected algorithm. This algorithm uses the data extracted from the inputs 1 to 14 (as needed) representing the capacities of the tank units and the capacitance (reference) of the compensators as a function of the typical data stream coming from the circuit of FIG. executed in the microprocessor controlled digital circuit 72, substantially

the manner presented below.

  At the beginning, a self-calibration term, k ac, is derived from measurements V15, V15A, V16 and V16A sampled during the interval of the self-calibration signal which is indicated in FIG. Equation (1) k V15 V15A + V16A V16 k ac 2 0 k2 is a proportionality constant which is stored in the microprocessor memory. This value ka is used ac to eliminate any errors or initial drifts of the analog part of the measuring equipment, as this could result from temperature variations, aging of the

  components, etc., as well as to neutralize the effects of automatic re-calibration of the measuring equipment.

  Then, a VT term is calculated according to equation (2) to eliminate DC offset.

  which exists in the tank signal measurements (as shown here for 13 tank units), and to provide an electronic summation of the tank unit signals.

  VT V1A + V2A + V3A + ............ V13A

-V1 - V2 V3-V13 (2)

  the terms VnA and Vn are sampled voltages, which are put in numerical form at the corresponding points of FIG. 6. These are values representative of the capacitance values of the

  particular units 15 of the tank.

  Similarly, V is calculated as a function of R Equation (3) to eliminate any offset due to direct current in the compensator measurements (as shown for a single reference / compensator unit 16)

VR = V14A -V14

  o V are sampled voltages put in form

  numerically at the points shown in Figure 6.

  Then, the values V and V as produced by the equations (2) and (3), are multiplied by the calibration coefficient k of equation (1) to establish the capacitance CT acT of the equations (2) and (3). Tank units and reference capacity CRCT V k (4) CT = T ac C Vk <5 RR ac Since the system uses profiled reservoir units, a factor x, which is defined as a normalized fuel volume (0 x - 1), is associated with the CT capacity of the tank units and with the reference capacity CR by the following equations (6) and (7) CT = C + C (K-1) x (6)

T A E

CR = CRA + CRE (K-1) (7)

  o C and C are constants that are stored

CA 'CE' CRA CRE

  in-The memory of the microprocessor and are defined as follows CA is the sum of all the capacities in the air of the units of the tank; CRE is the effective capacity of the reference unit; CA is the air capacity of the reference unit; RA C is the sum of the actual capacities of the tank units; summer

  K is the dielectric constant of the fuel.

  By combining equations (6) and (7), we can express x in the following way

(CT A RE

x = (C -CR) C (8)

R A E

  The normalized fuel volume x is then used to determine the mass of the fuel by the following formula M = x. Flight. d (9) where M is the mass of the fuel; Vol is the total volume of the tank; d is the fuel density, which is determined by the

hydrometer 18.

  The various tank members of the multiplex junction sensor system are designed so that the error in the M term which is due to any measurement error of d in the typical tank is less than 0.1% of the mass. fuel tank full. This is an extremely accurate measure of fuel mass and represents an improvement

  an order of magnitude compared to any known fuel gauging system.

  The MJP tank data, designated V1 to V13, is used by the SEM to determine the fuel surface plane in each tank at the intersection of at least three adjacent tank units. The actual position of the aircraft is then determined from the relationship

  between the fuel plane and the reference plane of the wings.

  This approach includes the effects of acceleration on fuel to provide a proper correction of the fuel gauge reading. This actual attitude correction is then applied by the SEM to the particular lookup tables which are stored in its permanent memory in relation to the

  fuel mass M above calculated using Equation (9), to obtain a fuel mass corrected for the effects of the attitude and to obtain a greater accuracy for the fuel reading.

  The output data 80 and 82 of the SEM each have a transmitted data bit which is sent according to the following parameters in the FSK PDM format (frequency-offset coded modulation). The data is updated by the SEM about every 2.0 s. Thus, a data stream of 2 s includes a first transmission followed, after a time lapse of 250 ms, by a second transmission consisting of 104 bits. Transmission n consists of eight data words, each consisting of four characters DCB (binary coded decimals). The eight data words are in order of synchronization n 1, total fuel (with the leading zeros in white), tank 1, tank 2, tank 3, tank 4, tank 5, Y tank 6, and total fuel (y including the first zeros for the calculation of the gross weight). In this embodiment, the tanks 4, 5 and 6 respectively correspond to the central auxiliary tank, the front tank and the rear tank. Word

  Synchronization No. I is transmitted in the form 000000000011.

  Each tank word and the total fuel data words are transmitted in the order from the least significant bit of the least significant digit to the most significant bit of the most significant digit. Each of the data words of the total fuel and tanks I to 6 incorporates a first zero in white, which is made by transmitting the hexadecimal F character (1111) for

all the missing zeros.

  In transmission No. 2, a synchronization word No. 2, transmitted in the form 00001011, is followed by six data words associated with the six particular tanks. The synchronization word n0 2 is the only word of 8 bits. The tank words each have 16 bits (four DCB characters). No blank headers

  is not used in transmission # 2.

  The entire data stream, i.e. both I and 2 transmissions, is sent to the intermediate device and the LSDU. However, the intermediate device uses only the transmission n 1, which is identified by the synchronization word. The LSDU uses the No. 1 transmission to produce a fuel quantity reading and the No. 2 transmission to drive the preselected automatic isolation system. Transmission No. 1 is produced by the SEM microprocessor from the measurement data. The SEM microprocessor produces transmission n 2 from transmission n 1 before sending both transmissions. Each group of reservoir data of the transmission n 2 is shifted by a predetermined amount (for example 10 + 50 kg) with respect to the corresponding data group of the transmission n 1 in order to compensate the response time of the valves of the transmission system. automatic isolation. No blanked leading zero appears during transmission n 2. Blanking occurs for

  the four characters of a defective tank data word 15 of the transmission n 1.

  All data is transmitted as FSK encoded signals. A logical level bit 1 consists of a reference mark of 600 4s followed by a space of 200 gs. A logical zero is represented by a mark of 200 g followed by a space of 600 Lis. In each case, the bit duration is 800 ps. The marker time is transmitted at 64 kHz, while the space time is transmitted at 48 kHz. The information is transmitted in the form of data words comprising four binary coded decimal characters (BCD). These characters correspond to the following table, the bits being represented in the order of the least significant bit to the least significant bit.

  more significant, from left to right.

TABLE I

DCB 1: 1000

DCB 2: 0100

DCB 3: 1100

DCB 4: 0010

DCB 5: 1010

DCB 6: 0110

DCB 7: 1110

DCB 8: 0001

DCB 9: 1001

DCB 0: 0000

(hex) F: 1111 - r, 1

1, '-.

1 1. 1 M '..,

  _ 20..DTD: The hexadecimal symbol F is used to denote ..; -White; thus, where initial zeros in the form of white are indicated, a hexadecimal symbol F is transmitted for each zero

- -: of head.

  A number of advantages are derived from using this FSK PDM format. By using frequency shift coding (FSK), abrupt transitions occurring during pulse transmission are avoided. Thus, electromagnetic interference filters can be used to minimize electromagnetic interference and the signals can be transmitted in a balanced configuration by means of transformer coupling. The balanced signals are sent over pairs of twisted wires, each pair being surrounded by an electrostatic shielding braid. This braid is preferably grounded at multiple points to minimize electromagnetic interference. Multi-point grounding is made possible by the use of balanced signal transmission over the twisted pair. The FSK coding makes it possible to use paired signals by an AC transformer (input and output data signals), which allow multiple grounding of the lightning shields. Moreover, since pulse duration modulation (PDM) is used, there is no need for a synchronization clock signal and the interconnection is therefore

simplified.

  Duplicating all the components of the dual channels A and B provides complete redundancy in the SEM 60. This redundancy allows the system to return to normal operation after any single failure of the SEM by channel switching. redundant (backup). The true mass, center of gravity and center of gravity limits, which have been calculated in the digital circuit 72 as described above, are transmitted to the intermediate device and the LSDU. The correct transmission to the intermediate device, in view of the display in the cockpit, is verified by the use of the loopback using the return bus 84 coming from the intermediate device. All the data of the SEM 60 is transmitted using the FSK PDM format, and the return bus 84 contains the bump transmission also in the FSK PDM format for the BIT verification, and also contains additional data from the cockpit , such as the weight in the absence of fuel and the center of gravity in the absence of fuel. Within each channel of the SEM 60, the analog circuits 70 and the digital circuit 72 are electrically powered by a corresponding power supply section 74. The electrical supply of each channel is put into operation by a channel selection switch which is placed on the mechanic's board. The unselected channel is usually not electrically powered and serves as a backup channel. Among the possibilities offered by the integrated verification, the SEM 60 has a power-up test which temporarily powers the redundant channel for the purpose of verifying the application of a

power supply.

  Details of the intermediate device 62 are shown in the block diagram of Figure 7. Like the SEM 60, the intermediate device 62 also includes channels A and B, which can be selected from switches 64 of the mechanic's table. Channel A of the intermediate device 62 is shown as comprising a microprocessor-controlled digital circuit 90 and a power supply 92 (channel B being identical to channel A). The microprocessor-controlled digital circuit 90 receives data via the corresponding bus A 80 from the SEM 60 (FIG. 5) and sends these signals back to the SEM via its return bus A 84 for verification (which corresponds to the "loopback" procedure described above), along with additional signals representing information applied from the mechanic's board. The digital circuit 90 includes circuitry for separating the received data and routing it to the appropriate fuel quantity display units (FQDU) of the cockpit in the PDM format via delineate excitation devices protected against failures of the output circuit 94. The power supply 92 provides regulated power to the circuitry of the intermediate device 62 and also provides power to the cockpit fuel quantity display devices and the control units. display of center of gravity, gross weight and total fuel via the output circuit 94. The permanent memory of the circuit 90 retains the intermittent failures that can be detected by one test until they are cleared by a

  BIT repositioning switch of panel 64.

  The SEM 60 and the intermediate device 62 include important BIT equipment to confirm the correct operation of the system and to locate failures to a replaceable line unit (LRU). The BIT tests include an electrical check,

  operator initiated checks and continuous automatic checks.

  During the electrical check, the two channels of the SEM and the intermediate device are electrically connected. SEM performs cross-channel tests

  Automatically, the SEM transmits first from the unselected channel and then from the selected channel.

  During these transmissions, the intermediate device 62 confirms the existence of transmissions from the SEM 60, carries out a cross-channel check on itself, and verifies the transmission of data to the display units of the cockpit. When an error is detected, a BIT flag is written to the permanent memory to indicate which unit has failed. The transmission of the SEM on each channel input is checked to confirm that the data is in the expected format and that it arrives at the correct intervals. A failure updated by this check sets a BIT flag

  on the channel considered, the SEM A or the SEM B. Cross-checking tests are carried out inside the intermediate device in the following manner. The two channels A and B are turned on when a BIT check initiated by the operator is activated.

  The outputs of the SEM connected to the intermediate device 62 are

- 1 1

  disconnected and the two channels of the intermediate device are connected to a BIT generator. The selected channel processes the test input signal, delivers the results to the display units 66 and 68 and the unselected channel, and then checks the output signal of the unselected channel. In the same way, the unselected channel cross-checks the selected channel by comparing the results of the unselected channel with those of the unselected channel.

  selected channel (using the same test input signal).

  In the event that a fault is detected, a BIT flag is set in the permanent memory. The output signals of each display control device of the display units 66 and 68 are compared with the transmitted data. Errors are recorded as intermediate device BIT flags designating the channel in question. Loopback data from each display unit 66 and 68 is read and compared with the transmitted data. The existence of differences causes the positioning of a display BIT flag for the affected unit. During the start-up test, all BIT alarms are put into service. Once the test is completed, all 20 BIT alarms are disabled, except for those with a flag

  BIT was positioned during the test.

  The triggered BIT check starts from the cockpit when the operator depresses the cockpit BIT check trigger switches to locate a fault on a replaceable line unit. Turning on the system test switch initiates two tests, the intermediate device test, followed by the SEM test, to locate a fault on the intermediate device or SEM. When a triggered BIT operation is initiated, the power supply is applied

  to the unselected channel of the SEM and the intermediate device.

  The system test is for both channels, after which the power supply is no longer supplied to the backup channel. The existence of a failure detected in the spare channel is stored in the memory relating to the selected channel and

  is displayed on the appropriate fault warning device 104 or 172.

r: r 10

  Thus, the system test checks the two channels of the SEM and the intermediate device. During the testing of the intermediate device, the SEM signal ceases to be applied to the intermediate device, and a BITE code generator injects a BIT code into each channel of the intermediate device. The channel of the selected intermediate device then distributes the data on the display units 66 and 68 and causes the output signals to be looped for verification. After first verifying that all display units pass the display test, the incorrect results that are then detected locate the fault on the intermediate device. The unselected channel of the intermediate device is cross-checked with the selected channel. After a lapse of 3 s after the intermediate device test, the intermediate device reconnects the SEM, and the SEM test is triggered automatically.

  The intermediate device continuously monitors transmissions of the SEM in the automatic BIT mode to ensure that they arrive at reasonable intervals. Failures are recorded as BIT flags of the SEM A or SEM B. Loop PDM data from the display units is routed via the return bus 119 and is compared in the intermediate device with the data that has been transmitted. . Errors are recorded as display BIT flags for the affected unit.

  One of the fuel quantity display units 66 is shown in FIG. 8, and a block diagram showing its circuit is shown in FIG. 9. On the mechanic board located in the cockpit, are mounted six identical fuel quantity display units 66, such as the unit shown in FIG. 8, which may be externally programmable for use (reservoirs RES1, RES2, RES3, RAAC, RAV, RAR) . These display units indicate the mass or density of the fuel of the tank in question. (The density display is selected by momentarily depressing a spring-loaded switch on board 64.) Referring to FIG. 8. The front side of the display unit 66 is provided with an element. liquid crystal display (LCD) 101 for displaying a six-digit group 100 showing which tank is indicated and which measurement is made, as well as fault alarms 104. For example, when the numbers 100 are brought to indicate the quantity of fuel, the legend "LBS" (for pounds) or "KGS" (for kilograms) lights up, together with the expression "FUEL QTY" (for quantity of fuel). Alternatively, if the numbers 100 give a reading of the fuel density, the captions "FUEL" (for fuel) and "LBS / GAL" (for pounds per gallon) or "SG" illuminate. Illuminates also the designation of the particular tank, namely "1" (for RES1), "2" (for RES2), "3" (for RES3), "CW" (for RAAC), "FD" (for RAV), or "AFT" (for RAR). During the operation of the integrated verification equipment, the legend "BIT" illuminates and, if a fault is detected, it is indicated on the fuel quantity display unit 66 by the illumination of the engine. one of the segments 104 designating the particular unit that has the detected fault ("J PROBE" (for junction probe), "M" (for master), "S" (for slave), "COMP" (for compensator), "R" (for right), "L" (for left), "DENS" (for densimeter), "SEM", "A" or "rB", 20 "ID", "A" or "B" (for intermediate device A, B or common), "DISP" (for display), or "PWR" (for switching on the display)). Thus, the fuel quantity display unit 66 offers the possibility of indicating a detected fault in any of the 16 tank units, either for the master or slave junction probe, the A and B channels of the SEM, channels A and B of the intermediate device, the right or left compensator, the densimeter, and the display itself. There is a legend "UNBALANCE" (for imbalance) 106 that illuminates to indicate the detection of a lateral imbalance of the fuel between the reservoirs RES1 and RES3. The "pF" (picofarad) designation in the 102 group illuminates when either unit capacity or tank trim values are displayed on the FQDUs (fuel quantity display units). It is thus possible to display simulated capacity values from a test equipment of a ground installation 35 so that a maintenance operator can compare the actual capacity value, in picofarads, with a value of one. specification chart, or may also display the actual values of the capacity of the units and the tank trim of the aircraft. As shown in the functional block diagram of FIG. 9, the fuel quantity display unit 66 has a single cable 120 which carries the input data from the intermediate device 62. These are delivered to a pair PDM receiver 122 produces a pair of output signals to a block 126 containing temporary storage shift registers, one for

  display the indication of the mode / and the other the storage of data.

  These excite a pair of LCD control devices (display

  128 and 129). The LCD controller 128 activates a six-digit display 100, shown in FIG.

  The LCD controller 129 activates the usage display

102 of Figure 8.

  Similarly, the PDM receiver 124 provides a pair of output signals to a block 130 which is a shift register for storing fault indication data. Block 130 provides signals to an LCD controller 132 which is coupled to the failure alarm section 104 of the display unit. A PDM transmitter 134 receives data signals shifted from the blocks 126 and 130 through an OR gate 136 and sends back signals to the intermediate device via a return bus 138 for verification according to a loopback function. A BITE generator 140 is coupled to the PDM receivers 122 and 124 to energize the display unit 66 upon receipt of a display test input signal via the line 142. An illumination element 144 The display and voltage regulators 146, the latter supplying power to all the blocks within the display unit 66 as required, receive external input signals from the controller. intermediate device. In addition to the BITE generator 140, the unit contains an additional BITE circuit 148 for detecting display failures and for energizing fault detectors 104. A heater 150 and a temperature switch 152 are associated with the LCD display. to allow the best response times for low ambient temperatures. The display used in the fuel quantity display unit 66 is a phase change dichroic type liquid crystal display. Markers, horns and characters are white

on a black background.

  Providing two PDM receivers 122 and 124 and two shift registers 126 and 130 creates redundancy for displaying the detected failures. The second path, passing through the shift register 130, displays as a display failure a failure appearing in the register.

with shift of use 126.

  The BIT display is in the form of black letters on a white field, with black and white markings in a "barber shop sign" and is visible, when illuminated, to indicate a signal malfunction. The location of the fault in the group of marks 104 is displayed at the same time as the display BIT 108 to facilitate identification of the fault. A power-on test is performed by the system to determine if both channels are working properly when the power supply is first applied. The power-up test uses fixed simulated input signals that are applied to the system to verify its proper operation. The two channels A and B of the SEM, the intermediate device, and the LSDU are temporarily switched on and cross-checked. Automatic BIT tests are also performed, as described above. If everything is working within the set tolerance limits, the power-on test turns on all segments of the display for about 15 seconds. This allows the mechanic to confirm that the system is working properly and that all segments of the display are working. The unselected channel is then disconnected at the end of the set-up test.

electrical circuit.

  The automatic BIT check of the FQDU 66 is carried out continuously by looping on the intermediate device as well as

1: 1-

  1. li by the additional BITE circuit 148. The data which is received from the intermediate device via the line 120 undergoes a parity check in the PDM receivers 122 and 124, then

  are shifted in the respective shift registers 126 and 130.

  When a new piece of data comes in, an old piece of data comes out and is returned, in loopback, on the intermediate device via the return bus 138 in the PDM format to be checked. The intermediate device verifies that the data received on the bus of

  back are the ones that were sent in the previous block of 10 data.

w

- j -

  The fuel quantity display unit 66 also includes an additional BITE circuit 148 for detecting (1) parity errors of the received data, (2) if

  the power supply 146 is out of tolerance, and (3) if the intermediate device stops the data delivery.

  The occurrence of any of the foregoing states causes the circuit to activate the appropriate BIT 104, to alert the mechanic as well as modify the loopback data to reflect the detected fault. This failure signal is emma20 gasined in the intermediate device and is retransmitted to the unit

  display 66 just like any other failure.

  This is done to alert the mechanic in the case where occurs

  an intermittent failure canceling itself.

  The triggered BIT checks begin when the operator depresses a display test switch placed on the mechanic board 64. When the display test line 142 is turned on, all the quantity display units are turned on. fuel 66 start the display tests. During the display tests, the data input of the PDM receivers 122 and 124 having taken the line 120 is disconnected and the BITE generator 140 is connected to an input of the display unit. The generator BITE 140 simulates an input signal of the display unit which activates all the display signals. The display unit 66 remains in the digit test mode as long as the display test switch 35 remains depressed up to a maximum of 60 seconds.

  after which the display automatically returns to its operating mode.

  i. i -w 1 1 / normal operation. This prevents the unit 66 from getting stuck in a test mode in the event of a switch failure. When the switch is released, the display unit 66 returns to normal operation. All errors are detected and classified as

  failures of the display unit by automatic BIT equipment.

  The center of gravity display and fuel totalizer unit 68 is shown in FIG. 10, and the circuit of this unit is represented by the schematic diagram.

  of Figure 11. The total fuel, expressed in pounds or kilograms, is displayed on the liquid crystal display (LCD) 160.

  A gross weight in the absence of fuel (ZFW) is indicated on the display 162. The reading of the raw ZFW can be set by the operator using the potentiometer 164. At the top of the display 15 68, finds the center of gravity reading 166 in the absence of fuel (ZFCG), which is represented as a percentage of the mean aerodynamic chord (MAC), or average profile. This reading is adjustable by means of the ZFCG potentiometer 168. Just below it is a bar graph display 170 which produces an analog indication of the front-rear imbalance between a "FWD LIM" front limit and a rear limit. "AFT LIM", as determined from the fuel mass readings from the various tank units. The display unit 68 comprises

  also a BIT display 172 for indicating detected failures.

  The circuit relating to the center of gravity and total fuel display unit 68, as shown in FIG. 11, is similar to that of the fuel quantity display unit 66, shown in FIG. 9, except that there are two display-data sections for the two types of data that are displayed and that there is also a section

* data transmission to the system that starts from unit 68.

  Information on the gross weight of the aircraft in the absence of fuel (the fuel tanks are empty) and the center of gravity in the absence of fuel is provided from the chart of the mechanic by the manipulation of the potentiometers 164 and 168. The voltage of the potentiometers is converted into digital signals in the analog-to-digital converters 180, 182, which signals are temporarily stored in shift registers 184, 186 and are transmitted for storage in the intermediate device by transmitters 188, 190. These data are immediately returned by the intermediate device to the PDM receiver 192, where they are directed to shift registers of the data storage block 194 and applied to the six-digit gross weight display. (GW) 162 and the three-digit display of ZFCG 166. The stored signals are also sent back to the intermediate device via the PDM 196 to be compared with the data stored in the memory of the

  intermediate device and be checked.

  The total fuel amount and center of gravity data are sent from the intermediate device to a pair of PDM receivers 200 and 202 and are stored in shift registers in the respective data storage blocks 204 and 20. 206. Block 204 stores the dynamic center of gravity and total fuel data and provides this data to the bar graph display 170 of the center of gravity and the display device 160 of the total fuel. The block 206 stores the data relating to the display BIT and applies this data to the display device BIT 172. The two blocks 204 and 206 also apply the data to a PDM transmitter 208 for retransmission to the intermediate device so that they are compared with the data previously sent and that a verification of the accuracy and a detection of failures is carried out. Regulated voltage supplies 210 and 212 provide electrical power to each of the blocks in the display unit 68 from

  the general power supply offered via the intermediate device.

  Generators BITE 214 and 216 have the function, from the start

  voltage, check all the particular blocks within the display unit 68 as follows.

  -35 The center of gravity and weight display unit

  68 has three forms of integrated verification - the audit

  Power-up, automatic check, and triggered verification - to provide greater confidence in the accuracy of displayed values and to help locate a fault on a particular line replaceable unit (LRU). The verification of the power-on is triggered automatically at the time of the first application of the voltage and then the operation of the display unit 68 is checked. The automatic verification checks the general state of the circuit on the display. a basis of continuity. The triggered check is used to locate a failure on an LRU. The failure detected by any one of these three checks results in the operation of the BIT display device 172 and

  associated fault positioning.

  The verification of the power-on is identical to that described in relation to the circuit of FIG. 9. After the start of the verification of the power-up taking place in the manner described above, the test Service all segments of the display for approximately 15 seconds, confirming to the locomotive engineer that all segments of the displays are in good condition. The verification of system power up continues until

the end of his cycle.

  The automatic integrated verification of the display unit 68 is carried out continuously by looping on the intermediate device, as already indicated. The additional built-in verification circuit, or BITE, 218 also controls various conditions, such as detecting received data parity errors, exceeding the tolerance levels of power supplies 210 and 212, and interrupting data delivery by the controller. intermediate device. If any of these failures are detected, even temporarily, the BIT display 172 and its associated alarm are turned on, and the failure detection is communicated to the intermediate device to be there.

  stored and retransmitted to the display unit 68.

  The triggered integrated check begins when the operator depresses the display check switch which is placed on the browser board. This verification mode is

  identical to that described above in relation to the circuit of FIG. 9.

  Through the multiplexed junction probe providing separate readings for separate tank units, the existence of dual channel data processing throughout the system, and extensive audit procedures that are incorporated into the various sections of the system. equipment, the system has a notable ability to detect and locate failures while being able to provide visual information usable on fuel in the presence of failures, protection being provided against invalidation of the system as a result of the occurrence of a failure . The existence of complete redundancy by doubling the channels in the data processing modules constituting

  the system allows the system to operate on another channel when a failure has been detected in the first channel.

  The passage on the non-faulty channel is carried out under manual control from the pilot station or the LSDU. All circuits - which are common to more than one fuel tank are in the redundant position. The backup circuit is normally not energized except during the integrated check in order to reduce

  energy dissipation and aging of the circuits.

  The standard electronics module (SEM) controls the entire system and provides extended integrated checks (BITs) for locating a failure on a replaceable line unit (LRU) with a high degree of confidence. There are three types of built-in SEM verification equipment: check when power is turned on, check

  triggered and automatic check.

  At the time of the first application of the voltage, the verification of the power-up begins automatically.

  For about the first minute after applying voltage, both channels are energized and may heat up. During this time, test input signals are applied to the channel that is not selected by the channel switch, together with a simulated density signal. After about 1 min, a reading of

  amount of test fuel is calculated by the non-selected channel

  born, based on the simulation input signals. After that, the system automatically switches the same simulated test input signals to the other channel (the selected channel) and a test fuel quantity reading is calculated by this channel. The SEM 5 then cross-checks by comparing the test readings calculated by each channel. If these are in agreement (within acceptable tolerances), then it is verified that the channels are being exchanged appropriately. If there is a disagreement exceeding a predetermined amount, the channel furthest from the nominal test value is considered erroneous, and its failure is announced on the display devices placed in the cockpit. that is, the appropriate BIT alarm is turned on and the designated SEM channel is shown to be defective (see displays 104 and 108 in FIG. 8). After about 1 min, the power-on check is complete and the power supply for the non-powered channel

  selected stops automatically.

  The triggered integrated check is performed from the cockpit and serves to check the system globally and locate a detected fault on a particular LRU already.

  applied. A first part of this audit is the SEM verification which consists of locating a failure on the SEM.

  During this verification, the components in the reservoir (the units, compensators and hydrometers of the reservoir) are electrically disconnected from the system and simulated input signals replace them as above. These simulation signals are chosen to produce predetermined numbers on the display devices. The SEM then performs the normal measurements and calculations. The data is transmitted to the intermediate device and is looped back for verification. Any incorrect result indicates that the fault is in the SEM. In addition, during the SEM verification,

  the power supply is applied to the unselected channel.

  A failure detected in the spare channel is stored in the selected channel and is displayed on the appropriate horn. Since the problems related to the warm-up time:

:: -: - V;>

  :: -:: ^ g! ::: -:: :: -:: - 5. . ..

: ,, .. X

-: 7.: 0 ::,. 'L2. U.

D: -, -:? 0: ':. - 10

L V :: '-a. R.i:: -,: D -.

-: 0 15

. -. :.,: 0 A :: - from: È:

:. f.

:.:

> r - 20 ::. -. 7

- '' '

*, 'E

.

0 | 25

M- X 0

  :. . ,, f: S. -a: b-: 0 f A. : .. r.P. ..:. X: 35

: g :: t.

: 4 E:.

f .:. AT,.

-: - :: 0 ;:

  have been eliminated, wider tolerance limits are applied for the detection of a failure in the unselected channel. Thus, SEM verification applies to both channels of the SEM.

  The other part of the triggered integrated check is the C check, which is used to locate faults on the units or tank trim. Verification C is identical to Verification of SEM, except that the compensator using the reservoir is used. During verification C, the SEM again returns data for checking. Any incorrect result indicates that the tank trim is faulty. When the SEM check or the C check is performed, a properly functioning system has display devices that indicate a fixed value for the amount of fuel (e.g. 20 t - 0.1 t).

  The automatic integrated check is performed under SEM microprocessor control and continuously monitors various system functions while providing warning signals to the operator in case of malfunction. The automatic checks are carried out during each update cycle, as follows.

  In the verification of the compensator, it is verified that the compensator placed in the tank has a capacity value which is within acceptable limits of tolerance imposed by the characteristics of the fuel. If the tank units indicate the presence of fuel, the compensator shall be at its wet value, within tolerance limits taking into account normal variations in fuel characteristics. If the tank units indicate the absence of fuel, then the compensator does not have a value exceeding its maximum wet value, nor should it have a value lower than its minimum dry value. Detecting a compensator failure causes the indicator to replace the failed value with a fixed compensation value, and the failure is announced on the proper display. In this mode, the display continues to work but has an uncompensated measurement.

  The verification of the tank units indicates whether these units have values within predetermined tolerance limits. These tests detect the existence of open circuits and short circuits in the tank wiring and in the tank units when results exceeding the limits are obtained. In addition, tank units or interconnecting wires in circuit. open or short circuit causing no exceed limits can be detected using rate of change constraints that are imposed on the processed data. A sudden change in the measured signal, which can be determined by comparison with an average running value for this tank, leads to the detection of a tank failure. In addition, the

  Verification of the integrity of the tank unit signals can detect the presence of unacceptable concentrations of water or impurities affecting the accuracy of the displays.

  The multiplexed junction probe provides a measure for each particular tank unit and, if it is found that a tank unit measure is less than half the dry value of the smallest tank unit for 20 minutes. two successive cycles of measurements, this tank unit is considered defective. Data from faulty tank units are not used in fuel mass measurements, but a predetermined value derived from the height-volume curve for that tank is used in its place. Detecting a defect for a tank unit activates the BIT alarm and activates the BIT display, thereby identifying the tank unit concerned. The density meter undergoes a similar check, i.e., it is determined whether the received data is within acceptable tolerances, which are dictated by the fuel characteristics and filling techniques. Any fault detected causes an appropriate fault warning to come on and causes the replacement

  the wrong signal by a predetermined value.

  The Hi-Z signal integrity is examined to verify that the waveform is within acceptable limits. In connection with the verification tests of tank units and densimeters, the Hi-Z signal check serves as a redundant check of the external wiring, as well as the

signal generator circuit.

  The analog signal conversion circuit 5 in the SEM undergoes periodic checks by applying a pair of reference voltages (a "low verification" voltage and a "high verification" voltage) to the demultiplexer which precedes the converter. YEAR. These high and low verify reference voltages check for the respective existence of offset and slope errors on the A / D converter. The microprocessor of the SEM verifies that the resulting signals associated with the reference reference voltages are

  are within acceptable tolerances. Each DC power supply undergoes a similar check to determine whether the voltages of the power supplies are within acceptable tolerance limits.

  The digital circuit RAM of the SEM is verified by sequentially loading alternate values of "ones" and "zeros" in segments having a check table pattern. This test is nondestructive with respect to the content of the memories, since a segment is always reserved for the preservation and restoration of the data of the segment under test. The total program of the fixed memory (ROM) is checked by a checksum and a comparison with the stored value. Sequence control timers are used to control the maximum time and minimum operating time of the microprocessor. The timer associated with the maximum time ensures that the microprocessor will not remain "in the air", failing to execute its program in a predetermined time. The timer associated with the maximum time is periodically repositioned by a specific sequence of output signals that are absent when there is a microprocessor execution time failure. If the maximum timer repositioning sequence is absent, the failure is detected. A minimum time timer is used to prevent erroneous looping of the program by setting a

  minimum completion time of program.

  The loopback function results from the fact that all outputs (including data buses) are "looped", that is, sent back to a microprocessor input.

  the output signal is compared with a known value corresponding to what the output signal should be. Thus, if an output circuit fails, this is detected.

  The series of verifications described above produces a configuration in which virtually all major functional sections of the system are verified by at least two or more independent BIT tests. Corresponding BITs are activated by the detection of failures, which are stored in the permanent memory of the SEM and the intermediate device. The BIT horns can be cleared by actuating a BIT erase switch which is placed in the cockpit on the mechanic's panel. Due to the storing of detected failures (which include possible intermittent failures) in the permanent memory, the information regarding intermittent failures is retained even after being disconnected, which substantially aids troubleshooting of maintenance. of the system. In addition, failure detection is extremely reliable and a high degree of confidence in the displayed values can be given. Therefore, in addition to the greater accuracy of the fuel quantity readings that are provided by the system of the invention, so that lower fuel reserves are sufficient to ensure a flight, the aircrew can work with trust

closer to the desired reserves.

  The charge selection display unit (LSDU) 69 is depicted in FIG. 12 and its circuit is shown in the block diagram of FIG. 13. This unit is usually located at a convenient location of a flight wing. the aircraft where the indicators are visible to the ground personnel responsible for filling the aircraft. For each tank, there is a fuel quantity display device 230 and a fuel selection display device 232. The value appearing on the fuel selection display 232 is adjusted by means of a setting knob 234, and this effectively determines the amount of fuel that must be in the corresponding tank. after filling. The circuit associated with the fuel selection display device 232 controls associated fuel supply valves (not shown) and closes the associated valve whenever the fuel quantity display device 230 is read. A predetermined range of reading of the fuel selection display device 232. The LSDU 69 also includes a display verification switch 238, a system verification switch 240, an indicator of

  failure 241 and a cross exchange switch 242 of the channels.

  In connection with FIG. 13, it can be seen that the circuit of the LSDU comprises two identical channels 1 and 2. Each channel comprises a microprocessor-controlled digital circuit 250 which is coupled to receive input signals from the potentiometers. load selection system, controlled by the adjustment buttons 234 (FIG. 12), and provides signals for exciting the fuel quantity display devices 230 and 232; rant and fuel selection. The circuit 250 also receives tank data from the SEM, when the corresponding channel is active. It demultiplexes this data and applies the demultiplexed data to the display devices 230 and 232. It digitally formats the analog signals from the load selection potentiometers 64, compares with the data received from the SEM. and, at the appropriate time, produces the signal that actuates the fuel shutoff valves. Each channel also has a power supply that is energized by the main power supply of

  the aircraft (alternating current under 115 V).

  The LSDU 69 Verification Switches 238 and 240 correspond to identical verification switches in the mechanic's chart and allow the filling staff to perform various verifications, including a LSDU display check and a system check, which can

  be carried out by the mechanic as indicated above.

  Of course, those skilled in the art will be able to imagine, from the description that has just been given of the invention, various variants and modifications that are not outside the scope of the invention.

- \ 0

  : = :. X '. / - v; : \: 0 :: n i_ c 7 -s: a:: D:: 10 0: 0::; E

: - 15

s: 0 ':.

>; 25

,:: - ::,

> -> - 30

: ::

0 0 35

: 0 I g9g8802

Claims (53)

  A multiplexed junction probe fuel gauging system for aircraft having at least one fuel tank having multiple fuel detection units, characterized in that it comprises:   a plurality of elements (15, 16, 18) * within a tank for detecting the presence of fuel and producing signals corresponding to a fuel measurement; a signal processing apparatus (60, 62, 66, 68) on board the aircraft for converting analog data signals into digital values corresponding to the measured fuel quantity; a junction sensor (14) installed in a reservoir and having a circuit which connects, separately, to the various elements mounted in the reservoir, the junction probe also being coupled to the signal processing apparatus by a path of common signals; a first circuit incorporated in the junction probe for electrically energizing said elements; and a second circuit incorporated in the junction probe for measuring each element in a predetermined sequence and forming a stream of analog signal data corresponding to the signals from said elements for transmission to the signal processing apparatus via said common signal path.   2. System according to claim 1, characterized in   the elements mounted in the reservoir comprise a plurality of tank units (15) placed inside a tank for detecting the level of the fuel and a compensation capacitor (16) placed inside the tank for producing signals proportional to the density of the fuel.   3. System according to claim 1, characterized in that it further comprises a second junction probe installed in a tank with the junction probe mentioned first in a maitreesclave combination, the second junction probe comprising means for exciting electrically a distinct plurality of tank mounted elements associated with the second junction probe and measuring the associated elements in a predetermined sequence to form a stream of analog signal data corresponding to said measurements for application to the first junction probe; the first junction probe further comprising a slave receiver (58) for receiving signals from the second junction probe and incorporating them into the stream of analog signal data created by the first junction probe for transmission to the treatment device of signals.   4. System according to claim 1, characterized in that the signal processing apparatus comprises several identical processing channels (A, B), one of which can be selected to operate actively, each channel being coupled to receive the current. sequential analog signal data on said common signal path and having a circuit for digitally converting the analog signals and storing them   the resulting numerical values.   5. System according to claim 1, characterized in that the signal processing apparatus comprises a standard electronic module (60) coupled to the common signal path, display means (66, 68) for displaying the signal. measured quantity of fuel, and an intermediate device (62) coupled between the standard electronic module and the display means   in order to receive output signals from the standard electronics module and to process the signals for application to the display means.   The system of claim 5, characterized in that the standard electronics module and the intermediate device each comprise a pair of identical signal processing channels (A, B), one of each pair being selectable as a channel actively working and the other being a spare channel.   7. System according to claim 6, characterized in that multiple fuel tanks are provided and in that they comprise at least one junction probe placed in a tank and several associated elements placed in each tank, the system further comprising means that couples the common signal path from the junction sensor in each reservoir to the two channels of the channel pair of the standard electronics module.   8. System according to claim 7, characterized in that the elements mounted in the tank comprise a plurality of tank units and a compensator in each tank and in that the system further comprises a densimeter (18) placed in at least one of the tanks. fuel tanks and a means that couples the densimeter of each tank to the two channels of the pair of   standard electronics module channels.   9. System according to claim 8, characterized in that it further comprises means placed in the standard electronics module for calculating the true mass of the fuel measured from signals indicative of the volume of fuel in   a given reservoir and signals emanating from the densimeter of this reservoir.   10. System according to claim 9, characterized in that it further comprises means placed in the standard electronics module and used to calculate the center of gravity from separate signals from each of the mounted elements.   in the tank and predetermined signals indicating the selected parameters of the aircraft.   11. System according to claim 10, characterized in that each channel of the standard electronic module comprises buses for transmitting signals indicating the mass.   true and the center of gravity to the intermediate device.   12. System according to claim 11, characterized in   each channel of the intermediate device comprises means for receiving said bus signals from the standard electronic module and separating the signals from the true mass and the center of gravity for display on means for corresponding display.   13. The system of claim 12, characterized in that it further comprises a plurality of input means arranged on an array of the aircraft intended for an operator which serve to selectively introduce modes in the intermediate device for transmission. to the standard electronics module. 14. System according to claim 13, characterized in that the intermediate device and the standard electronic module further comprise means for storing said modes and in that said module comprises means for combining the measurements of the center of gravity of the fuel with corresponding signals from the center of gravity in the absence of fuel that   are issued from the operator panel to produce the display of a center of gravity of the aircraft corresponding to the distribution of the fuel.   15. System according to claim 14, characterized in that the display means comprise a first display unit which has a means for displaying the center of gravity of the aircraft in the form of a percentage of the average profile obtained at from an input signal, coming from the operator's chart relating to the state of the center of gravity in the absence of fuel and the distribution of the mass of fuel that is   calculated in the standard electronics module.   16. System according to claim 15, characterized in that the first display unit also comprises an analog display in the form of a bar graph of the percentage of the   average profile between front and back boundaries.   17. System according to claim 16, characterized in that the first display unit also comprises a display for indicating the total amount of fuel   embedded as calculated in the standard electronics module.   18. System according to claim 17, characterized in that the first display unit also comprises separate potentiometers which are accessible to an operator and which serve to manually introduce into the intermediate device signals corresponding to the center of gravity in absence.   fuel and weight at the absence of fuel weight.   19. System according to claim 12, characterized in that the display means further comprise several second display units, one for each tank, for displaying the mass of fuel contained in the corresponding tank as it has been. calculated in the standard electronics module. 20. System according to claim 19, characterized in that all the display units of the tanks are consti tuted according to a common configuration, each display unit   tank is programmed from the outside to operate with the tank to which it corresponds.   21. System according to claim 19, characterized in that each tank display unit comprises means 15 for displaying the mass of fuel, the density of the fuel, and the capacity of the particular units mounted in the tank,   according to the selection made by an operator, based on signals from the standard electronic module transmitted via the intermediate device.   22. System according to claim 19, characterized in that each tank display unit comprises warning means for indicating the detection of failures and the location of a detected fault in any of the following parts of the system. : junction probe, master or slave; compensator, right or left; hydrometer; standard electronics module, channel A or B; intermediate device, channel A or B, or common circuit; tank display unit; power supply voltage display unit; and any of the units mounted in the corresponding fuel tank. 30 23. System according to claim 19, characterized in that each tank display unit comprises an alarm serving to give the warning of a lateral imbalance of the center of gravity which is due to the distribution of fuel such as   calculated in the standard electronics module.   24. System according to claim 12, characterized in that it comprises a redundant return bus between the standard electronic module and the intermediate device, the bus serving to send signals from the intermediate device corresponding to those sent to the intermediate device. from the standard electronics module and means located in the standard electronics module for comparing the returned signals with corresponding signals stored therein for the purpose of detecting any difference between the two signal groups and producing a signal of failure detection when a deviation is detected.   25. System according to claim 24, characterized in that it comprises a return bus which extends between the display means and the intermediate device and means placed inside the intermediate device for comparing the signals returned with signals. stored therein in order to detect any difference between the two groups of signals and to produce a fault detection signal when a deviation is detected.   The system of claim 1, characterized in that the first circuit of the junction probe comprises a timer and control circuit which responds to timing signals from the standard electronics module by generating the data current of analog signals in a predetermined sequence. 27. System according to claim 26, characterized in that said timer and control circuit comprises means for injecting calibration signals into the signal sequence of the elements mounted in the tank for use in the detection of a signal. derives from the signal reference level   analogous due to variations in circuit parameters related to use.   28. System according to claim 27, characterized   in that the standard electronics module includes means for controlling the calibration signals and automatically adjusting the reference levels of the analog signals to include the detected derivative therefor.   29. System according to claim 19, characterized in that it comprises an integrated verification equipment (BIT) for verifying each of the channels of the standard electronic module, the intermediate device, the display unit of selecting the load and each of the components of the first and second display units at the time of application of a power supply to the system and in response to the triggering   0 0-; the verification of the system by an operator.   30. System according to claim 29, characterized in that the integrated verification equipment comprises means for applying simulated signals of elements mounted in the reservoir and of densimeter to each, one after the other, standard electronics module and comparing the corresponding verification readings as calculated in the respective channels to detect failures in the parts calculating the true mass and the test centers.   gravity of the standard electronics module.   The system of claim 30, characterized in that the integrated verification equipment further comprises means for comparing received tank compensator signals with predetermined allowable limits for said signals and producing a signal indicative of a failure at a corresponding tank display unit upon detection of a tank compensator signal which out of said acceptable limits.   32. System according to claim 31, characterized in that it further comprises means for substituting a fixed compensation value for the signal emanating from a tank compensator in which a failure has been detected so that the quantity measurement fuel is not invalidated by   detecting a failure in a tank compensator.   33. System according to claim 29, characterized in that the integrated verification equipment comprises means placed in the standard electronics module and used for emma; To gas a current average of signals from the respective elements mounted in the tank and to compare the different   signals with said current average for detecting a sudden change in the measured signals and providing the display of a corresponding failure.   34. System according to claim 11, characterized in that it further comprises a load selection display unit for receiving fuel quantity signals from the standard electronics module and providing the display. a quantity of fuel to an operator at level of a filler panel.   35. System according to claim 34, characterized in that the charge selection display unit comprises several display modules, one for each tank; each module having a fuel quantity display and an adjustable fuel selection display for controlling the amount of fuel to be added to the corresponding tank. 36. The system of claim 35, characterized in that the load selection display unit comprises a pair of identical data processing channels and a cross exchange switch for selecting the channel to be put into service. 37. System according to claim 19, characterized in that the first and each of the second display units comprise means for storing fuel quantity data and failure indication data and means coupled to the medium. stored and used to activate displays   corresponding to the display unit.   38. System according to claim 37, characterized in that it further comprises a return bus extending between each display unit and the intermediate device in order to return sequentially stored data to the intermediate device for the purpose of comparison. with the data previously delivered by the intermediate device to thus detect   the existence of discrepancies between the compared data.   39. System according to claim 9, characterized in that it further comprises a means placed in the module: A :: 0 e: f ::; - -: \ -: 0 ::: 0 - S :: l ::: - A 0:   : A :: :::: ::: X -!: - An o ''.,: 7 r. S ... f: - 0 t. 1 D 'g: -. :: : - 2 . f * \: -i f:, ::. D: - :: d:. :, * X - :: - 31 . X:: - 9 > - f. :::, 0. 3,. : ':: 0:   In order to produce signals indicative of the fuel surface plane in a given tank from separate signals from different elements mounted in the tank, to determine the effective attitude of aircraft from the relationship between the fuel surface plane and a wing reference plane, and to modify fuel quantity data signals digitally   in view of their transmission to the intermediate device and the load selection display unit to compensate for said predetermined effective attitude of the aircraft.   40. System according to claim 16, characterized in that the front and rear limits vary with the input signal.   raw weight data from the aircraft from the operator's table, as determined by the standard electronics module.   41. System according to claim 28, characterized in that the standard electronic module comprises a clock synchronization means for producing synchronization signals intended for the timer and control circuit.   located in the junction probe.   42. System according to claim 30, characterized in that it further comprises means for checking one by one the successive units in the reservoir and, in case of detection of a defective tank unit, to substitute a predetermined signal value deduced from a curve height relative to this reservoir to the signal to be used in the calculation of the fuel mass.   43. System according to claim 30, characterized in that the standard electronic module and the intermediate device comprise a permanent memory used to store 0 indications of equipment failures detected during the verification without loss of said indications of   failures stored when the power supply is removed.   44. A multiplexed junction probe for use in the system of claim 1, the probe, which is intended to be installed in an aircraft fuel tank, being characterized in that it comprises: a circuit (30, 32, 34) for separately coupling the different elements (15, 16, 18) mounted in the reservoir and coupling the common signal path leading to the signal processing apparatus (60, 62, 66, 68); a first circuit for electrically exciting elements mounted in the tank; and a second circuit for measuring each element in a predetermined sequence and forming a stream of analog signal data corresponding to signals from said elements for transmission to the apparatus   signal processing on said common signal path.   45. The probe as claimed in claim 44, characterized in that it further comprises a second multiplexed junction probe 15 which is coupled with the junction probe mentioned first in a master-slave combination, the second junction probe comprising a means for electrically exciting a separate plurality of tank mounted members associated with the second junction probe and for measuring the associated elements at a predetermined frequency to form a stream of analog signal data corresponding to said measurements for their application to the first junction probe; the first junction probe further comprising a slave receiver (58) for receiving signals from the second junction probe and incorporating them into the analog signal data stream produced by the first junction probe in order to from their transmission to the device of signal processing.   46. The probe as claimed in claim 44, characterized in that the first circuit comprises a timer and control circuit which responds to synchronization signals emanating from the signal processing apparatus while producing the current.   of analog signal data in a predetermined sequence and separately in time. 25988'02   47. The probe as claimed in claim 46, characterized in that the timer and control circuit comprises means for injecting calibration signals into the sequence of element signals mounted in the reservoir in order to use them to detect the drift of the reference level of the analog signals which is due to variations in the parameters of the circuit   as and when used.   48. Junction sensor for installation in the fuel tank of an aircraft to produce fuel quantity measurement signals. existing in the tank, characterized in that it comprises: means (30, 32, 34) which provide the coupling *. separate with a plurality of fuel detection elements (15, 16, 18) mounted within the tank; means for electrically exciting the elements mounted in the tank via a common connection with a first side of each of said elements; and a multiplexer coupled to different lead wires connected to the other side of each of said elements, said multiplexer being arranged to measure the level of the signal present on each of the different lead wires in a predetermined sequence and produce a stream of analog signal data corresponding according to said sequence on one of its outputs. 49. A junction probe according to claim 48, characterized in that it further comprises a timer and control circuit for exciting the multiplexer so that it measures said signals according to said predetermined sequence in response   to the application of a synchronization signal.   50. A junction probe according to claim 49, characterized in that it further comprises a transmission line control stage coupled to receive the output data stream of the multiplexer and to apply a current of analog data corresponding to an output signal path common.   51. Combination of two junction probes according to claim 50, characterized in that they are interconnected in a master-slave configuration to be installed in the same fuel tank, the second junction probe (14) of the pair being configured to operate as a slave probe and being connected to a separate group of elements (15, 16, 18) mounted in the tank for producing a multiplexed signal data current as a function of the analog signals from the second group and applying the analog data current to the first junction probe (14) of said pair, the first junction probe being configured to operate as a master junction probe and further comprising a slave receiver (58). for receiving an analog data current from the slave junction probe, the first probe applying said data stream to the transmission line excitation positive of the master junction probe for combining with the data stream from the multiplexer of the master junction sensor, so that the transmission line driving device produces a junction current. analog output data which comprises the analog data currents of the   two junction probes in series with each other.   52. A junction sensor according to claim 49, characterized in that said timer and control circuit comprises means for injecting calibration signals into the signal sequence of the elements mounted in the tank for use therewith in the detection of a drived Jniveaude reference of analog signals that is due to variations in   circuit parameters over time.   53. Aircraft multiplexing fuel gauging system having at least one fuel tank having multiple fuel detection units, characterized in that it comprises: a plurality of elements (15, 16, 18) mounted within a fuel tank a tank for detecting the fuel and producing signals which correspond to a measurement of the fuel; 25988 02   a signal processing apparatus (60, 62, 66, 68) on board the aircraft for converting analog data signals to digital values corresponding to the measured fuel quantity; a multiplexer associated with a reservoir and having a circuit which couples separately to the various elements mounted in the tank, the multiplexer also being coupled to the signal processing apparatus by a common signal path; a first circuit incorporated in the multiplexer and serving to electrically excite said elements; and a second circuit in the multiplexer for measuring each element in a predetermined sequence and forming a stream of analog signal data corresponding to the signals from said elements for transmission to the signal processing apparatus via said common signal path. 1 o 1 1.